Russian-linked hackers breach UK government accounts in major cyberattack

Russian-linked hackers have compromised the email accounts of UK government officials and overseas Foreign Office staff in a major cybersecurity breach, according to The Telegraph.

The report said the ongoing attack, dubbed "FortiBleed" by researchers, exploited a vulnerability in Fortinet firewalls to steal login credentials, potentially allowing unauthorised access to sensitive government systems. More than 80,000 Fortinet firewalls were reportedly affected globally.

According to The Telegraph, the leaked credentials include accounts belonging to Foreign Office personnel stationed overseas, local government officials, and IT staff at British embassies in Thailand and Mauritius. The stolen login details are reportedly being offered for sale on dark web forums for up to $60,000.

The report also said credentials linked to the UK's National Health Service (NHS), energy providers and pharmaceutical suppliers were among those exposed, raising concerns about possible attacks on critical infrastructure.

Dr. Saif Abed, a former NHS doctor and cybersecurity expert, warned of the potential consequences.

“NHS organisations, pharmacies, labs, and their suppliers are highly dependent on products like those compromised by FortiBleed,” he said. “This is exactly the type of hack that’s the first step for launching catastrophic ransomware attacks that can threaten patient safety across the country.”

Cybersecurity researcher Volodymyr Diachenko, who first identified the breach, said the attack could provide access to “core networks” within the UK Foreign Office and potentially affect other government departments.

The UK's National Cyber Security Centre (NCSC) has issued an alert confirming a “brute force” attack targeting Fortinet systems and urged organisations to audit their networks, isolate compromised devices and change default or reused passwords.

Officials said there is currently no evidence that the cyberattack was directed by the Russian state. However, the report noted that Russian-based cybercriminal groups have long been viewed by Western governments as operating with relative freedom inside Russia.

An NCSC spokesman said: “We have provided support to organisations in the UK affected by malicious targeting of Fortinet edge devices globally.”

“Organisations using Fortinet VPN and firewalls should change all default or reused passwords as set out by the advice available on the NCSC website.”

“To stay alert to malicious activity on your networks, the NCSC recommends signing up for its Early Warning service to gain potentially invaluable time to help detect and stop attacks.”

By Sabina Mammadli