Poor security let hackers access 40 million voters’ details

Personal details of millions of UK voters were left “vulnerable to hackers” because passwords were not changed and software not updated, the UK’s data privacy watchdog has found.

The Electoral Commission, which oversees UK elections, has been formally reprimanded, external by the Information Commissioners Office (ICO) over the security lapse.

Beginning in August 2021 cyber-attackers were able to access computers containing the Electoral Registers, which hold details of voters including millions of those not available publicly.

The Electoral Commission said, external it regretted that sufficient protections were not in place to prevent the cyber-attack.

“As the ICO has noted and welcomed, since the attack we have made changes to our approach, systems, and processes to strengthen the security and resilience of our systems and will continue to invest in this area,” it said in a statement.

The investigation did not find any evidence that personal data was misused, or that any direct harm has been caused by the attack.

The ICO said hackers had access to the Electoral Commissions’ systems for over a year.

It was only spotted when an employee reported that spam emails were being sent from the commission’s own email server.

The hackers were eventually booted out in 2022.

The UK government has formally accused China of being behind the attack on the commission, claims the Chinese embassy rejected as “malicious slander”.