The Information Commissioner’s Office (ICO) has issued a reprimand to the Electoral Commission after hackers gained access to servers that contained the personal information of approximately 40 million people.

Back in August 2021, hackers successfully accessed the Electoral Commission’s Microsoft Exchange Server by impersonating a user account and exploiting known software vulnerabilities in the system that had not been secured.

Over a year later, until October 2022, the attackers had access to the personal information held on the Electoral register, including names and home addresses. The servers were accessed on several occasions without the Electoral Commission’s knowledge.

The ICO’s following investigation found that the Electoral Commission lacked appropriate security measures in place to protect the personal information it held.

In particular, it did not ensure its servers were kept up to date with the latest security updates. The security patches for the vulnerabilities exploited in the cyber-attack were released in April and May 2021, months before the attack.

Further, the ICO found that the Electoral Commission did not have sufficient password policies in place at the time of the attack, with many accounts still using passwords identical or similar to one originally allocated by the service desk.

“The Electoral Commission handles the personal information of millions of people, all of whom expect their data to be in safe hands,” deputy commissioner at the ICO, Stephen Bonner said.

“If the Electoral Commission had taken basic steps to protect its systems, such as effective security patching and password management, it is highly likely that this data breach would not have happened. By not installing the latest security updates promptly, its systems were left exposed and vulnerable to hackers.

Recommended

• UK Electoral Register Reveals it Suffered “Complex Cyber-Attack”
• Electoral Commission Failed Cybersecurity Test During Breach
• Facebook Political Ad Overhaul Aims for Greater Transparency

“I know the headline figures of 40 million people affected caused considerable public alarm when news of this breach emerged last year. I want to reassure the public that while an unacceptably high number of people were impacted, we have no reason to believe any personal data was misused and we have found no evidence that any direct harm has been caused by this breach. The Electoral Commission has now taken the necessary steps to improve its security.

“This action should serve as a reminder to all organisations that you must take proactive and preventative measures to ensure your systems are secure. Do you know if your organisation has installed the latest security updates? If not, then you jeopardise people’s personal information and risk enforcement action, including fines.”

According to the ICO, the Electoral Commission did take a number of remedial steps to improve their security following the attack, including implementing a plan to modernise their infrastructure, as well as password policy controls and multi-factor authentication for all users.