The UK Electoral Commission suffered a cyberattack in 2021–2022 that potentially exposed copies of electoral registers covering people registered to vote between 2014 and 2022—about 40 million individuals. The accessible information included names, home addresses, and, in some cases, dates on which people reached voting age. Attackers may also have accessed the Commission’s email system. The initial weakness may have involved Microsoft Exchange Server’s “ProxyNotShell” vulnerability, CVE-2022-41040, although the Commission said it could not establish with certainty what data was accessed or who was responsible.
The intrusion may have been ongoing from August 2021 but was not detected until October 2022. The Commission reported it to the Information Commissioner’s Office, National Cyber Security Centre, and National Crime Agency within 72 hours of discovery, and apologized publicly. It said electoral records were not altered and the breach did not affect the voting process. In March 2024, UK security services identified the Chinese government as the suspected perpetrator; the UK government and the US Treasury’s Office of Foreign Assets Control sanctioned Wuhan Xiaoruizhi Science and Technology, described as a Chinese Ministry of State Security front company, along with affiliated individuals, over the breach and related malware activity.
