The Independent National Electoral Commission (INEC) has launched an investigation into allegations of unauthorised access to its Continuous Voter Registration (CVR) database and the subsequent disclosure of information relating to a candidate in a recent political party primary election in the Federal Capital Territory (FCT).
In a statement issued on Tuesday on its official X page, the electoral body said it became aware of reports circulating on social media and in sections of the media alleging that information was improperly retrieved from its voter registration database.
According to INEC, it has commenced a thorough probe to establish the facts surrounding the incident and determine whether any of its internal protocols were violated.
The commission explained that authorised registration officers participating in the ongoing nationwide CVR exercise were granted controlled access to specific parts of the system to enable them register new voters, process transfers and update voter records. It noted that such access is strictly limited to official duties and is withdrawn once the exercise concludes.
INEC disclosed that preliminary findings from its audit trail have already identified the user account through which the information was accessed.
“Relevant personnel have been questioned, and all units connected with the incident are cooperating fully with the investigation,” the commission said.
The electoral body added that it is examining all technical, administrative and operational aspects of the matter to determine individual responsibility and establish whether there was any breach of its internal access-control procedures.
However, INEC stressed that its preliminary investigation found no evidence of an external cyberattack or compromise of its systems.
“Preliminary findings from the Commission’s audit trail so far indicate that there was no external breach of the CVR database, no hacking incident, and no unauthorised external access to the Commission’s ICT infrastructure,” the statement said.
According to the commission, the information in question was accessed using valid credentials assigned to personnel involved in the ongoing voter registration exercise but was released without authorisation.
INEC further clarified that the incident involved the retrieval of a specific voter record and does not suggest any compromise of its wider voter registration infrastructure or the personal data of more than 90 million registered voters nationwide.
Reaffirming its commitment to protecting voter information, the commission said it treats the security, confidentiality and integrity of voter data with utmost seriousness.
The commission also revealed that the Department of State Services (DSS) has independently commenced its own investigation into the matter.
INEC pledged full cooperation with security agencies and vowed to take appropriate legal action against anyone found responsible for any wrongdoing.
The electoral body urged members of the public and the media to avoid speculation while investigations continue, assuring Nigerians that its final findings will be made public in due course.
