House of Commons hit by 50 million-plus cyber attacks in last three years

The data, which was obtained through a Freedom of Information request and analysed by the Parliament Street Think Tank, reveals the sheer scale of these malicious attacks on the House of Commons between July 2023 and May this year. Among the 51,145,419 e-mails rejected were likely a mixture of phishing attempts, malware and spam.

The number of rejected e-mail attacks increased each year, rising by almost 20% over the three-year period. The House of Commons rejected 15,973,452 e-mails in 2023-2024, with that figure increasing to 16,272,909 in 2024-2025 and 18,899,058 in 2025-2026.

Proactive response 

Stuart Harvey, CEO of Datactics, commented: “Modern e-mail security systems generate real-time data on attempted malware delivery and phishing attacks that helps security teams to respond to threats on a proactive basis. Organisations must have control over their sensitive personal data as messy data increases exposure and makes breaches harder to contain. Good security starts with good data discipline. If you don’t know your data, you cannot protect it.”

Harvey added: “When organisations lack a clear structure and visibility over their data, even basic questions become difficult to answer. What was accessed? Whose data is affected? How serious is it? If your data’s in a mess then security teams don’t stand a chance in the event of a cyber attack or data breaches.”

Irreversible damage 

Andy Ward, senior vice-president for international business at Absolute Security, commented: “The reality is that it only takes one high-level cyber attack to cause irreversible financial and reputational damage to an organisation. When hit by a cyber attack, almost one fifth of organisations experienced operational disruptions that lasted as long as two weeks, with the majority facing downtime that lasted for nearly five days.”

Ward concluded: “These threats are not a matter of ‘If’ but ‘When’ they are going to transpire. Organisations simply cannot avoid the inevitable. Therefore, it’s essential that these Government bodies have true cyber resilience embedded into their operations. This is not just to prevent attacks, but to anticipate them, withstand them and then recover quickly enough to keep business running.”