Electoral Commission: one system exposed a population-scale register

What was reported

The ICO’s enforcement summary records attacker access to Electoral Commission systems between August 2021 and October 2022. The incident affected approximately 40 million individuals whose personal data was held as part of the electoral register. The regulator identified unpatched software vulnerabilities as the initial entry route and found inadequate technical and organizational safeguards.

Read the report from Information Commissioner’s Office

Our perspective

Our reading: An AI task answering a narrow policy question should not automatically receive a complete register. Vivendur’s context-selection approach is relevant to keeping large source collections separate from the smaller extracts or aggregates a tool needs.

Limits of this connection

The documented entry route was vulnerable software. Patching, network security, and protecting source systems are necessary; limiting AI context would not fix that vulnerability or establish that this breach was preventable by Vivendur.