ENKR

UK Electoral Commission electoral register breach

Add to my breach check

Made public · 40,000,000 people on the electoral registers

What leaked2

Hard to replace

  • Home or delivery address

Permanent

  • Full name
  • Home or delivery addresshome address; overseas voters' names only, without addresses · BBC

To-dos

None of the harms this check covers.

What happened next9 events

  1. Undetected 2 eventsabout 1 yr 1 mo · show events
  2. Response 4 eventsNo individual notice on record · show events
  3. RemedyNone on record
  4. Penalty 3 eventsOngoing · show events
  5. DisputesNone on record
  1. ICO: no reason to believe any personal data was misused, and no evidence of direct harm from the breach
  2. ICO reprimand · no fine: servers not kept up to date with security patches and insufficient password policies
  3. The UK government attributed the compromise to a China state-affiliated actor and summoned China's ambassador
  4. The ICO said it was urgently investigating
  5. The chief executive apologised to those affected
4 more
  1. Public notice: hostile actors had accessed copies of the electoral registers from August 2021, with names and addresses of people registered 2014-2022
  2. The intrusion into the email and control systems was discovered
  3. A staff report of spam sent from the Exchange server led to a malware scan and clean-up; the NCSC was told. Attacker access continued
  4. Intrusion began
Company
UK Electoral Commission
When it happened
Company detected it
Made public
Notice
Leak confirmed
Affected
40,000,000 people on the electoral registers · approximate, ICO

Sources