It appears someone has grepped out parliament.uk emails from those leaks and then published it separately, the earliest mention of such a list that I can find online is from mid-May.
The credential stuffing and darkweb markets are full of such lists as the scammers attempt to make a dollar or two from content that is otherwise publicly available by slicing it in interesting or appealing ways.
I doubt any of the credentials would have worked against the parliament Office 365 login[1] as either the IT admins would have noticed, and/or the list is old enough where it would have been noticed far earlier plus Office 365 even without MFA enabled or enforced will usually require an email or SMS confirmation for a new device login or a login that doesn't match user pattern.
The story mentions they disabled logins, but it appears to still work. This is likely just a precaution from the IT department over what is a relatively minor issue since it is easier to pretend you're doing something rather than having to explain to the media that this is an old issue and not that big a deal.
[0] https://www.cert.govt.nz/businesses-and-individuals/recent-t...
It must be total chaos in the UK now! 110748 super secret government emails and passwords leaked on a hacker forum :P
We see credential stuffing attacks regularly - some from folks just trying their luck (using known tools and scripts such as Sentry-MBA). Others are a little more advanced and persistent, looking to gather information from successful logins which they can then re-sell on the various shifty marketplaces.
Sites that have monetary value are particularly high value targets. If you have a site which reveals key personal information such as addresses and credit card info (last 4 etc.), these will likely be scraped. If you have a site that can order goods, successful accounts will be scraped to see if they have a valid and active card associated with them, allowing them to be sold for a higher price. If you have a site which collects points (think airlines or hotels), these too will be scraped and sorted, allowing them to market those with higher points for more cash.
Where possible, use 2FA, and always use a different password for each website. Password managers sometimes get a bad name, but they're much better than using the same password everywhere.
Constituents can email their MPs and I'd imagine they all share the same few email servers. It's not hard to imagine that someone thought they'd 'have a go' (as was the case during the election period), and the reaction by Parliament has so far been a precautionary one.
Not sure how that wouldn’t be treated as a cyberattack. Note, the word used was not ‘hack’ - not all cyberattacks are hacks.
> stolen data revealed the private login details of 1,000 British members of Parliament and parliamentary staff, 7,000 police employees and more than 1,000 Foreign Office officials.
That was reported last week. The attacks happened months ago. (Why do I even bother?)
How is that not critical infrastructure given legislators' need for secure and accessible communications?
To put it another way, pentesting is almost always the art of exploiting complexity. It's true that you can have a system that's both simple and broken, but that's the exception.
Two-factor authentication increases complexity in every measurable way but mitigates against a number of softer attacks.
Adding encryption adds a ton of complexity but effectively removes all man-in-the-middle attacks.
The simplest way of storing passwords is in plaintext.
Privelege separation is far from the simplest way of structuring a daemon, but it effectively prevents exploits in the complex parts from allowing an attacker to gain remote root access.
Perhaps it is more that superfluous complexity is the problem.
> British Parliament Hit by Cyberattack, Affecting Email Access
Clickbait title. Access to email has been disabled as a precaution because passwords were being trafficked and there were attempts to access accounts.
I don't think it's that simple.
There are two ways you can look at simplicity:
1. The lack of needless complexity, which is just another way of saying something is well built
2. Smaller modular components that do less and have clearer interfaces, ie: the unix way.
If you mean the 1st, then sure, the main reason systems aren't secure is lack of being well built.
But if you mean the second, all you're really doing is taking security concerns and spreading them out over more components. This makes them easier to reason about, but also means more entities need to reason about them. Like all things in engineering there are only trade offs, no pure wins.
The downvotes are just my regular stalkers.
Pentests can't catch everything, so a simple system costs less to secure.