Hijackers have targetted thousands of government websites, including NHS services, forcing users’ computers to mine cryptocurrency while on the site.
The Information Commissioner’s Office temporarily took down their website when it found hackers were taking control of visitors’ computers.
The code is now disabled and websites are no longer affected but the hackers had affected over 5,000 websites.
“This type of attack isn’t new – but this is the biggest I’ve seen. A single company being hacked has meant thousands of sites impacted across the UK, Ireland and the United States,” said Scott Helme, an IT security consultant who raised the alarm.
“Someone just messaged me to say their local government website in Australia is using the software as well.”
The software, known as Coinhive, uses devices to mine open-source cryptocurrency Monero, a rival to Bitcoin.
According to Helme, the security breach was “very serious.”
“They could have extracted personal data, stolen information or installed malware. It was only limited by the hackers’ imaginations,” he added.
Websites affected included the Student Loans Company, Barnsley Hospital and other worldwide companies and sites.
There is no further risk to computers who were affected. The software only runs when users were actively on affected websites.
A spokesperson for the National Cyber Security Centre said: “NCSC technical experts are examining data involving incidents of malware being used to illegally mine cryptocurrency.”
“The affected services has been taken offline, largely mitigating the issue. Government websites will continue to operate securely. At this stage there is nothing to suggest that members of the public are at risk.”
Martin McKay, the chief technical officer of TextHelp, said: “In light of other recent cyber-attacks all over the world, we have been preparing for such an incident for the last year and our data security action plan was actioned straight away.”