Basic IT security failings left electoral register vulnerable – data watchdog

Basic IT security failings allowed Chinese state-linked hackers to access the election watchdog’s register containing the details of 40 million voters.

The Information Commissioner’s Office (ICO) said the Electoral Commission had failed to keep its servers updated, allowing hackers to exploit the vulnerability.

The National Cyber Security Centre (NCSC), part of GCHQ, has previously said it was likely that Beijing-affiliated hackers stole data from the electoral register.

Hackers gained access to the system in August 2021 but the breach was not identified until October 2022.

Security patches

The security patches for the vulnerabilities exploited in the cyber attack were released in April and May 2021, months before the attack, but not installed.

The data watchdog issued a formal reprimand to the Electoral Commission, which has already put in place a series of steps to improve its security.

Stephen Bonner, deputy commissioner at the ICO, said: “If the Electoral Commission had taken basic steps to protect its systems, such as effective security patching and password management, it is highly likely that this data breach would not have happened.

“By not installing the latest security updates promptly, its systems were left exposed and vulnerable to hackers.

“I know the headline figures of 40 million people affected caused considerable public alarm when news of this breach emerged last year.

“I want to reassure the public that while an unacceptably high number of people were impacted, we have no reason to believe any personal data was misused and we have found no evidence that any direct harm has been caused by this breach.”

In March this year the Government publicly blamed Chinese state-affiliated hackers for the attack.

Intelligence agencies believed the data accessed from the electoral register “would highly likely be used” by Chinese spies for purposes, including large-scale espionage and the repression of perceived dissidents and critics in the UK.

An Electoral Commission spokesman said: “We regret that sufficient protections were not in place to prevent the cyber attack on the commission.

“As the ICO has noted and welcomed, since the attack we have made changes to our approach, systems, and processes to strengthen the security and resilience of our systems and will continue to invest in this area.”