Email addresses and passwords belonging to ministers of the British cabinet, ambassadors and police officers were stolen and sold online by Russian hackers, the Times reported.

Caught in the trove of login credentials, which included tens of thousands of government-related accounts, were the passwords and emails of Education Secretary Justine Greening, Business Secretary Greg Clark and the head of the Foreign Office’s IT department.

Read: US Election Hacked? Voter Rolls Altered, Data Stolen By Russian Hackers, Report Says

Two lists of credentials linked to UK officials made their rounds on the dark web, passed around on Russian-language hacking sites. In total, more than 1,000 British Members of Parliament, 7,000 police employees and 1,000 Foreign Office officials had information exposed in the stolen datasets.

The email addresses and passwords were reportedly for sale on various parts of the dark web and may have been traded several times. The lists have since been made freely available for anyone to access.

The stolen credentials are believed to have primarily come from a data breach that hit LinkedIn in 2012. According to breach tracking website Have I Been Pwned, more than 164 million accounts were compromised in the LinkedIn hack.

While passwords associated with LinkedIn accounts were encrypted, they were done so using the SHA-1 algorithm—an encryption method that has since been made essentially obsolete —that was quickly cracked. Many of the passwords included in the breach were compromised.

Read: Can US Elections Be Hacked? Security Experts Call For More Protections Against Election Hacking

Many of the passwords associated with British government officials were weak, which suggests the best password practices were not exercised. It’s possible that those officials have not changed their passwords since the 2012 breach or still use the password associated with their LinkedIn account for another account, which would increase the possibility of a victim in the breach being further compromised.

“You can be a minimum-wage employee, or the prime minister of the UK—it does not matter when it comes to passwords. We are all vulnerable to static passwords,” Ori Eisen, a cybersecurity expert and founder and CEO of identification management company Trusona, told International Business Times.

“If you knew that the keys to your home could be purchased, would you still be using the same lock? The same can be said about using static passwords. They are not secure and need to be completely removed from protecting online accounts,” Eisen said.

The incident is just the latest of apparently politically-motivated hacking carried out by hackers connected to Russia. A recent report suggested Russian government-linked hackers successfully breached elections systems in the United States to alter voter rolls and steal personal information from registered voters, including driver’s license and social security numbers.

A leaked document from the U.S. National Security Agency (NSA) published by the Intercept this month provided details into how Russian military-backed hackers targeted U.S. companies that manufacture election software and hardware.

The report found the attacks were successful in compromising at least one voting software maker, and that data was used to target at least 122 local election officials across the country in the days leading up to the presidential election.

Earlier this week, the Department of Homeland Security’s acting Director of Cyber Division of the department's Office of Intelligence and Analysis Samuel Liles told the Senate Intelligence Committee the intelligence community found 21 states "were potentially targeted by Russian government-linked cyber actors."

RELATED STORIES
Security Security Russia