Over 126 million malicious emails have been fired at House of Commons (HoC) inboxes this year, a 358% increase on the total figure for 2020, according to new figures from Parliament Street.

The think tank obtained Freedom of Information (FoI) data from the UK parliament’s lower house, revealing a significant increase in potential threats over recent years.

The number of emails blocked by HoC filters in 2018 was just 15.7 million in 2018, nearly doubling to hit 30.3 million in 2019, but then dropping again to almost 28 million in 2020.

With 126.4 million malicious emails recorded up to September this year, Parliament Street reckons the total for 2021 could reach as high as 150 million.

However, there are no data on how many if any threats slipped past filters during this time.

Chris Ross, SVP international at Barracuda Networks, argued that the uptick in threats this year could result from attackers trying to target remote working civil servants via cloud infrastructure.

“All it takes is for one well-placed email to be mis-clicked before an entire organization is facing a severe breach of customer or company information, or even being held to ransom,” he added.

“Our analysis from 2020 revealed that public sector organisations are one of the biggest targets of ransomware attacks due to the sensitivity of the information stored on its servers, combined with the inherent weaknesses in some of their department’s security protocols.”

Tessian CEO, Tim Sadler, blamed phishing for the surge in email threats.

“Remote work meant employees were more reliant on email to stay connected with colleagues while verifying the legitimacy of an email became more difficult. It just takes one email to slip through the cracks, and one employee to fall for the scam to cause a serious security incident,” he argued.

“So, as phishing attacks continue to rise and become more sophisticated, businesses must empower people to be more resilient to these threats – providing them with the tools and knowledge they need to spot the scams and avoid falling victim – wherever they choose to work.”

The only major cyber incident in the Commons that led to compromised inboxes in recent years was an Iranian state-sponsored effort in 2017. However, even here, only 1% of 9000 inboxes were affected.

Security researchers claim to have saved BlackMatter ransomware victims millions over the past few months after exploiting a bug they found in the malware to recover files for free.

Emsisoft CTO, Fabian Wosar, explained in a blog post yesterday that the security vendor has been building decryption tools and services to help speedy recovery from ransomware for a decade.

One of its most fruitful efforts is to search for vulnerabilities in the code of ransomware variants and exploit them for the benefit of customers. However, for this scheme to work without alerting the ransomware developers, it must happen covertly.

“Publicly disclosing the existence of a flaw in ransomware can alert the threat actors to its existence, resulting in them immediately fixing the problem. Consequently, in the case of gangs that we believe to be technically sophisticated — such as DarkSide/BlackMatter — we do not publicly announce or disclose the existence of vulnerabilities,” said Wosar.

“Instead, we communicate our decryption capabilities in private via a network of law enforcement agencies and trusted parties. In our opinion, this approach enables us to help as many victims for as long as possible. Additionally, it creates an incentive for victims to report ransomware incidents to local authorities as they may, in return, be able to provide crucial intelligence from third parties such as us which avoids the need for ransom demands to be paid.”

This is what happened with BlackMatter, a mistake that reportedly cost the group tens of millions of dollars over several months.

Unfortunately, the group eventually realized what had happened and remediated the bug several weeks ago.

That said, Wosar urged BlackMatter victims to get in touch as Emsisoft may still help them. It has also identified flaws in around a dozen ransomware variants, saving victim organizations significant time, money and blushes.

The US authorities also released a new alert on BlackMatter last week, detailing recommendations for mitigating the threat.

Tesco’s groceries app and website are back up after a weekend of disruption for customers following a suspected cyber-attack.

The UK’s largest supermarket chain received a barrage of complaints on social media over the past two days as angry customers found they couldn’t place or track orders or change existing ones online.

Some said this had caused significant problems as they were self-isolating at home, and switching brands would mean paying for their shopping all over again.

According to reports, the retailer’s app and website went down early on Saturday local time but was back up around midnight on Sunday.

A spokesperson blamed the incident on a third party but claimed customer data is not likely to have been affected.

“Since yesterday, we’ve been experiencing disruption to our online grocery website and app,” they said in a statement.

“An attempt was made to interfere with our systems which has caused problems with the search function on the site. We’re working hard to fully restore all services and apologize for the inconvenience.”

Dominic Trott, UK product manager at Orange Cyberdefense, argued that the online hit to Tesco may have cost the supermarket dear at a time when digital sales comprise an increasingly large share of revenue.

“Over the past 18 months, we have seen an increase in threats against large organizations as a result of changes to the network permitter due to the adoption of flexible and remote working,” he continued.

“Employees now hold far greater responsibility with regards to company security. Their endpoint devices – such as company laptops or phones, or personal devices they connect to the corporate network – are all potential gateways for cyber-criminals.”

Ed Macnair, CEO of Censornet, argued that customer data was the likely target for attackers despite Tesco’s reassurances.

“A shopping trolley of data from Britain’s biggest supermarket is an attractive target,” he claimed. ““Hackers are looking for the weak link in the attack kill chain. It is why organizations need to urgently assess how their cyber-defenses can be more autonomous, more intelligent and better coordinated to best protect customer data.”

Tesco said it is using a virtual waiting room on the site at present to regulate high user demand.