They Waited Two Years to Tell You

In August 2021, hackers gained access to the UK Electoral Commission's network. They reached the electoral registers, the full list of everyone in the United Kingdom registered to vote. Names. Addresses. 40 million people.

The Commission discovered the breach in October 2022. Fourteen months after it happened. During those fourteen months, the attackers had unrestricted access to the registers. What they did with that access, and how many times they accessed it, was never fully established.

The public was not informed until August 2023. Almost two years after the initial breach. The Commission stated that the data was "complex" and that it was unlikely to affect how people vote or their ability to participate in democracy. They offered no explanation for why it took two years to tell 40 million people their information had been stolen.

The identity of the attackers was not disclosed at time of publication. The Commission said the attack had not affected electoral outcomes.