The Independent National Electoral Commission (INEC) has confirmed that one of its staff members with authorised access to the Continuous Voter Registration (CVR) database is under investigation over the alleged unauthorised disclosure of a voter’s personal record linked to a candidate in a recent party primary in the Federal Capital Territory (FCT).
INEC made the disclosure on Tuesday in a statement issued by National Commissioner and Chairman of its Information and Voter Education Committee, Mohammed Kudu Haruna, following reports circulating on social media and in sections of the press alleging a breach of its database.
The electoral body also confirmed that the Department of State Services (DSS) has launched a parallel investigation into the incident.
According to INEC, preliminary findings from its internal audit indicate that there was no external cyberattack or hacking of its ICT infrastructure. Rather, the incident was traced to legitimate user credentials assigned to personnel involved in the ongoing CVR exercise, which were allegedly used to access and release the information without authorisation.
“Preliminary findings from the Commission’s audit trail so far indicate that there was no external breach of the CVR database, no hacking incident, and no unauthorised external access to the Commission’s ICT infrastructure. Rather, the information in question was accessed through valid user credentials assigned to personnel participating in the ongoing CVR exercise but released without authority,” Haruna stated.
INEC explained that registration officers were granted restricted access to specific parts of the database strictly for official duties such as voter registration, transfers, and updates, and that such access is monitored and revocable after the exercise.
The commission said its audit trail had helped investigators identify the specific user account used to retrieve the record, adding that affected staff have been questioned and are cooperating with the investigation.
It further stated that it is reviewing all technical, administrative, and operational procedures to determine whether internal protocols were breached and to assign responsibility where necessary.
INEC disclosed that only a single voter record was involved in the incident, assuring the public that the data of over 90 million registered voters remains secure and that the overall integrity of its voter database has not been compromised.
The commission also confirmed that the DSS initiated its own independent investigation without prompting and assured full cooperation with security agencies.
INEC urged the public and media to avoid speculation while investigations are ongoing, adding that it will publish its final findings and any disciplinary or corrective measures after the probe is concluded.
