Basic IT security failings allowed Chinese state-linked hackers to access the election watchdog’s register containing the details of 40 million voters.
The Information Commissioner’s Office (ICO) said the Electoral Commission had failed to keep its servers updated, allowing hackers to exploit the vulnerability.
The National Cyber Security Centre (NCSC), part of GCHQ, has previously said it was likely that Beijing-affiliated hackers stole data from the electoral register.
We need your consent to load this Social Media content. We use a number of different Social Media outlets to manage extra content that can set cookies on your device and collect data about your activity.
Hackers gained access to the system in August 2021 but the breach was not identified until October 2022.
The security patches for the vulnerabilities exploited in the cyber attack were released in April and May 2021, months before the attack, but not installed.
The data watchdog issued a formal reprimand to the Electoral Commission, which has already put in place a series of steps to improve its security.
Stephen Bonner, deputy commissioner at the ICO, said: “If the Electoral Commission had taken basic steps to protect its systems, such as effective security patching and password management, it is highly likely that this data breach would not have happened.
“By not installing the latest security updates promptly, its systems were left exposed and vulnerable to hackers.
“I know the headline figures of 40 million people affected caused considerable public alarm when news of this breach emerged last year.
“I want to reassure the public that while an unacceptably high number of people were impacted, we have no reason to believe any personal data was misused and we have found no evidence that any direct harm has been caused by this breach.”
In March this year the Government publicly blamed Chinese state-affiliated hackers for the attack.
Intelligence agencies believed the data accessed from the electoral register “would highly likely be used” by Chinese spies for purposes, including large-scale espionage and the repression of perceived dissidents and critics in the UK.