Britain’s security agencies are investigating whether hackers from a hostile state successfully targeted a personal Gmail account to access an explosive cache of correspondence that was seized on by Labour during the election campaign.

The leak inquiry into how the 451-page dossier got into the public domain is focused on the Department for International Trade. Jeremy Corbyn said during the campaign that the documents proved the NHS was “on the table” in future US trade talks.

Dominic Cummings, the prime minister’s chief adviser, warned ministerial special advisers at a meeting on Tuesday not to use personal Gmail accounts because “foreign powers” were targeting them.

Special advisers are not supposed to use personal accounts for government business but, in practice, some communications are conducted via private accounts, where security may be weaker because they are outside official networks.

It is not clear which country – if any – is behind the alleged hack, but independent analysts have already suggested that the cache was originally disseminated online by a Russian operation known as Secondary Infektion.

One source said the investigation was focused on events that may have taken place a few months ago.

An official spokesperson said the government was looking into the matter and added that the investigation involved the National Cyber Security Centre (NCSC), a division of GCHQ, saying: “It would be inappropriate to comment further.”

Downing Street blocked an analysis of the threat posed by Russia to the British democratic system written by MPs from the all-party intelligence and security committee from being published during the election campaign.

Immediately after the Conservatives were returned to power with an overall majority, No 10 said that the document had been approved for release, but claimed that publication had to wait for the committee to be formally reconstituted.

Existing guidance from the NCSC aimed at individuals involved in politics tells them to use a “strong and separate” password for their email accounts, and to use additional means of authentication, such as via a mobile phone, because of the risk that they will be targeted by hackers.

During the election campaign, Graphika, a social media research firm, examined the history of the cache of emails before they were picked up by the Labour leader in a dramatic press conference at the end of November.

Graphika said the full cache of emails was posted on Reddit by an anonymous Twitter user called Gregoriator, who in their initial writing made grammatical errors that matched those made by the Russian Secondary Infektion operation.

A Twitter user with the same name then tried unsuccessfully to disseminate it by tweeting it to various public figures including Labour and Liberal Democrat politicians and even to celebrities such as Stephen Fry and Bette Midler in October.

Graphika said the approach used matched amplification techniques deployed by Secondary Infektion, the name given to a Russian information operation exposed by Facebook earlier this year, operating across six languages and dozens of platforms.

Labour has not said how the full documents ended up in the hands of Corbyn, but a pressure group Global Justice Now has said it was alerted to their existence online after the party leader obtained a heavily redacted version of them. The opposition party has also pointed out that their authenticity was never denied.