The Electoral Commission, the independent body that oversees elections in the United Kingdom, disclosed on 8 August 2023 that it had been the target of what it called a complex cyber-attack. Unnamed hostile actors had been able to reach copies of the electoral registers held by the commission for research purposes and for permissibility checks on political donations, along with its email system and control systems.
The commission said the intruders first gained access in August 2021 and that the activity was not identified until October 2022. It reported the incident to the Information Commissioner's Office within 72 hours and to the National Crime Agency, but the public was not told for a further ten months. Chair John Pullinger defended the delay, saying going public before the vulnerability was closed would have risked more exposure.
The register copies held names and addresses of everyone in the UK registered to vote between 2014 and 2022, including people who had opted out of the open register, and the names but not addresses of overseas voters. Data on anonymously registered voters was not accessed. The commission estimated each annual register covers around 40 million people, but said it could not conclusively determine which files were accessed or whether anything was downloaded.
Chief executive Shaun McNally apologised. The commission said the registers themselves, maintained locally by registration officers, were not altered, that donation and loan records sat on an unaffected system, and that it had updated login requirements, alerting and firewall policies. The ICO said it was urgently investigating.