UK Electoral Commission Recovers After Three-Year Cybersecurity Breach

The UK’s Electoral Commission has revealed that it took three years and over £250,000 to fully recover from a major cyber attack in which the personal details of 40 million voters were accessed by suspected Chinese hackers. The breach, which occurred in August 2021, exploited a security vulnerability in Microsoft Exchange software. Despite warnings from cybersecurity authorities, the commission failed to update its systems, leaving databases and emails exposed. The hackers remained undetected until October 2022 during a password system upgrade. Chief Executive Vijay Rangarajan, who was not in charge at the time, described the incident as a chaotic discovery, comparable to ‘being burgled while inside the house.’ The breach highlighted several basic security failures, including poor password practices, ignoring government security audits, and disregarding advice from the National Cyber Security Centre. Although there is no evidence that elections were affected, the commission cannot be certain what data the hackers accessed. The commission has now implemented significant cybersecurity improvements, achieving both Cyber Essentials and Cyber Essentials Plus certifications. The incident prompted formal reprimands and increased parliamentary scrutiny, although no individual was publicly held accountable. Sanctions were imposed on the suspected Chinese spies, who denied involvement. The commission now prioritizes cybersecurity to safeguard future elections.