Massive Breach Of British Voter Data

Cyber hackers have obtained the details of tens of millions of British voters in a complex cyber attack on the Electoral Commission that went undetected for more than a year and Russian hackers are suspected to be the attacks.

The UK's elections checker the Electoral Commission has revealed it has been the victim of a "complex cyber-attack" affecting millions of voters.

“Both Police Service of Northern Ireland (PSNI) and the Electoral Commission cases are reminders of the massive importance of proper data controls. The Electoral Commission case shows that hostile actors, likely to be an as yet unknown nation state, will target the infrastructure of our democratic processes and the data of our population at scale,” says Phil Mason CEO of CyberCX UK operations, which is Australia’s largest independent cyber security services company.

“As such, all owners of critical datasets and important infrastructure in our public life need to be alert to the risks and have the ability to detect and manage anomalous activity in real time.”

“Meanwhile, the PSNI leak, while accidental and not a cyber security incident per se, is a stark reminder that when you have sensitive datasets you need expert and well managed procedures to avoid this sort of very serious accident.”

“However, it is also important to understand risk and harm. While the Electoral Commission breach sounds extraordinarily bad on the face of it, with deeply concerning intent, there are two saving graces.

“First, the electoral system is dispersed and voting is manual, so it’s very hard to cyber-attack a British election.

“Secondly, most - if not all - of the data is already public or purchasable.

“So it is important to not overreact. On the other hand, given the security situation in Northern Ireland, it is absolutely right that PSNI leadership are taking steps to ensure officers understand and get all the support necessary to manage the heightened risk’, says Phil Mason.

And the UK’s Electoral Commission has warned that hostile actors have accessed voter data, including names and addresses, belonging to anyone registered to vote in elections between 2014 and 2022.

The attackers gained access to full names, addresses, and the date on which a person achieves voting age, which is 18 for UK parliamentary elections.

The Commission said "hostile actors" had managed to gain access to copies of the electoral registers with the names and addresses of 40 million registered voters were accessible as far back as 2021 after cyber-attack.

Hackers also broke into its emails and "control systems" but the attack was not discovered until October last year.

“The incident was identified in October 2022 after suspicious activity was detected on our systems. It became clear that hostile actors had first accessed the systems in August 2021.”

“During the cyber-attack, the perpetrators had access to the Commission’s servers which held our email, our control systems, and copies of the electoral registers,” the Commission has published.

The attackers were able to access full copies of the electoral registers, held by the commission for research purposes and to enable permissibility checks on political donations.

These registers include the name and address of anyone in the UK who was registered to vote between 2014 and 2022. The commission’s email system was also accessible during the attack.

People have been warned to watch out for unauthorised use of their data.

In a public notice, the commission said hackers accessed copies of the registers it was holding for research purposes, and for conducting checks on political donors.

The watchdog said the information it held at the time of the attack included the names and addresses of people in the UK who registered to vote between 2014 and 2022.

This includes those who opted to keep their details off the open register - which is not accessible to the public but can be purchased, for example by credit reference agencies.

The data accessed also included the names, but not the addresses - of overseas voters, it added.

However, the data of people who qualified to register anonymously - for safety or security reasons, was not accessed, the watchdog said.

The commission says it is difficult to predict exactly how many people could be affected, but it estimates the register for each year contains the details of around 40 million people.

Sophisticated Attack

It added that the personal data held on its email servers was "unlikely to present a high risk to individuals," although information included in the body of an email or in an attachment could be vulnerable.

The personal data held on the registers - name and address - did not itself present a "high risk" to individuals, it added, although it is possible it could be combined with other public information to "identify and profile individuals".

It has not said when exactly the hackers' access to its systems was stopped, but said they were secured as soon as possible after the attack was identified in October 2022.

Explaining why it had not made the attack public before now, the commission said it first needed to stop the hackers' access, examine the extent of the incident and put additional security measures in place.

Information about donations and loans to political parties and registered campaigners is held in a system that is not affected by this incident, the notice added.

The commission added that it had taken steps to secure its systems against future attacks, including by updating its login requirements, alert system and firewall policies.

The Information Commissioner's Office, which is responsible for data protection in the UK, said it was urgently investigating.

The Commission did not publicly disclose the data leak until 10 months after discovering the breach. This was because it needed to remove attacks and put security in place.

BBC:      Electoral Commission:      IT Pro:      The Guardian:      Bloomberg:      Financial Times:      The Telegraph:      Evening Standard

 

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

 


Cyber Security Intelligence: Captured Organised & Accessible

« Police Officers At Severe Risk As Personal Data Exposed
Embracing The Passwordless Future »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Arab Information & Communication Technologies Organization (AICTO)

Arab Information & Communication Technologies Organization (AICTO)

The Arab ICT Organization (AICTO) is an Arab governmental organization working under the aegis of the league of Arab States.

ThreatAware

ThreatAware

Total visibility of your business cybersecurity. Monitoring, management and compliance for your cybersecurity tools, people and processes from one easy to use dashboard.

SMESEC

SMESEC

SMESEC is a lightweight Cybersecurity framework for protecting small and medium-sized enterprises (SME) against Cyber threats.

ioXt Alliance

ioXt Alliance

The ioXt Alliance is a group of manufacturers, industry alliances and government organizations dedicated to harmonizing best security practices in a highly connected world.

Fingent

Fingent

Fingent develops strategic software solutions for businesses across the globe in areas including Network Security, Infrastructure Security, Application Security, Risk and Compliance.

Forgepoint Capital

Forgepoint Capital

ForgePoint Capital is a premier venture investor for early stage cybersecurity companies.

Defendify

Defendify

We built Defendify to help small businesses navigate the cybersecurity landscape with cybersecurity that is dead simple, affordable, and works around the clock.

Area 1 Security

Area 1 Security

Area 1 is the only Pay-per-Phish solution in cyber security. And the only technology that blocks phishing attacks before they damage your business.

Converge Technology Solutions

Converge Technology Solutions

Converge Technology Solutions Corp. is a North American IT solution provider delivering advanced analytics, cloud, cybersecurity, and managed services solutions.

NodeSource

NodeSource

NodeSource helps organizations run production-ready Node.js applications with greater visibility into resource usage and enhanced awareness around application performance and security.

Bugbank

Bugbank

Bugbank (aka Vulnerability Bank) is a leading SaaS platform for internet security services in China.

CrossCountry Consulting

CrossCountry Consulting

CrossCountry Consulting is a trusted business advisory firm that provides customized finance, accounting, human capital management, risk, operations and technology consulting services.

Altospam

Altospam

Altospam is a full service corporate email protection, integrating multiple security levels for your emails.

Cyber Crucible

Cyber Crucible

Cyber Crucible is a cybersecurity Software as a Service company definitively removing the risk of data extortion from customer environments.

Sequentur

Sequentur

Sequentur is an award-winning Managed IT Services company. We are SOC 2 certified and provide Managed IT Services and Cybersecurity services to businesses nationwide.

Appranix

Appranix

Appranix delivers Cloud App Resilience with app-centric entire cloud resources backup, restore, and cross-region disaster recovery.