The Department of Parliamentary Services blocked the Meta-owned messaging application on all parliamentary web browsers after the phishing attack was reported on March 6, the department's chief information officer Mike Webb told an inquiry on Monday.
All four accounts were compromised in the same way, Mr Webb said.
The hackers first requested a legitimate verification code be sent to the users' devices.
They then sent the victims a request to send them the verification code, which the hackers used to log into the account.
"The next step is to link one of their devices, and they essentially become that person from a communication perspective," Mr Webb said.
Evidence suggests the attack was conducted by a foreign state actor, he said.
"Multiple governments worldwide have issued warnings on this type of attack, including Germany, the Netherlands, the US, a range of other countries," Mr Webb said.
"So this is targeting our parliamentarians, but it is a genuine global issue."
After being notified of the breach, the department's cybersecurity team informed intelligence agency the Australian Signals Directorate and temporarily blocked WhatsApp from parliament's IT systems to prevent more users being ensnared in the hackers' web.
The block was lifted on Sunday night.
Between July 1, 2025 and March 31, the department had detected 46 instances of malware, close to 20,000 phishing attempts and about 1458 cyber alerts, officials said.
Coalition frontbencher James McGrath accused the Albanese government of a lack of leadership on foreign interference and national security.
"This translates to the way departments are being run and their handling of serious situations," Senator McGrath said.
"This is just the latest failure in a series of events that are becoming far too frequent and putting parliamentarians and their staff at risk."
12°C