Elections watchdog targeted by cyber attack which left voters’ details exposed

Details of tens of millions of voters could have been accessed by hackers who targeted the elections watchdog.

The Electoral Commission revealed on Tuesday it was targeted by a cyber attack which allowed “hostile actors” to access electoral registers.

They apologised for the breach but said there was little risk it could influence the outcome of a vote.

Politics latest: Minister defends Lee Anderson’s ‘salty’ comments about migrants

The hack allowed the attackers to access reference copies of electoral registers which contained the name and addresses of anyone registered to vote between 2014 and 2022.

The reference copies, which are held for research purposes and to enable permissibility checks on political donations, also contained details of people registered to vote overseas during this period of time.

The attack was identified in October 2022, but the hackers had first been able to access the commission’s systems in August 2021.

Shaun McNally, the Electoral Commission’s chief executive, said: “The UK’s democratic process is significantly dispersed and key aspects of it remain based on paper documentation and counting.

“This means it would be very hard to use a cyber attack to influence the process.

“Nevertheless, the successful attack on the Electoral Commission highlights that organisations involved in elections remain a target, and need to remain vigilant to the risks to processes around our elections.”

A spokesperson for the National Cyber Security Centre said they provided the commission with “expert advice and support to aid their recovery” after the incident was first identified.

They added: “Defending the UK’s democratic processes is a priority for the NCSC and we provide a range of guidance to help strengthen the cyber resilience of our electoral systems.”

Mr McNally said significant measures had been taken to improve security on the commission’s IT systems.

He said while it is known which systems were accessible to the “hostile actors,” they are “not able to know conclusively what files may or may not have been accessed”.

Read more:
Russia-linked cyber attack groups want to ‘destroy’ UK
Domestic abuse victims ‘detected by perpetrators’ through Netflix account

“While the data contained in the electoral registers is limited, and much of it is already in the public domain, we understand the concern that may have been caused by the registers potentially being accessed and apologise to those affected.”

The register for each year holds the details of around 40 million individuals, although this includes people on the open registers whose information is already in the public domain.

The registers accessed by hackers did not include the details of those registered anonymously.

The Information Commissioner’s Office said it would be making enquiries.

“We recognise this news may cause alarm to those who are worried they may be affected and we want to reassure the public that we are investigating as a matter of urgency.

“In the meantime, if anyone is concerned about how their data has been handled, they should get in touch with the ICO or check our website for advice and support.”