INEC Investigates Unauthorized Access to and Disclosure of CVR Database Information

•Insists no external breach of CVR database, no hacking incident

Adedayo Akinwale in Abuja

The Independent National Electoral Commission (INEC) has opened an investigation into alleged unauthorised access to the Commission’s Continuous Voter Registration (CVR) database and the subsequent publication of information about a candidate during recent primaries of a political party in the Federal Capital Territory (FCT).

Previously, Lere Olayinka, a media aide to the Minister of FCT, Nyesom Wike, had shared the personal data of Nollywood actor Emeka Ike from the Commission’s portal.

In response, Ike threatened legal action against Olayinka for disclosing his voter information through an INEC administrative webpage.

Ike, a native of Imo State, contested the House of Representatives seat for the AMAC/Bwari Federal Constituency in the FCT under the Nigerian Democratic Congress and was defeated.

INEC National Commissioner and Chairman of the Information and Voter Education Committee, Mohammed Haruna, issued a statement on Tuesday announcing that the Commission has immediately begun a thorough investigation to establish the facts surrounding the incident.

He said: “The attention of the Independent National Electoral Commission (INEC) has been drawn to allegations currently circulating on social media and in some sections of the media regarding the alleged unauthorised access to the Commission’s Continuous Voter Registration (CVR) database and the subsequent publication of information on a candidate in the recent primaries of a political party in the Federal Capital Territory.”

“The Commission takes this allegation seriously and has immediately commenced a thorough investigation to establish the facts surrounding the incident.”

“As part of the ongoing Continuous Voter Registration (CVR) exercise nationwide, authorised INEC Registration Officers were granted controlled access to specific components of the CVR system to enable them to register new applicants, process requests for transfer of registration and update voter records where necessary.”

“Such access is restricted to official duties only and is withdrawn at the conclusion of the exercise.”

“The audit trail from the preliminary investigation has enabled the Commission to identify the user account through which the information was accessed.”

“Accordingly, relevant personnel have been questioned, and all units connected with the incident are cooperating fully with the investigation.”

Haruna emphasised that the Commission is also examining all technical, administrative and operational factors associated with the matter to establish individual responsibility, determine the circumstances surrounding the use of those credentials and identify any breach of internal access‑control protocols before taking appropriate action against anyone involved.

He explained that preliminary findings from the Commission’s audit trail so far indicate that there was no external breach of the CVR database, no hacking incident, and no unauthorised external access to the Commission’s ICT infrastructure.

“Rather, the information in question was accessed through valid user credentials assigned to personnel participating in the ongoing CVR exercise but released without authority.”

Haruna said the incident under investigation concerns the retrieval of a specific voter record and does not indicate any compromise of the Commission’s broader voter registration infrastructure or the personal data of over 90 million registered voters.

The Commission stated categorically that it takes the security, confidentiality and integrity of voter data with the utmost seriousness and remains committed to transparency, institutional integrity and the protection of voters’ personal information.

It added that the Department of State Services (DSS) has independently commenced an investigation into the matter.

Haruna added that the Commission will continue to cooperate fully with all relevant security agencies and will not hesitate to refer any person found culpable for appropriate legal action.

The Commission urged members of the public and the media to disregard unfounded speculations while investigations remain ongoing.

The Commission assured that it would continue to keep the public informed of its final findings and any measures taken in response to the incident in due course.