[nikcub]

Based on the names mentioned I searched for their email addresses in password dumps and they all match the large 500M+ lists (anti public and exploit.in - covered here[0]) that have been available on some of the credential-stuffing and hacking forums since late last year. They are aggregate lists composed of MySpace, LinkedIn and other breaches.

It appears someone has grepped out parliament.uk emails from those leaks and then published it separately, the earliest mention of such a list that I can find online is from mid-May.

The credential stuffing and darkweb markets are full of such lists as the scammers attempt to make a dollar or two from content that is otherwise publicly available by slicing it in interesting or appealing ways.

I doubt any of the credentials would have worked against the parliament Office 365 login[1] as either the IT admins would have noticed, and/or the list is old enough where it would have been noticed far earlier plus Office 365 even without MFA enabled or enforced will usually require an email or SMS confirmation for a new device login or a login that doesn't match user pattern.

The story mentions they disabled logins, but it appears to still work. This is likely just a precaution from the IT department over what is a relatively minor issue since it is easier to pretend you're doing something rather than having to explain to the media that this is an old issue and not that big a deal.

[0] https://www.cert.govt.nz/businesses-and-individuals/recent-t...

[1] https://intranet.parliament.uk

[ryanlol]

http://sprunge.us/HIYa

It must be total chaos in the UK now! 110748 super secret government emails and passwords leaked on a hacker forum :P

[graystevens]

Yup, completely agree with this. I know I've mentioned it on HN before, but credential stuffing is unfortunately common practice and is a huge reason not to reuse passwords - especially if they've been leaked.

We see credential stuffing attacks regularly - some from folks just trying their luck (using known tools and scripts such as Sentry-MBA). Others are a little more advanced and persistent, looking to gather information from successful logins which they can then re-sell on the various shifty marketplaces.

Sites that have monetary value are particularly high value targets. If you have a site which reveals key personal information such as addresses and credit card info (last 4 etc.), these will likely be scraped. If you have a site that can order goods, successful accounts will be scraped to see if they have a valid and active card associated with them, allowing them to be sold for a higher price. If you have a site which collects points (think airlines or hotels), these too will be scraped and sorted, allowing them to market those with higher points for more cash.

Where possible, use 2FA, and always use a different password for each website. Password managers sometimes get a bad name, but they're much better than using the same password everywhere.