Russian Hackers Compromised Sir Keir Starmer’s Personal Email in 2022

British authorities suspect Russian hackers of breaching the personal email of Sir Keir Starmer a couple of years before becoming Prime Minister of the United Kingdom. 

Email accounts belonging to prominent public figures are often targeted by hackers, and those belonging to politicians are even bigger targets. Access to such accounts will often yield a treasure trove of information. 

According to a report from The Times, Russian hackers broke into Starmer’s email in 2022 when he was the Labour leader, two years before becoming prime minister. This unknown incident is detailed in a new book named “Get In,” which details how Starmer found his way to 10 Downing Street in the PM position.

The book also reveals that the party leader had to ditch his personal email and create a new one. It turns out that the initial hack was likely possible because the first one lacked two-factor authentication.

The report also underlines that Starmer’s head of office, Jill Cuthbertson, told everyone, via a note, not to send emails to the opposition leader’s personal email under any circumstances, although no explanation was given at the time.

It’s unclear just how much sensitive information might have ended up in the hacker’s hands, but in 2022, Russian hackers also gained access to the emails of Sir Richard Dearlove, the former head of MI6, and of Paul Mason, an advisor to John Healey, the shadow defense secretary. Mason sent emails to numerous people, including Starmer. This is likely just a taste of the type of sensitive information that would have been visible to hackers.

A simple extra security measure that’s available now for most online services, the two-factor authentication option, could be the only way to keep hackers out of the email account. From the looks of it, even people in important positions sometimes have security lapses, just like regular users. 

The main lesson we can learn from this revelation is the same one security companies have been preaching for years: Enable two-factor authentication whenever you can, and avoid using SMS 2FA if you have other options.