INEC speaks on reported database breach

The Independent National Electoral Commission (INEC) has denied a hacking incident or external breach of its Continuous Voter Registration (CVR) database despite allegations surrounding the disclosure of a voter record linked to a candidate in a recent  political party primary in the Federal Capital Territory.Politics

The commission disclosed this in a statement issued on Tuesday by its National Commissioner and Chairman of the Information and Voter Education Committee, Mohammed Kudu Haruna.

INEC said it had commenced a full investigation into the circumstances surrounding the unauthorised release of information obtained from its Continuous Voter Registration (CVR) system.

According to the commission, preliminary findings from its audit trail showed that the information was accessed using valid user credentials assigned to personnel involved in the ongoing voter registration exercise.

The commission said: “Preliminary findings from the Commission’s audit trail so far, however, indicate that there was no external breach of the CVR database, no hacking incident, and no unauthorised external access to the Commission’s ICT infrastructure.”

“Rather, the information in question was accessed through valid user credentials assigned to personnel participating in the ongoing CVR exercise but released without authority,” INEC added.

The electoral body explained that authorised registration officers were granted restricted access to specific parts of the CVR system solely for official duties related to new registrations, transfer requests and voter record updates.

It explained that such access is withdrawn at the conclusion of the exercise.

The commission further disclosed that its audit trail had already identified the user account through which the information was accessed.

“The audit trail from the preliminary investigation has enabled the Commission to identify the user account through which the information was accessed,” INEC disclosed.

It added that relevant personnel had been questioned and that all units connected to the matter were cooperating with investigators.

The commission said it was examining all technical, administrative and operational aspects of the incident to establish responsibility and determine whether internal access-control protocols were breached.

It stressed that the matter involved the retrieval of a specific voter record and did not indicate any compromise of the wider voter registration infrastructure.

According to INEC, the incident does not affect the personal data of more than 90 million registered voters.

The commission reaffirmed its commitment to protecting voter information and maintaining the integrity of its database.

INEC assured that it takes “the security, confidentiality and integrity of voter data with the utmost seriousness” and remains committed to transparency and institutional integrity.

It also disclosed that the Department of State Services (DSS) had independently commenced an investigation into the matter.

The commission said it would cooperate fully with security agencies and would not hesitate to pursue legal action against any individual found culpable.

It urged members of the public and the media to avoid speculation while investigations continue and assured Nigerians that the outcome of the probe would be made public in due course.