The Electoral Commission of Britain has disclosed that it fell victim to a sophisticated cyber-attack, unraveling an incident that was first detected in October 2022. The attack, marked by its complexity, is believed to have been initiated by hostile actors who gained access to the Commission’s systems as far back as August 2021. The revelation has sparked concern about the security of crucial democratic processes, prompting calls for enhanced vigilance and protection.
Suspicion arose in October 2022 when the regulator observed suspicious activities within its systems. Collaborating with external security experts and the National Cyber Security Centre (NCSC), the Commission undertook an extensive investigation to assess the extent of the breach and to bolster the security posture of its IT infrastructure.
Shaun McNally, Chief Executive of the Electoral Commission, emphasised the distributed nature of the UK’s democratic system as a mitigating factor. He stated, “The UK’s democratic process is significantly dispersed and key aspects of it remain based on paper documentation and counting. This means it would be very hard to use a cyber-attack to influence the process.” McNally further acknowledged that while the incident underlines the susceptibility of election-involved organisations, the current democratic process itself remains resistant to such attacks.
In light of the breach, hostile actors managed to access reference copies of electoral registers held by the Commission for research and donation permissibility purposes. The compromised registers encompassed names and addresses of individuals who were registered to vote between 2014 and 2022, including overseas voters. Notably, the data accessed did not include details of those registered anonymously. The Commission’s email system was also compromised during the cyber-attack.
McNally admitted, “We know which systems were accessible to the hostile actors but are not able to know conclusively what files may or may not have been accessed.” While the exposed data was limited and much of it was already in the public domain, he acknowledged the potential concern it might have raised among affected individuals and offered an apology for any distress caused.
Electoral registers, primarily maintained by individual Electoral Registration Officers for local authorities, are also duplicated by the Commission to support its role in the democratic process. The attack on the Commission highlights the broader challenge faced by organisations that play a pivotal role in elections.
In compliance with legal requirements, the Commission promptly notified the Information Commissioner’s Office (ICO) within 72 hours of identifying the data breach. A formal notification has been published, and the ICO is currently conducting an investigation into the incident.
