The Electoral Commission of the UK said it suffered a significant data breach that compromised the personal sensitive information of citizens who registered to vote between 2014 and 2022.

The Electoral Commission said in a press release posted on its website that the security incident was identified last October when it detected “suspicious activity” in its internal network. After investigating the incident, it concluded that “hostile actors had first accessed the systems in August 2021.”

“During the cyber-attack, the perpetrators had access to the Commission’s servers which held our email, our control systems, and copies of the electoral registers,” the elections watchdog said. “They were able to access reference copies of the electoral registers, held by the Commission for research purposes and to enable permissibility checks on political donations.”

The compromised registers contained the name and address of anyone in the UK who registered to vote between 2014 and 2022, along with the names of those registered as overseas voters. The Commission has, however, clarified that the compromised registers did not contain the data of individuals who registered anonymously.

The Commission said that threat actors accessed email systems that contained full names, email addresses, home addresses, phone numbers, the content of the webform, and email filled by the individual that may contain personal data and any personal images sent to the Commission. The Electoral Register, which was also compromised, contained full names, home addresses, and the date on which the person achieved voting age that year.

“We understand the concern this attack may cause and apologise to those affected. Since the attack was discovered, we have worked with security specialists to investigate the incident and have taken action to secure our systems and reduce the risk of future attacks,” the Commission said.

It added that the personal data held on the electoral registers does not in itself present a high risk to individuals. However, this data could be combined with other data available in the public domain and could hold a possible threat to the individuals.

“The personal data held on the Commission’s email servers is also unlikely to present a high risk to individuals unless someone has sent us sensitive or personal information in the body of an email, as an attachment or via a form on our website, such information may include medical conditions, gender, sexuality, or personal financial details,” the elections watchdog explained.

While the Commission did not state the number of affected individuals, the BBC reported that the election register for each year contains the personal information of as many as 40 million people.

The Information Commissioner’s Office (ICO), which is responsible for data protection in the UK, said, “The Electoral Commission has contacted us regarding this incident and we are currently making inquiries. We recognise this news may cause alarm to those who are worried they may be affected and we want to reassure the public that we are investigating as a matter of urgency.

“In the meantime, if anyone is concerned about how their data has been handled, they should get in touch with the ICO or check our website for advice and support,” it added.

According to Senior Solutions Architect at HackerOne, Tom Hamersley the fact that the breach was identified in October 2022 and is only being reported now, suggests the impact wasn’t critical. This is also illustrated by the fact the PII breach was limited, with most of the information already being in the public domain, and the breach has not affected the rights or access to the democratic process or affected electoral registration status.

“I’m more concerned that the measures they’ve stated as having taken to prevent future attacks look reactive and basic,” Hammersley said.

“While they are increasing their overall alerting to suspicious login activity, it doesn’t suggest an improvement in the overall security maturity of their electoral assets and whether or not they will undergo sufficient automated and human testing. Many other government agencies, including the NCSC, already take an advanced approach to security testing and engage with the ethical hacking community to report any potential vulnerabilities,” he added.

Director of Strategy and Alliances at Orange Cyberdefense, Dominic Trott said the way this attack has been handled should be questioned considering it is common knowledge that CNI and electoral information are major targets for cybercriminals.

“While the Electoral Commission has abided by its legal duty to notify the ICO, it has become usual practice for organisations to inform those impacted about data breaches within the same or a similar timeframe. In effect, it has become de-facto standard practice to make a public announcement within days of a breach being discovered. This gives people full awareness of the issue and allows them to take any available steps to protect themselves and their data.

“Despite this misstep, it is comforting that the Electoral Commission has since strengthened its security posture since the attack, including its threat monitoring and alert systems, on advice from the NCSC. We can therefore hope that if it is targeted again in the future, the attack will come to light and be communicated quicker than in this instance,” Trott added.