Russian hackers steal government logins

On a warm July afternoon, as Westminster prepared for the usual churn of statements, briefings and political theatre, a less visible drama was unfolding in the machinery beneath the state. The compromise was not of a minister’s phone or a high-profile database, but of something more quietly consequential: the usernames and passwords that allow officials to move through the government’s digital corridors without drawing attention. According to evidence reviewed by security researchers and cited by The Telegraph, login credentials linked to the Foreign Office and to local authorities have been gathered and are now being marketed in criminal forums for sums reaching $60,000, roughly £44,000. The asking price signals not only scarcity but perceived strategic value. Access, in this case, is the commodity.

The operation has been nicknamed “FortiBleed”, a label that captures both the method and the implication: a slow, persistent loss from a device that many organisations treat as a protective seal. The entry point is said to be a vulnerability affecting Fortinet firewalls, widely used pieces of security infrastructure intended to sit at the boundary between trusted internal networks and the unruly outside world. More than 80,000 such firewalls are reported to have been compromised. It is a startling figure for any single campaign, yet it also reflects the contemporary paradox of cyber security: the very products bought to reduce risk can, when flawed or poorly maintained, become risk’s most efficient amplifier.

What distinguishes this episode from the background noise of phishing emails and opportunistic scans is the focus on credentials, and the suggestion that they enable access to email accounts and associated systems in ways that may be hard to detect. An attacker who has stolen a password does not need to smash a door down; they can stroll through it, appearing to be a legitimate user. That is what makes credential theft so prized and, in the context of government, so unsettling. If authentication fails, the downstream harm does not depend on any cinematic hack, only on routine administrative privilege misused at scale.

The accounts reportedly exposed include those of Foreign Office staff posted overseas and local government officials in Britain. Among the examples cited are IT personnel at British embassies in Thailand and Mauritius, alongside staff connected to Derbyshire and the London Borough of Waltham Forest. It is easy, particularly for those accustomed to focusing on Whitehall’s centre, to dismiss local authorities or overseas administrative roles as peripheral. In cyber terms they rarely are. Councils hold sensitive personal data, manage procurement, and maintain links to contractors whose own security may be uneven. Embassy IT staff may have broad permissions over networks that connect local systems to the wider government estate. In a networked environment, the value of an account lies less in the seniority of its owner than in what it can touch.

The Telegraph reports that the attackers exploited the Fortinet vulnerability while using valid credentials from previous leaks to bypass protections and, in effect, turn compromised devices into collection points. That detail matters because it speaks to a layered approach: the exploitation of a technical weakness combined with the recycling of known passwords and email addresses, relying on the stubborn habit of reuse and the lag between a leak and a full reset of organisational hygiene. Cyber security professionals have long warned that old breaches do not expire. A password stolen years ago can remain potent if a user has carried it from job to job, or if an organisation has not enforced robust multi-factor authentication and regular credential rotation. The past, in this domain, is never really past.

An additional note in the reporting is that the code analysed is written in Russian. This is suggestive rather than dispositive. In cyber conflict, language can be a clue, but it can also be a costume. Still, the broader context is difficult to ignore. Britain’s intelligence community has repeatedly spoken of the ecosystem of Russian-speaking criminal groups, and of the blurred lines between outright state operations and tolerated, sometimes encouraged, freelancing. The Telegraph notes that there is no evidence of state involvement in this breach. That caveat should be taken seriously, not least because attribution without proof corrodes public trust and can lead to policy made in anger rather than evidence. Yet it is equally true that the strategic effect of such campaigns, whether directed or merely permitted, is to keep adversaries off balance, to impose costs, and to foster the sense that the digital realm is a space where the normal rules of sovereignty do not apply.

The market for stolen access is a further indicator of where cybercrime now sits in relation to geopolitics. Criminal forums offer a kind of outsourced intelligence capability: a place where a state actor, if it wished, could purchase access without leaving fingerprints, and where non-state groups can bankroll further campaigns. The name “SantaAd”, the handle reportedly used by an operator offering access to the stolen credentials, is not especially informative, but the behaviour is. The transaction is framed not as a one-off dump of data but as a sale of entry, implying continuing exploitation and a product that may be refreshed and maintained. That is the hallmark of an industrialised criminal economy, not a teenage stunt.

