INEC investigates voter data leak

The Independent National Electoral Commission (INEC) has launched an investigation into alleged unauthorized access and disclosure of information from the Continuous Voter Registration (CVR) database.

This was disclosed by INEC National Commissioner and Chairman of the Information and Voter Education Committee (IVEC), Mohammed Haruna in a statement on Tuesday in Abuja.

The investigation follows reports on social media claiming that a candidate’s voter data in the recent Federal Capital Territory (FCT) primaries was leaked, using official access credentials.

Haruna said that although INEC’s initial findings showed no evidence of an external cyber attack, the commission took the allegations seriously and immediately initiated a thorough investigation to establish the facts surrounding the incident.

He explained that as part of the ongoing nationwide implementation of the CVR, authorized INEC Registration Officers were given controlled access to certain components of the CVR system.

This, he said, is to allow them to register new applicants, process registration transfer requests and update voter records, if necessary.

READ ALSO: 2027: APP announces governorship and parliamentary candidates in Lagos

He added that such access was restricted to official duties only and was withdrawn at the end of the exercise.

But Haruna said the audit trail from the initial investigation had allowed the commission to identify the user accounts used to access the information.

Therefore, the relevant personnel have been questioned, and all units related to the incident are cooperating fully with the investigation.

“The Commission is also examining all technical, administrative and operational factors related to this matter to determine individual responsibility,” he said.

Haruna added that this investigation aims to determine the circumstances surrounding the use of such credentials and identify violations of internal access control protocols before taking appropriate action against anyone involved.

“Preliminary findings from the commission’s audit so far indicate that there have been no external breaches of the CVR database, no hacking incidents and no unauthorized external access to the commission’s ICT infrastructure.

“Instead, the information in question was accessed through valid user credentials provided to personnel participating in the ongoing CVR exercise but was released without authorization,” the INEC official added.