The UK Electoral Commission suffered a cyberattack in 2021–2022 that potentially exposed electoral-register records covering people registered to vote between 2014 and 2022—around 40 million individuals. Attackers may have gained access as early as August 2021, but the intrusion was not detected until October 2022. The compromised material consisted of copies of registers and potentially the Commission’s email system; names, home addresses, and, for some people, dates on which they reached voting age were exposed. Anonymous-register voters and overseas voters’ addresses were not included, and the electoral process was not altered.
The Commission said it could not establish with certainty exactly what data was accessed or who was responsible, though it described the operation as sophisticated. Investigators examined a possible Microsoft Exchange Server vulnerability known as ProxyNotShell (CVE-2022-41040). After discovery, the Commission reported the incident to the Information Commissioner’s Office, National Cyber Security Centre, and National Crime Agency within 72 hours, and issued an apology. In March 2024, UK security services publicly identified the Chinese government as the suspected perpetrator; the UK government and the US Treasury’s Office of Foreign Assets Control sanctioned Wuhan Xiaoruizhi Science and Technology, described as a Chinese Ministry of State Security front company, and affiliated individuals over the breach and related critical-infrastructure malware allegations.
