Poor security exposed 40 million voters’ data, says UK authority

The UK Information Commissioner’s Office (ICO) has blamed the Electoral Commission’s poor security for a breach that exposed personal information of around 40 million voters.

The ICO’s investigation found the Electoral Commission did not ensure its servers were kept up to date with the latest security updates. The ICO added the security patches for the exposed vulnerabilities exploited in the cyberattack were released in April and May 2021, months before the attack.

The Electoral Commission also did not have sufficient password policies in place at the time of the attack, with many accounts still using passwords identical or similar to the ones originally allocated by the service desk.

“If the Electoral Commission had taken basic steps to protect its systems, such as effective security patching and password management, it is highly likely that this data breach would not have happened,” said Stephen Bonner, Deputy Commissioner at the ICO.

Bonner stressed to the public that while an unacceptably high number of people were impacted, the ICO has no reason to believe any personal data was misused.

The Electoral Commission improved security after the attack by modernising their infrastructure, enforcing password policy controls, and implementing multi-factor authentication for all users. 

In September 2023, the UK Electoral Commission failed a National Cyber Security Centre (NCSC) Cyber Essentials test in the same year it suffered a cyberattack. A spokeswoman for the Commission admitted the failings, but claimed they were unrelated to the recent cyberattack that affected email servers.

Cyberattack a ‘Cautionary Tale’ for Businesses

Dr Martin Kraemer, Security Awareness Advocate at security awareness training company, KnowBe4, said ‘this must be a cautionary tale for all future elections and presumably has been one for every election held since’.

“Unpatched software is the number two cause of data breaches happening. It will be crucially important to make sure that security basics are covered and to also talk about it so as to rebuild trust. The expected cyber resilience bill is an important step in the right direction,” added Kraemer.

In October 2022, suspicious activities led to the discovery that the Commission’s systems had been compromised. Investigations revealed that hostile actors had gained unauthorised access to the Commission’s servers as early as August 2021.

These servers housed the Commission’s emails, control systems, and copies of the electoral registers. The attackers could view reference copies of electoral registers from 2014 to 2022, including details of UK residents and overseas voters, but not anonymous registrations.

Join Tech Show London

12-13 March 2025, ExCeL London

Be a part of the latest tech conversations and discover pioneering innovations.

You won’t want to miss one of the most exciting technology events of the year.

Register Your Interest