Particularly troubling is the breadth of institutions reportedly caught in the dragnet. The Telegraph says the credentials offered for sale include those linked to the NHS, energy providers and suppliers of medicines. These are not simply large organisations with deep pockets; they are systems of national life, and their failure is measured not in inconvenience but in harm. Dr Saif Abed, a former NHS doctor now working in cyber security, is quoted warning that the breach could be the first step toward catastrophic ransomware attacks that threaten patient safety. The phrasing may sound dramatic, but recent history lends it credibility. Healthcare is among the most vulnerable sectors precisely because it cannot easily stop. Hospitals cannot close their doors to patch servers. Laboratories cannot halt testing without clinical consequences. That operational urgency, which is a sign of moral purpose, becomes in cyber terms a point of leverage.

Britain has already had a grim tutorial in how cyber attacks on health-linked suppliers can cascade. The Telegraph references the June 2024 attack on Synnovis, a pathology services provider, which led to the cancellation of more than 1,000 operations and 2,000 appointments. The lesson of such incidents is not simply that criminals cause disruption, but that the modern public sector often depends on a web of third parties whose resilience may not match the importance of the service they underpin. When a laboratory network fails, the effect is felt in wards and theatres, in delayed diagnoses and altered clinical decisions. It becomes a public health issue as much as an IT incident.

The National Cyber Security Centre has issued an urgent alert confirming what it describes as a “brute force” attack on Fortinet systems and advising organisations to audit networks and isolate breached devices. Such guidance is necessary, but it also illustrates a persistent dilemma. Britain has competent cyber agencies and a well-developed advisory apparatus, yet the pace of patching and the discipline of credential management across thousands of organisations remain uneven. Local councils, small NHS trusts, and smaller suppliers may lack the resources to implement best practice quickly, particularly when legacy systems and outsourced contracts complicate accountability. In that environment, an advisory alert can resemble a fire warning delivered to a building where some occupants do not have functioning sprinklers.

The suggestion that the attackers used previously stolen data to bypass security perimeters also points to a mundane but decisive factor: password culture. For years, public campaigns have urged individuals to use unique passwords and enable multi-factor authentication. Within organisations, particularly large ones, the challenge is harder. Staff turnover, contractor access, and multiple legacy systems create a landscape in which identities proliferate and are not always retired cleanly. The problem is not merely the existence of one weak password but the presence of systemic gaps through which an attacker can move laterally. Once inside, email access can be used to harvest further credentials, intercept sensitive conversations, and craft convincing internal messages that trigger yet more compromise. The damage compounds quietly, until it becomes visible in a ransom note or a sudden outage.

The Foreign Office, like other departments, operates in a complex security environment. Overseas posts vary in connectivity, local infrastructure, and exposure to hostile attention. The presence of compromised credentials linked to embassy IT staff is therefore more than an embarrassment. It raises questions about segmentation, about whether an account used for one purpose can reach systems of greater sensitivity, and about how quickly anomalous logins can be detected across time zones and jurisdictions. It also touches on a perennial tension in government technology: the need for secure communications in a world that demands constant, rapid information flow. The more frictionless the system is for the user, the more valuable it becomes to the intruder.

Local government faces a different but related set of pressures. Councils have endured years of tight settlements, rising demand and an expanding statutory load. Cyber resilience competes with social care, housing and highways for funding, and tends to lose because its successes are invisible. A council that patches diligently and enforces strict access controls does not get a ribbon-cutting ceremony. A council that fails does, however, attract headlines, regulatory scrutiny and, in the worst cases, human cost if services are interrupted. The exposure of credentials linked to councils in Derbyshire and Waltham Forest, as reported, should therefore be read as a warning about the fragility of the local state’s digital scaffolding, and about how that fragility can be exploited to reach broader national targets.

