Basic IT security failings left electoral register vulnerable – data watchdog
The Electoral Commission has been issued with a reprimand after the Information Commissioner’s Office said it should have kept its systems updated.
Your support helps us to tell the story
From reproductive rights to climate change to Big Tech, The Independent is on the ground when the story is developing. Whether it's investigating the financials of Elon Musk's pro-Trump PAC or producing our latest documentary, 'The A Word', which shines a light on the American women fighting for reproductive rights, we know how important it is to parse out the facts from the messaging.
At such a critical moment in US history, we need reporters on the ground. Your donation allows us to keep sending journalists to speak to both sides of the story.
The Independent is trusted by Americans across the entire political spectrum. And unlike many other quality news outlets, we choose not to lock Americans out of our reporting and analysis with paywalls. We believe quality journalism should be available to everyone, paid for by those who can afford it.
Your support makes all the difference.Basic IT security failings allowed Chinese state-linked hackers to access the election watchdog’s register containing the details of 40 million voters.
The Information Commissioner’s Office (ICO) said the Electoral Commission had failed to keep its servers updated, allowing hackers to exploit the vulnerability.
The National Cyber Security Centre (NCSC), part of GCHQ, has previously said it was likely that Beijing-affiliated hackers stole data from the electoral register.
Hackers gained access to the system in August 2021 but the breach was not identified until October 2022.
The security patches for the vulnerabilities exploited in the cyber attack were released in April and May 2021, months before the attack, but not installed.
The data watchdog issued a formal reprimand to the Electoral Commission, which has already put in place a series of steps to improve its security.
Stephen Bonner, deputy commissioner at the ICO, said: “If the Electoral Commission had taken basic steps to protect its systems, such as effective security patching and password management, it is highly likely that this data breach would not have happened.
“By not installing the latest security updates promptly, its systems were left exposed and vulnerable to hackers.
“I know the headline figures of 40 million people affected caused considerable public alarm when news of this breach emerged last year.
“I want to reassure the public that while an unacceptably high number of people were impacted, we have no reason to believe any personal data was misused and we have found no evidence that any direct harm has been caused by this breach.”
In March this year the Government publicly blamed Chinese state-affiliated hackers for the attack.
As the ICO has noted and welcomed, since the attack we have made changes to our approach, systems, and processes to strengthen the security and resilience of our systems and will continue to invest in this area
Intelligence agencies believed the data accessed from the electoral register “would highly likely be used” by Chinese spies for purposes, including large-scale espionage and the repression of perceived dissidents and critics in the UK.
An Electoral Commission spokesman said: “We regret that sufficient protections were not in place to prevent the cyber attack on the commission.
“As the ICO has noted and welcomed, since the attack we have made changes to our approach, systems, and processes to strengthen the security and resilience of our systems and will continue to invest in this area.”