Massive Breach Of British Voter Data

Cyber hackers have obtained the details of tens of millions of British voters in a complex cyber attack on the Electoral Commission that went undetected for more than a year and Russian hackers are suspected to be the attacks.

The UK's elections checker the Electoral Commission has revealed it has been the victim of a "complex cyber-attack" affecting millions of voters.

“Both Police Service of Northern Ireland (PSNI) and the Electoral Commission cases are reminders of the massive importance of proper data controls. The Electoral Commission case shows that hostile actors, likely to be an as yet unknown nation state, will target the infrastructure of our democratic processes and the data of our population at scale,” says Phil Mason CEO of CyberCX UK operations, which is Australia’s largest independent cyber security services company.

“As such, all owners of critical datasets and important infrastructure in our public life need to be alert to the risks and have the ability to detect and manage anomalous activity in real time.”

“Meanwhile, the PSNI leak, while accidental and not a cyber security incident per se, is a stark reminder that when you have sensitive datasets you need expert and well managed procedures to avoid this sort of very serious accident.”

“However, it is also important to understand risk and harm. While the Electoral Commission breach sounds extraordinarily bad on the face of it, with deeply concerning intent, there are two saving graces.

“First, the electoral system is dispersed and voting is manual, so it’s very hard to cyber-attack a British election.

“Secondly, most - if not all - of the data is already public or purchasable.

“So it is important to not overreact. On the other hand, given the security situation in Northern Ireland, it is absolutely right that PSNI leadership are taking steps to ensure officers understand and get all the support necessary to manage the heightened risk’, says Phil Mason.

And the UK’s Electoral Commission has warned that hostile actors have accessed voter data, including names and addresses, belonging to anyone registered to vote in elections between 2014 and 2022.

The attackers gained access to full names, addresses, and the date on which a person achieves voting age, which is 18 for UK parliamentary elections.

The Commission said "hostile actors" had managed to gain access to copies of the electoral registers with the names and addresses of 40 million registered voters were accessible as far back as 2021 after cyber-attack.

Hackers also broke into its emails and "control systems" but the attack was not discovered until October last year.

“The incident was identified in October 2022 after suspicious activity was detected on our systems. It became clear that hostile actors had first accessed the systems in August 2021.”

“During the cyber-attack, the perpetrators had access to the Commission’s servers which held our email, our control systems, and copies of the electoral registers,” the Commission has published.

The attackers were able to access full copies of the electoral registers, held by the commission for research purposes and to enable permissibility checks on political donations.

These registers include the name and address of anyone in the UK who was registered to vote between 2014 and 2022. The commission’s email system was also accessible during the attack.

People have been warned to watch out for unauthorised use of their data.

In a public notice, the commission said hackers accessed copies of the registers it was holding for research purposes, and for conducting checks on political donors.

The watchdog said the information it held at the time of the attack included the names and addresses of people in the UK who registered to vote between 2014 and 2022.

This includes those who opted to keep their details off the open register - which is not accessible to the public but can be purchased, for example by credit reference agencies.

The data accessed also included the names, but not the addresses - of overseas voters, it added.

However, the data of people who qualified to register anonymously - for safety or security reasons, was not accessed, the watchdog said.

The commission says it is difficult to predict exactly how many people could be affected, but it estimates the register for each year contains the details of around 40 million people.

Sophisticated Attack

It added that the personal data held on its email servers was "unlikely to present a high risk to individuals," although information included in the body of an email or in an attachment could be vulnerable.

The personal data held on the registers - name and address - did not itself present a "high risk" to individuals, it added, although it is possible it could be combined with other public information to "identify and profile individuals".

It has not said when exactly the hackers' access to its systems was stopped, but said they were secured as soon as possible after the attack was identified in October 2022.

Explaining why it had not made the attack public before now, the commission said it first needed to stop the hackers' access, examine the extent of the incident and put additional security measures in place.

Information about donations and loans to political parties and registered campaigners is held in a system that is not affected by this incident, the notice added.

The commission added that it had taken steps to secure its systems against future attacks, including by updating its login requirements, alert system and firewall policies.

The Information Commissioner's Office, which is responsible for data protection in the UK, said it was urgently investigating.

The Commission did not publicly disclose the data leak until 10 months after discovering the breach. This was because it needed to remove attacks and put security in place.

BBC:      Electoral Commission:      IT Pro:      The Guardian:      Bloomberg:      Financial Times:      The Telegraph:      Evening Standard

 

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

 


Cyber Security Intelligence: Captured Organised & Accessible

« Police Officers At Severe Risk As Personal Data Exposed
Embracing The Passwordless Future »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ON-DEMAND WEBINAR: How to build and implement an effective endpoint detection and response strategy

ON-DEMAND WEBINAR: How to build and implement an effective endpoint detection and response strategy

Discover how you can implement endpoint detection and response (EDR) tools into your security strategy.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Cloud Credential Council (CCC)

Cloud Credential Council (CCC)

The CCC is a leading provider of vendor-neutral certification programs that empower IT and business professionals in their digital transformation journey.

Usenix

Usenix

Usenix brings together the community of engineers, system administrators, scientists, and technicians working on the cutting edge of computing.

Verlingue

Verlingue

Verlingue (formerly ICB Group) is a leading corporate insurance broker providing Insurance, Risk Management and related advice to businesses and private clients.

National Institute of Information and Communications Technology (NICT)

National Institute of Information and Communications Technology (NICT)

NICT is Japan’s sole National Research and Development Agency specializing in the field of information and communications technology.

Cradlepoint

Cradlepoint

With Cradlepoint customers leverage the speed and economics of wired and wireless Internet broadband for branch, mobile, and IoT networks while maintaining end-to-end visibility, security and control.

Crypta Labs

Crypta Labs

Crypta Labs is an Award Winning IOT Security startup that is developing a quantum-based encryption chip to secure the Internet of Things.

Forum of Incident Response & Security Teams (FIRST)

Forum of Incident Response & Security Teams (FIRST)

FIRST is the global Forum of Incident Response and Security Teams.

Measured Insurance

Measured Insurance

Measured Insurance are bridging the gap between technology and Insurance using AI-Powered analytics that track clients’ exposure in real time to create smarter insurance products.

Midwest Cyber Security Alliance (MCSA)

Midwest Cyber Security Alliance (MCSA)

Midwest Cyber Security Alliance is a nonprofit, nonpartisan collaboration of individuals, businesses, government entities, and professionals advocating for more effective cyber security solutions.

Flatt Security

Flatt Security

Flatt Security is a cyber security startup based in Japan providing security assessments and other cyber security services.

AutoSec

AutoSec

AutoSec supports the FFI program Electronics, Software and Communication by dissemination and exploitation of the results of projects related to automotive cybersecurity.

Mindaro Insurance

Mindaro Insurance

Mindaro is adding the crucial piece of the cyber security puzzle that protects your organization from the financial ramifications of cyber attacks.

Celebrus

Celebrus

Celebrus Fraud Data Platform, by D4t4 Solutions, works with existing fraud structures to augment functionality and turn fraud management into true fraud prevention.

Aceiss

Aceiss

Aceiss empowers access security, providing unprecedented visibility and insights into user access.

PT Kubus Hitam Indonesia

PT Kubus Hitam Indonesia

Kubus Hitam are a research-based company focused on cyber security. we strongly believe that innovation and safety are the two keywords for the future business market.

Control D

Control D

Control D is a modern and customizable DNS service that blocks threats, unwanted content and ads - on all devices.