Hackers steal UK Foreign Office logins, put government credentials up for sale on dark web

Login credentials belonging to employees of the UK's Foreign, Commonwealth and Development Office (FCDO), including staff stationed at overseas embassies, have reportedly been stolen by hackers and offered for sale on dark web marketplaces in what experts describe as a significant cybersecurity incident.

According to AzerNEWS, citing The Daily Telegraph, whose findings were cited by other British media, the compromised accounts include those of Foreign Office personnel based at British diplomatic missions in Thailand and Mauritius, as well as employees working for local authorities in Derbyshire and London's Waltham Forest borough.

The Sun reports that cybercriminals are advertising the stolen credentials, including email addresses and matching passwords, on dark web forums for as much as US$60,000 (£44,000), raising concerns that the information could be used to gain unauthorised access to sensitive government systems.

The breach is reportedly linked to a large-scale cyber campaign known as "FortiBleed," in which attackers exploited vulnerabilities affecting internet-facing devices manufactured by cybersecurity company Fortinet. Researchers say compromised credentials from previous data leaks were used to conduct automated "brute force" attacks against government and corporate networks.

Cybersecurity researcher Volodymyr Diachenko warned that the stolen credentials could potentially provide attackers with access to core government networks if adequate safeguards were not in place. The UK's National Cyber Security Centre (NCSC) has issued guidance urging organisations to review their systems and isolate any compromised devices.

While code associated with the operation reportedly contains Russian-language elements, and the stolen credentials have allegedly been advertised by a user operating under the alias "SantaAd," British officials have not publicly attributed the attack to the Russian state. Security agencies have previously warned that Russian cybercriminal groups often operate with tacit tolerance from the Kremlin, although no direct evidence of state involvement has been presented in this case.