“We Have Identified the User Account Involved” — INEC Reveals Progress in Data Leak Investigation

 By Kehinde Awosina 

The Independent National Electoral Commission (INEC) has commenced an investigation into allegations of unauthorised access to its Continuous Voter Registration (CVR) database following the circulation of information linked to a candidate who participated in a recent political party primary election in the Federal Capital Territory (FCT).

In a statement issued on Tuesday by the National Commissioner and Chairman of the Information and Voter Education Committee, Mohammed Kudu Haruna, the commission said it became aware of reports on social media and in some media outlets alleging that confidential voter information had been improperly accessed and disclosed.

According to INEC, preliminary findings from its ongoing investigation indicate that there was no cyberattack, hacking incident, or external breach of its database or ICT infrastructure. Rather, the information was reportedly accessed through legitimate user credentials assigned to officials participating in the ongoing nationwide voter registration exercise.

The commission explained that authorised registration officers are granted controlled access to specific sections of the CVR system to perform official duties such as registering new voters, processing transfers, and updating voter records. Such access, it noted, is strictly regulated and intended solely for official purposes.

INEC disclosed that an audit trail from its initial investigation had enabled investigators to identify the user account through which the information was accessed. Relevant personnel have since been questioned, while all departments connected to the matter are cooperating with investigators.

The electoral body said it is examining the technical, administrative, and operational circumstances surrounding the incident to determine whether internal access protocols were violated and to establish responsibility for the unauthorised disclosure.

The commission stressed that the incident involved the retrieval of a specific voter record and does not suggest any compromise of its wider voter registration infrastructure or the personal information of more than 90 million registered voters across the country.

Reaffirming its commitment to data security, INEC said it remains dedicated to safeguarding the confidentiality, integrity, and protection of voter information.

The commission also revealed that the Department of State Services (DSS) has independently launched its own investigation into the matter. INEC pledged full cooperation with security agencies and vowed to ensure that anyone found culpable faces appropriate legal consequences.

While the investigation continues, the commission urged Nigerians and media organisations to avoid speculation and await the outcome of the inquiry.

INEC assured the public that it would provide updates on the findings of the investigation and any actions taken once the process is concluded.