Tuesday , June 24 2025
Image Credits: Leon Neal / Getty Images

UK electoral Commission hack exposed data of 40 million voters

The UK’s Electoral Commission was targeted by a “sophisticated cyber-attack”, which led to the personal information of many British voters being exposed.

In October 2022, the Commission made a shocking discovery – an attack had been detected on its systems after detecting suspicious activity. Attackers accessed the servers of the Commission in August 2021, according to a subsequent investigation reported in a notification on August 8, 2023.

WhatsApp banned on all US House of Representatives devices

The U.S. House of Representatives has banned congressional staff from using WhatsApp on government devices due to security concerns, as...
Read More
WhatsApp banned on all US House of Representatives devices

Kaspersky found “SparkKitty” Malware on Google Play, Apple App Store

Kaspersky found a new mobile malware dubbed SparkKitty in Google Play and Apple App Store apps, targeting Android and iOS....
Read More
Kaspersky found “SparkKitty” Malware on Google Play, Apple App Store

OWASP AI Testing Guide Launched to Uncover Vulns in AI Systems

OWASP has released its AI Testing Guide, a framework to help organizations find and fix vulnerabilities specific to AI systems....
Read More
OWASP AI Testing Guide Launched to Uncover Vulns in AI Systems

Axentec Launches Bangladesh’s First Locally Hosted Tier-4 Cloud Platform

In a major milestone for the country’s digital infrastructure, Axentec PLC has officially launched Axentec Cloud, Bangladesh’s first Tier-4 cloud...
Read More
Axentec Launches Bangladesh’s First Locally Hosted Tier-4 Cloud Platform

Hackers Bypass Gmail MFA With App-Specific Password Reuse

A hacking group reportedly linked to Russian government has been discovered using a new phishing method that bypasses two-factor authentication...
Read More
Hackers Bypass Gmail MFA With App-Specific Password Reuse

Russia detects first SuperCard malware attacks via NFC

Russian cybersecurity experts discovered the first local data theft attacks using a modified version of legitimate near field communication (NFC)...
Read More
Russia detects first SuperCard malware attacks via NFC

Income Property Investments exposes 170,000+ Individuals record

Cybersecurity researcher Jeremiah Fowler discovered an unsecured database with 170,360 records belonging to a real estate company. It contained personal...
Read More
Income Property Investments exposes 170,000+ Individuals record

ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs

GreyNoise found attempts to exploit CVE-2023-28771, a vulnerability in Zyxel's IKE affecting UDP port 500. The attack centers around CVE-2023-28771,...
Read More
ALERT (CVE: 2023-28771)  Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs

CISA Flags Active Exploits in Apple iOS and TP-Link Routers

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently included two high-risk vulnerabilities in its Known Exploited Vulnerabilities (KEV)...
Read More
CISA Flags Active Exploits in Apple iOS and TP-Link Routers

10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online

SafetyDetectives’ Cybersecurity Team discovered a public post on a clear web forum in which a threat actor claimed to have...
Read More
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online

ALSO READ:

Two-Thirds of UK Sites Vulnerable to Bad Bots: DataDome

The perpetrators gained unauthorized access to the “reference copies” of the electoral registers. These copies were specifically maintained by the Commission for research purposes and to verify the acceptability of political donations. The data included personal information like names and addresses of all registered voters in the United Kingdom from 2014 to 2022. The names of those registered as overseas voters were also exposed. The register did not contain any information about those who registered anonymously.

JBlake Moore, a cybersecurity advisor at ESET, expressed concern about the 15-month-long unnoticed attack. The authorities were not informed of any irregularities in their systems during this period.

Cybercriminals are most effective when operating in stealth mode, but it is uncommon for them to remain undetected for such an extended period. He expressed sadness at witnessing malicious individuals infiltrating and searching for a prolonged period, regardless of the attack’s complexity.

Social media users have also raised questions about why it took the Commission 10 months to notify the public about the incident.

                     Tweet of electoral commission of UK

According to the Commission’s official Twitter account, they took steps to safeguard their system by removing the actors involved, evaluating the full impact of the incident, collaborating with the National Cyber Security Centre and ICO, and implementing extra security measures. These precautions were necessary before the Commission publicly disclosed the incident.

There has been no evidence of the “hostile actor” affecting the security of UK elections, including the upcoming 2024 General Election. Accessing the data does not influence individuals’ ability to register, vote, or actively engage in democratic processes. It has no impact on the management of the electoral registers or on the running of elections.”

Furthermore, the attackers were able to breach the Electoral Commission’s email system, resulting in the exposure of additional personal information belonging to voters.

The Commission said the information affected in the breach “does not pose a high risk to individuals.” However, it had a duty to provide the August 8 notification “due to the high volume of personal data potentially viewed or removed during the cyber-attack” under Articles 33 and 34 of the UK General Data Protection Regulation (GDPR).

The Commission has issued a statement expressing its sincere apology to all individuals impacted by the incident. Furthermore, the company has worked with security experts to investigate the issue and improve its system security to prevent future attacks.

The breach’s perpetrator remains unknown at this time. In recent years, there have been frequent accusations of Russia-linked actors targeting the electoral processes of nation-states.

It is not the first time voter information has been exposed. In March 2022, London voters’ personal details were accidentally leaked by their council. The leak occurred when emails were sent to the wrong recipients.

Check Also

Patch Tuesday

Microsoft patch Tuesday fix exploited zero-day and 65 vuls patched

Microsoft’s June Patch Tuesday update has arrived, addressing 66 vulnerabilities across its product line. One …

Leave a Reply

Your email address will not be published. Required fields are marked *