The Electoral Commission data breach: three key takeaways

• Published date: 14 August 2023
• Law Firm: Kennedys
• Author: Mr George Chaisty, Issie Edwards and Bethany Thompson

On 8 August 2023, the Electoral Commission (EC), an independent body which oversees elections and regulates political finance in the UK, published a public notification to announce that they had been subject to a complex cyber attack. The notification confirmed that "hostile actors had first accessed the systems in August 2021" and that this was first detected by the EC in October 2022 due to suspicious activity.

The EC have confirmed the "hostile actors" were able to access copies of the electoral registers and that their email system was accessible during the entire period of the attack. It was further indicated that the names and addresses of all voters who registered between 2014 and 2022 had been impacted, as well as the names of those registered as overseas voters - approximately 40 million in total.

Early fallout from the EC's public notification

The Information Commissioner's Office (ICO) released a statement on 9 August 2023 confirming that they are "making enquiries" and "investigating as a matter of urgency".

Media reports have confirmed that approximately 28 million individuals chose to 'opt out' of the UK's open register. This has raised concern as to why the EC retained so much data, such that it was still accessible to the attackers. In a further publication on the EC's website, it stated that the data was "held by the Commission for research purposes and to...