Head of the UK’s National Cyber Security Centre says Russia is ‘seeking to undermine the international system’

This article is more than 2 years old

This article is more than 2 years old

Russian hackers attacked British media, telecoms and energy companies over the last year, the head of the UK’s National Cyber Security Centre has confirmed for the first time.

Ciaran Martin, the founding chief executive of the NCSC, declined to provide any further details of the attacks.

“I can confirm that Russian interference, seen by the National Cyber Security Centre over the past year, has included attacks on the UK media, telecommunication and energy sectors,” Martin said.

The NCSC, which is a branch of GCHQ charged with oversight of Britain’s cybersecurity, was “actively engaging with international partners, industry and civil society” to counter the threat, he said.

“Russia is seeking to undermine the international system. That much is clear. The PM made the point on Monday night – international order as we know it is in danger of being eroded.”

On Monday, Theresa May accused Russia of meddling in elections and planting fake stories in the media in an attempt to sow discord in the west.

“I have a very simple message for Russia,” May said. “We know what you are doing. And you will not succeed. Because you underestimate the resilience of our democracies, the enduring attraction of free and open societies, and the commitment of western nations to the alliances that bind us.”

An investigation by the Guardian revealed that more than 400 accounts from a list of 2,700, all named by Twitter as being run by a notorious Russian “troll agency”, had tweeted about Brexit in the run-up to and aftermath of the referendum.

One particular account managed to secure substantial mainstream coverage, stirring anger after the terrorist attack on Westminster in March this year.

In July, a leaked NCSC memo suggested that the UK energy sector had been targeted and probably compromised by “state-sponsored actors”, but declined to name a suspect nation.

The agency warned it had spotted connections “from multiple UK IP addresses to infrastructure associated with advanced state-sponsored hostile threat actors, who are known to target the energy and manufacturing sectors.

“NCSC believes that due to the use of widespread targeting by the attacker, a number of industrial control system engineering and services organisations are likely to have been compromised.”

A month earlier, in June, a cyber-attack on parliament breached dozens of email accounts belonging to MPs and peers.

Moscow was thought to be a “likely” culprit behind the attack, which simply attempted to guess the passwords to parliamentary email accounts. But a security source told the Guardian at the time that “the nature of cyber-attacks means it is notoriously difficult to attribute an incident to a specific actor”.