Massive Breach Of British Voter Data

Cyber hackers have obtained the details of tens of millions of British voters in a complex cyber attack on the Electoral Commission that went undetected for more than a year and Russian hackers are suspected to be the attacks.

The UK's elections checker the Electoral Commission has revealed it has been the victim of a "complex cyber-attack" affecting millions of voters.

“Both Police Service of Northern Ireland (PSNI) and the Electoral Commission cases are reminders of the massive importance of proper data controls. The Electoral Commission case shows that hostile actors, likely to be an as yet unknown nation state, will target the infrastructure of our democratic processes and the data of our population at scale,” says Phil Mason CEO of CyberCX UK operations, which is Australia’s largest independent cyber security services company.

“As such, all owners of critical datasets and important infrastructure in our public life need to be alert to the risks and have the ability to detect and manage anomalous activity in real time.”

“Meanwhile, the PSNI leak, while accidental and not a cyber security incident per se, is a stark reminder that when you have sensitive datasets you need expert and well managed procedures to avoid this sort of very serious accident.”

“However, it is also important to understand risk and harm. While the Electoral Commission breach sounds extraordinarily bad on the face of it, with deeply concerning intent, there are two saving graces.

“First, the electoral system is dispersed and voting is manual, so it’s very hard to cyber-attack a British election.

“Secondly, most - if not all - of the data is already public or purchasable.

“So it is important to not overreact. On the other hand, given the security situation in Northern Ireland, it is absolutely right that PSNI leadership are taking steps to ensure officers understand and get all the support necessary to manage the heightened risk’, says Phil Mason.

And the UK’s Electoral Commission has warned that hostile actors have accessed voter data, including names and addresses, belonging to anyone registered to vote in elections between 2014 and 2022.

The attackers gained access to full names, addresses, and the date on which a person achieves voting age, which is 18 for UK parliamentary elections.

The Commission said "hostile actors" had managed to gain access to copies of the electoral registers with the names and addresses of 40 million registered voters were accessible as far back as 2021 after cyber-attack.

Hackers also broke into its emails and "control systems" but the attack was not discovered until October last year.

“The incident was identified in October 2022 after suspicious activity was detected on our systems. It became clear that hostile actors had first accessed the systems in August 2021.”

“During the cyber-attack, the perpetrators had access to the Commission’s servers which held our email, our control systems, and copies of the electoral registers,” the Commission has published.

The attackers were able to access full copies of the electoral registers, held by the commission for research purposes and to enable permissibility checks on political donations.

These registers include the name and address of anyone in the UK who was registered to vote between 2014 and 2022. The commission’s email system was also accessible during the attack.

People have been warned to watch out for unauthorised use of their data.

In a public notice, the commission said hackers accessed copies of the registers it was holding for research purposes, and for conducting checks on political donors.

The watchdog said the information it held at the time of the attack included the names and addresses of people in the UK who registered to vote between 2014 and 2022.

This includes those who opted to keep their details off the open register - which is not accessible to the public but can be purchased, for example by credit reference agencies.

The data accessed also included the names, but not the addresses - of overseas voters, it added.

However, the data of people who qualified to register anonymously - for safety or security reasons, was not accessed, the watchdog said.

The commission says it is difficult to predict exactly how many people could be affected, but it estimates the register for each year contains the details of around 40 million people.

Sophisticated Attack

It added that the personal data held on its email servers was "unlikely to present a high risk to individuals," although information included in the body of an email or in an attachment could be vulnerable.

The personal data held on the registers - name and address - did not itself present a "high risk" to individuals, it added, although it is possible it could be combined with other public information to "identify and profile individuals".

It has not said when exactly the hackers' access to its systems was stopped, but said they were secured as soon as possible after the attack was identified in October 2022.

Explaining why it had not made the attack public before now, the commission said it first needed to stop the hackers' access, examine the extent of the incident and put additional security measures in place.

Information about donations and loans to political parties and registered campaigners is held in a system that is not affected by this incident, the notice added.

The commission added that it had taken steps to secure its systems against future attacks, including by updating its login requirements, alert system and firewall policies.

The Information Commissioner's Office, which is responsible for data protection in the UK, said it was urgently investigating.

The Commission did not publicly disclose the data leak until 10 months after discovering the breach. This was because it needed to remove attacks and put security in place.

BBC:      Electoral Commission:      IT Pro:      The Guardian:      Bloomberg:      Financial Times:      The Telegraph:      Evening Standard

 

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

 


Cyber Security Intelligence: Captured Organised & Accessible

« Police Officers At Severe Risk As Personal Data Exposed
Embracing The Passwordless Future »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

RPC

RPC

RPC is a business law firm. Practice areas include technology and cyber risk.

sic[!]sec

sic[!]sec

sic[!]sec provide products and services for web application security.

Jenson Knight

Jenson Knight

Jenson Knight is a global cyber security, cloud and IT infrastructure staffing specialist.

Vaadata

Vaadata

Vaadata are experts in ethical hacking. We secure your web, mobile and IoT platforms.

Practical Assurance

Practical Assurance

Practical Assurance helps companies navigate the rough terrain of information security compliance.

Crosspring

Crosspring

Crosspring is an incubator/accelerator for people who have the ambition to start a successful business or want to extend their existing business in the areas of FinTech, AR, VR, Cybersecurity and SaaS

C11 Cyber Security & Digital Innovation Centre

C11 Cyber Security & Digital Innovation Centre

C11 is working with local and national partners to develop talent and bring brilliant minds and brilliant businesses together.

Datacentrix

Datacentrix

Datacentrix provides end-to-end cybersecurity services for the operational technology (OT) and IT environments to monitor, assess and defend our customers' information assets.

MCPc

MCPc

MCPc improves the security and well-being of our clients. We protect data, manage the complexity and sustainability of technology, empower employee performance, and ultimately reduce business risk.

Center for Information Technology Policy (CITP) - Princeton University

Center for Information Technology Policy (CITP) - Princeton University

The Center for Information Technology Policy at Princeton University is a nexus of expertise in technology, engineering, public policy, and the social sciences.

Retruster

Retruster

Protect your users against phishing emails, ransomware & fraud with the most advanced, user-friendly, non-intrusive solution available.

Clearnetwork

Clearnetwork

Clearnetwork specializes in managed cybersecurity solutions that enable both public and private organizations improve their security posture affordably.

Artjoker

Artjoker

Artjoker is a full cycle software development partner specialized in Blockchain projects and smart contract development including full cycle information security of all projects.

Gulf Business Machines (GBM)

Gulf Business Machines (GBM)

GBM is a leading end-to-end digital solutions provider, offering the broadest portfolio, including industry-leading digital infrastructure, digital business solutions, security and services.

Dexian

Dexian

Dexian is a leading provider of staffing, IT, and workforce solutions with nearly 12,000 employees and 70 locations worldwide.

Apollo Secure

Apollo Secure

Apollo is an automated cybersecurity platform for startups and small businesses to achieve and maintain security compliance.