No Database Breach, Hacking Incident In CVR Data Leak Probe, Says INEC

The Independent National Electoral Commission (INEC) has commenced an investigation into allegations of unauthorised access to its Continuous Voter Registration (CVR) database following the circulation of information relating to a candidate who participated in a recent political party primary election in the Federal Capital Territory (FCT).

However, the Commission said preliminary findings from its investigation indicate that there was no external breach of the CVR database, no hacking incident and no unauthorised access to its ICT infrastructure from outside the organisation.

INEC disclosed this in a statement issued on Tuesday by the National Commissioner and Chairman of the Information and Voter Education Committee, Mohammed Kudu Haruna, amid allegations circulating on social media and in sections of the media regarding the alleged unauthorised access to its voter registration database.

According to the Commission, the information in question was accessed through valid user credentials assigned to personnel participating in the ongoing nationwide voter registration exercise but was subsequently released without authorisation.

The Commission said it had immediately launched a thorough investigation into the incident and that preliminary audit trail findings had enabled it to identify the user account through which the information was accessed.

It added that relevant personnel had been questioned while all units connected to the matter were cooperating fully with investigators.

INEC explained that authorised registration officers were granted controlled access to specific components of the CVR system to facilitate new voter registration, transfers and updates during the ongoing exercise, stressing that such access was strictly for official duties and withdrawn at the end of the exercise.

The electoral body said it was examining all technical, administrative and operational factors connected to the incident to establish responsibility, determine how the credentials were used and ascertain whether any internal access-control protocols were breached.

It further noted that the incident involved the retrieval of a specific voter record and did not indicate any compromise of the wider voter registration infrastructure or the personal data of more than 90 million registered voters.

The Commission reiterated its commitment to protecting voter information and maintaining the integrity of its electoral systems, stressing that the security, confidentiality and integrity of voter data remain a top priority.

INEC also disclosed that the Department of State Services (DSS) had commenced a separate investigation into the matter and pledged full cooperation with security agencies. It said anyone found culpable would face appropriate legal action.

The Commission urged members of the public and the media to refrain from speculation while investigations continue, assuring that its final findings and any measures taken would be made public in due course.