According to the commission, the data could have been accessed as far back as August 2021 but was not detected until October 2022.[1][2][3] Once discovered, the attack was reported to the Information Commissioner's Office, National Cyber Security Centre and National Crime Agency within 72 hours.[1][2][3]
The initial vulnerability may have been a Zero-day flaw referred to as 'ProxyNotShell' (CVE-2022-41040) in their Exchange Server.[6]
The commission said that it was not able to know for certain what data was accessed or who was responsible, but the attack showed considerable sophistication.[1][2][3] The breach did not have any impact on the electoral process, with only copies of electoral registers visible in the breach, which had not been changed as a result of the attack. The commission assessed the breach did not pose a high risk to individuals, but did include a high volume of low-grade personal data (name, home address and for some the date reaching voting age).[7]
It would have been possible to access records for people registered to vote in the UK between 2014 and 2022 and the Commission email system would also have been accessible by attackers.[1][2][3] About forty million people are on the electoral register.[1][2][3] Data that would not be available would have included those whose identity is kept anonymous for safety reasons and addresses of overseas voters.[1][2][3]
The Electoral Commission apologised for the data breach.[1][2][3]