Massive Breach Of British Voter Data

Cyber hackers have obtained the details of tens of millions of British voters in a complex cyber attack on the Electoral Commission that went undetected for more than a year and Russian hackers are suspected to be the attacks.

The UK's elections checker the Electoral Commission has revealed it has been the victim of a "complex cyber-attack" affecting millions of voters.

“Both Police Service of Northern Ireland (PSNI) and the Electoral Commission cases are reminders of the massive importance of proper data controls. The Electoral Commission case shows that hostile actors, likely to be an as yet unknown nation state, will target the infrastructure of our democratic processes and the data of our population at scale,” says Phil Mason CEO of CyberCX UK operations, which is Australia’s largest independent cyber security services company.

“As such, all owners of critical datasets and important infrastructure in our public life need to be alert to the risks and have the ability to detect and manage anomalous activity in real time.”

“Meanwhile, the PSNI leak, while accidental and not a cyber security incident per se, is a stark reminder that when you have sensitive datasets you need expert and well managed procedures to avoid this sort of very serious accident.”

“However, it is also important to understand risk and harm. While the Electoral Commission breach sounds extraordinarily bad on the face of it, with deeply concerning intent, there are two saving graces.

“First, the electoral system is dispersed and voting is manual, so it’s very hard to cyber-attack a British election.

“Secondly, most - if not all - of the data is already public or purchasable.

“So it is important to not overreact. On the other hand, given the security situation in Northern Ireland, it is absolutely right that PSNI leadership are taking steps to ensure officers understand and get all the support necessary to manage the heightened risk’, says Phil Mason.

And the UK’s Electoral Commission has warned that hostile actors have accessed voter data, including names and addresses, belonging to anyone registered to vote in elections between 2014 and 2022.

The attackers gained access to full names, addresses, and the date on which a person achieves voting age, which is 18 for UK parliamentary elections.

The Commission said "hostile actors" had managed to gain access to copies of the electoral registers with the names and addresses of 40 million registered voters were accessible as far back as 2021 after cyber-attack.

Hackers also broke into its emails and "control systems" but the attack was not discovered until October last year.

“The incident was identified in October 2022 after suspicious activity was detected on our systems. It became clear that hostile actors had first accessed the systems in August 2021.”

“During the cyber-attack, the perpetrators had access to the Commission’s servers which held our email, our control systems, and copies of the electoral registers,” the Commission has published.

The attackers were able to access full copies of the electoral registers, held by the commission for research purposes and to enable permissibility checks on political donations.

These registers include the name and address of anyone in the UK who was registered to vote between 2014 and 2022. The commission’s email system was also accessible during the attack.

People have been warned to watch out for unauthorised use of their data.

In a public notice, the commission said hackers accessed copies of the registers it was holding for research purposes, and for conducting checks on political donors.

The watchdog said the information it held at the time of the attack included the names and addresses of people in the UK who registered to vote between 2014 and 2022.

This includes those who opted to keep their details off the open register - which is not accessible to the public but can be purchased, for example by credit reference agencies.

The data accessed also included the names, but not the addresses - of overseas voters, it added.

However, the data of people who qualified to register anonymously - for safety or security reasons, was not accessed, the watchdog said.

The commission says it is difficult to predict exactly how many people could be affected, but it estimates the register for each year contains the details of around 40 million people.

Sophisticated Attack

It added that the personal data held on its email servers was "unlikely to present a high risk to individuals," although information included in the body of an email or in an attachment could be vulnerable.

The personal data held on the registers - name and address - did not itself present a "high risk" to individuals, it added, although it is possible it could be combined with other public information to "identify and profile individuals".

It has not said when exactly the hackers' access to its systems was stopped, but said they were secured as soon as possible after the attack was identified in October 2022.

Explaining why it had not made the attack public before now, the commission said it first needed to stop the hackers' access, examine the extent of the incident and put additional security measures in place.

Information about donations and loans to political parties and registered campaigners is held in a system that is not affected by this incident, the notice added.

The commission added that it had taken steps to secure its systems against future attacks, including by updating its login requirements, alert system and firewall policies.

The Information Commissioner's Office, which is responsible for data protection in the UK, said it was urgently investigating.

The Commission did not publicly disclose the data leak until 10 months after discovering the breach. This was because it needed to remove attacks and put security in place.

BBC:      Electoral Commission:      IT Pro:      The Guardian:      Bloomberg:      Financial Times:      The Telegraph:      Evening Standard

 

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

 


Cyber Security Intelligence: Captured Organised & Accessible

« Police Officers At Severe Risk As Personal Data Exposed
Embracing The Passwordless Future »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

SecureWorks

SecureWorks

SecureWorks provides intelligence-driven security solutions for organizations to prevent, detect, rapidly respond and predict cyberattacks.

KoolSpan

KoolSpan

KoolSpan’s security and privacy solutions address the growing threat of loss or theft of intellectual property, information, and proprietary assets.

Data Recovery Services (DRS)

Data Recovery Services (DRS)

DRS provides data recovery services from media including hard disk drives, RAID, solid state disks SSD, memory sticks, USB drives, SD cards, tapes and mobile phones.

Wind River

Wind River

Wind River delivers the technology and expertise that enables the deployment of safe, secure, and reliable intelligent connected systems.

Securepoint

Securepoint

Securepoint is the market leader in the development of professional “Unified Threat Management” solutions in Germany.

Redshift Consulting

Redshift Consulting

Redshift is an information management and information security consulting company offering a full range of services from infrastructure design to security assessments and network monitoring.

4Stop

4Stop

4Stop is a global KYC, compliance and anti-fraud risk management company.

NinjaJobs

NinjaJobs

NinjaJobs is a community-run job platform developed by information security professionals. We focusing strictly on cybersecurity positions.

astarios

astarios

astarios provide near-shore software development services including secure software development (DevSecOps), quality assurance and testing.

Blackbird.AI

Blackbird.AI

Blackbird.AI provides an intelligence and early-warning system to help users detect disinformation and take action against threats.

Presidio

Presidio

Presidio is a leading North American IT solutions provider focused on Digital Infrastructure, Business Analytics, Cloud, Security & Emerging solutions.

ProCheckUp

ProCheckUp

ProCheckUp is a London-based independent provider of cyber security services, including IT Security, Assurance, Compliance and Incident Response.

The Hacking Games

The Hacking Games

The Hacking Games' Mission is to inspire, educate and mobilise a generation of ethical hackers to make the world a safer place.

IS4IT Kritis

IS4IT Kritis

IS4IT is your partner for the successful planning, introduction and implementation of company-specific information security concepts.

ACDS (Advanced Cyber Defence Systems)

ACDS (Advanced Cyber Defence Systems)

ACDS was founded in the belief that cyber security can be done better. We’re combining emerging technologies and proven methods to bring a new approach to tackling the growing threat landscape.

Mother Technologies

Mother Technologies

From Datacentre to Desktop, Mother Technologies has been delivering IT Support, Telecoms, Cybersecurity and Connectivity services to businesses across Scotland and beyond since 2002.