UK Electoral Commission data breach

On 8 August 2023, the UK Electoral Commission disclosed that hostile actors had been inside its systems since August 2021, in one of the largest known breaches affecting British citizens — touching the personal details of roughly 40 million voters.

What happened

The intruders gained entry by exploiting the ProxyShell vulnerability chain in the Commission's on-premise Microsoft Exchange Server — three flaws (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) for which Microsoft had shipped patches in spring 2021. The Commission failed to apply them. Using the flaws, the attackers impersonated a user account and planted web shells, giving them persistent control.

Crucially, the attackers then dwelt undetected for more than a year. Suspicious activity was only spotted in October 2022, and the breach was not made public until August 2023 — a timeline the Commission attributed to the need to remove the actors and assess the damage first.

What was accessed

• Reference copies of the electoral registers held by the Commission, containing the names and home addresses of everyone registered to vote in the UK between 2014 and 2022 — an estimated 40 million people, including those registered anonymously (held separately) being excluded.
• The Commission's email system and internal control systems were also accessible to the intruders.

The Commission assessed that the data, much of which is partly public, posed limited direct risk and that electoral processes were not affected, since the registers are static copies the attackers could read but not alter.

Regulatory and security findings

In December 2023, the ICO issued a formal reprimand, finding the Commission had failed to patch known vulnerabilities and operated with weak password hygiene — many accounts still used passwords identical or similar to those originally issued by the service desk, leaving them open to guessing.

Attribution

On 25 March 2024, the UK government attributed the intrusion to Chinese state-affiliated actors, naming APT31 and the Ministry of State Security front company Wuhan Xiaoruizhi Science and Technology, and imposing sanctions alongside the United States.

Why it matters

The breach combined a basic patching failure with a year-long undetected dwell time inside a body central to British democracy. It crystallised concern about state-sponsored targeting of electoral infrastructure and pushed UK public bodies toward stricter vulnerability-management and disclosure expectations.