The notion of a “national security breach” in this context is not hyperbole, but it should be understood properly. Not every compromised account yields state secrets. Yet the aggregation of access, combined with the chance to monitor communications, identify personnel, map networks and exploit trust relationships, can produce intelligence of real value. A single mailbox can reveal travel plans, internal frustrations, procurement intentions or the names of contractors working on sensitive projects. In cyber security, the marginal value of each additional data point is often greater than it appears, because it helps build a coherent picture. The state’s adversaries do not always need the crown jewels if they can instead gather enough small pieces to predict, influence or disrupt.

The Telegraph reports that Volodymyr Diachenko, a cyber security researcher, first identified the attack, and that it remains active. The ongoing nature of the exploitation is important. This is not merely a breach to be cleaned up; it suggests a campaign whose operators are still harvesting, still probing, and still likely adapting to defences. In such circumstances, remediation is not just a technical exercise but an operational one: prioritising which systems to isolate, how to maintain continuity, how to reset credentials without locking out legitimate users, and how to communicate transparently without revealing too much to the attacker. For institutions that depend on public confidence, that balance is delicate. Too much secrecy breeds suspicion; too much detail can invite copycats or reveal where defences are weakest.

It is also worth noting what the criminal pricing implies. An offer of tens of thousands for access signals that buyers expect significant return, either through extortion or through the ability to sell on. Ransomware groups, in particular, have become adept at targeting organisations for whom downtime is intolerable, and at tailoring demands to the perceived capacity to pay. If access to an NHS-linked system or a medicine supplier is genuinely in play, it becomes, from a criminal point of view, a lever with potentially brutal effectiveness. Even if the initial breach is opportunistic, the secondary exploitation can be ruthlessly strategic.

Government responses, when they come, tend to revolve around guidance, audits and calls for vigilance. These are necessary but often insufficient. The deeper issue is structural: the patching of widely deployed security appliances, the enforcement of multi-factor authentication across all users, the elimination of password reuse, and the ability to detect suspicious behaviour at scale. None of this is glamorous, and much of it is difficult to deliver in organisations where IT is a mix of modern cloud services, ageing on-premise systems and outsourced arrangements. Yet the alternative is to accept that the digital perimeter will be breached repeatedly and that the state will spend its time in recovery rather than prevention.

The question of Russia, raised by the language of the code and the broader ecosystem, sits uncomfortably in the background. The Telegraph notes previous warnings from GCHQ about growing links between Russian intelligence services and proxy hacker groups, and cites remarks made in 2024 by Anne Keast-Butler, then newly installed as head of the agency, about Russia nurturing non-state actors. Even without pinning this specific breach on the Kremlin, the strategic pattern is clear enough. In an era of constrained budgets and political attention pulled in many directions, cyber operations offer a comparatively cheap way to impose stress on adversaries, to gather intelligence and to demonstrate reach. They thrive in the grey zone between war and peace, where retaliation is uncertain and the public’s patience for abstract threats is limited until a hospital appointment is cancelled or a council’s services grind to a halt.

Britain’s vulnerability is not unique, but it is acute. The country is highly digitised, heavily outsourced and reliant on interconnected critical infrastructure. That interconnection is a source of efficiency, but it also means that a compromise in one place can reverberate widely. The reported scale of the Fortinet exploitation, and the apparent targeting of credentials rather than merely devices, should prompt a sober reassessment of how the public sector and its suppliers treat identity and access management. The attacker’s easiest route is often not through an exotic zero-day but through the accumulation of small, preventable weaknesses: a firewall unpatched, a password reused, a multi-factor prompt ignored, an account left active after a contractor has moved on.

In the coming days, the familiar choreography will play out: statements from agencies, assurances that systems are being investigated, perhaps a carefully worded note from a department or trust emphasising that there is no evidence of data exfiltration, at least not yet. The public may be tempted to view it as another episode in a relentless stream of cyber stories. That would be a mistake. Credential theft is not merely a leak; it is an enabling act. It allows the attacker to choose when and how to strike next, to return later under a legitimate guise, and to sell that choice to others. When the state’s logins become tradable goods, the question is not just who is inside today, but who might be invited in tomorrow.