INEC probes misuse of CVR access credentials, denies database hack

The Independent National Electoral Commission (INEC) has launched an investigation into allegations of unauthorised access to its Continuous Voter Registration (CVR) database, following the circulation of sensitive voter information linked to a political party’s primary election in the Federal Capital Territory.

In a press statement issued on Tuesday, INEC said it had taken the matter seriously and commenced a detailed probe to determine the circumstances surrounding the incident.

The Commission explained that as part of the ongoing CVR exercise, authorised registration officers were granted restricted access to specific sections of the system strictly for official duties such as new registrations, transfers, and data updates. It noted that such access is temporary and revoked once the exercise concludes.

According to INEC, preliminary findings from its audit trail have identified the specific user account through which the data was accessed. The personnel linked to the account have been questioned, while relevant departments are cooperating fully with the investigation.

The Commission, however, dismissed claims of a cyberattack, stating that there was no evidence of external hacking or unauthorised intrusion into its ICT infrastructure.

“Information in question was accessed באמצעות valid user credentials assigned to personnel involved in the CVR exercise but was disclosed without authorisation,” the statement said.

INEC further clarified that the incident involved the retrieval of a single voter record and does not suggest any compromise of its broader database, which contains the personal data of over 90 million registered voters.

Reaffirming its commitment to data protection, the Commission stressed that it treats the security and confidentiality of voter information with utmost importance.

Meanwhile, the Department of State Services (DSS) has also initiated an independent investigation into the matter. INEC pledged full cooperation with security agencies and vowed to ensure that anyone found culpable faces appropriate legal action.

The Commission urged the public and media to avoid speculation while investigations are ongoing, assuring that its final findings and necessary actions will be made public in due course.