UK Electoral Commission Failed Cyber Essentials Test, Suffered A Breach Of 40m Voters’ Records

The UK’s Electoral Commission revealed last week that it failed a significant cybersecurity test around the same time when threat actors infiltrated its systems and compromised the sensitive personal data of 40 million voters.

Last month, the Electoral Commission of the UK said that it suffered a significant data breach that compromised the personal sensitive information of citizens who registered to vote between 2014 and 2022.

In a press release posted on its website, the organisation said that the security incident was identified last October when it detected “suspicious activity” in its internal network. After investigating the incident, it concluded that “hostile actors had first accessed the systems in August 2021.”

“During the cyber-attack, the perpetrators had access to the Commission’s servers which held our email, our control systems, and copies of the electoral registers,” the elections watchdog said. “They were able to access reference copies of the electoral registers, held by the Commission for research purposes and to enable permissibility checks on political donations.”

The compromised registers contained the name and address of anyone in the UK who registered to vote between 2014 and 2022, along with the names of those registered as overseas voters. The Commission has, however, clarified that the compromised registers did not contain the data of individuals who registered anonymously.

The Commission said that threat actors accessed email systems that contained full names, email addresses, home addresses, phone numbers, the content of the webform, and email filled by the individual that may contain personal data and any personal images sent to the Commission. The Electoral Register, which was also compromised, contained full names, home addresses, and the date on which the person achieved voting age that year.

According to BBC, a whistleblower told the media house that the Commission also failed a Cyber Essentials audit. According to the whistleblower, the Commission was notified by cybersecurity auditors that it was not compliant with the Cyber Essentials scheme, a system backed by the government to help organisations achieve minimum best practice in cyber-security. This notification came around the same time the threat actors infiltrated the Commission’s systems.

Reports also confirm that the Electoral Commission failed to clear the test in 2021 too. One of the reasons it failed the cyber security test was that around 200 staff laptops were running on obsolete and potentially insecure software. The Commission was asked to urge all its employees to use the Windows 10 Enterprise operating system, which had fallen out of date for security updates months earlier.

Acknowledging the failings, a spokesperson for the Commission said that the failings weren’t linked to the cyber attack that impacted its servers.

The UK’s Information Commissioner’s Office (ICO) said that it is urgently investigating the implications of the data breach. The National Cyber Security Centre also said that it is looking into the massive data breach and is in the process of determining the scope of the same.

Commenting on the news, CTO of Barrier Networks, Ryan McConechy said, “This is a concerning discovery about a cyberattack that could give adversarial powers greater advantage in meddling with the future UK electoral process.

“Cyber Essentials is a certification that sets out best security practices for businesses of all sizes to help them improve their resilience against attacks. It is non-intrusive and cost-effective and something all businesses should aim to achieve especially when they process high volumes of data. The certification is more than another compliance check box to be ticked; It is a solid baseline to make sure that, as an organisation, many obvious pitfalls have been avoided, helping remove the easy wins so attackers give up or move on.

“The fact that the Electoral Commission recently failed the assessment is very worrying. Especially given that an organisation of such prominence would normally be expected to be Cyber Essentials Plus certified.

“No organisation that handles the data of the UK population should ever gamble with security, the requirements of Cyber Essentials should be met as a standard practice and achieving certification should be a guarantee,” he added.