Electoral Commission admits 'painful lessons learned' after Chinese hack

Despite repeated security warnings, the commission failed to act

The Electoral Commission has revealed that it has taken three years and more than £250,000 to fully recover from a devastating cyberattack attributed to Chinese state-linked hackers, which exposed the data of around 40 million voters

The breach was discovered in October 2022. More than a year after hackers exploited a flaw in Microsoft Exchange software in August 2021.

Despite repeated warnings to improve its security, the commission failed to act, leaving its databases and email systems wide open to intrusion.

Hackers accessed the complete open electoral register, listing the names and addresses of every UK voter, in addition to the commission's email communications.

In his first interview on the incident, the commission's new chief executive, Vijay Rangarajan, told the BBC that the scale of the breach came as an "enormous shock."

"Basically, it's taken us quite a few years to recover from it," he said.

"The culture here has changed significantly now partly as a result of this. It's a very painful way to learn."

Rangarajan, who was not in charge at the time of the breach, said colleagues described the moment the attack was uncovered during a routine password system upgrade as "feeling like you'd been burgled whilst still inside the house."

The organisation later discovered that hackers had roamed freely inside its IT networks for months, with no way to determine exactly what information may have been downloaded or whether malicious software was installed.

Although six by-elections were held during the breach period, the commission says there is no evidence that the hackers interfered with results.

Still, Rangarajan admitted that attackers had the potential to cause "major disruption."

Security failures and public reprimand

The hack exposed a catalogue of security failings. The commission had failed a basic government-run security audit, ignored advice from the National Cyber Security Centre, and was criticised for weak password practices.

In 2023, the Information Commissioner's Office issued a formal reprimand over the failures.

Officials acknowledged that had the same mistakes occurred in the private sector, the consequences would likely have included a heavy financial penalty. Despite the seriousness of the breach, no individual staff member has been publicly disciplined. Instead, parliament and other stakeholders expressed shock at what Rangarajan described as "complacency" within the watchdog.

Government blamed the breach on hackers working for the Chinese government, though Beijing has consistently denied any involvement.

Rangarajan said staff at the time underestimated the risks, despite high-profile examples of foreign interference in other countries, including the 2016 US presidential election hack of Hillary Clinton's emails.

The Electoral Commission has since received grants of more than £250,000 to overhaul its cyber defences and says it is now devoting a much larger share of its budget to security.

It has also passed the National Cyber Security Centre's Cyber Essentials and Cyber Essentials Plus certifications, the highest levels of government-backed assurance, which it had failed to achieve before the breach.