NCC inaugurates new IPv6 Council board, pushes Nigeria’s internet infrastructure upgrade
The Independent National Electoral Commission (INEC) has acknowledged that information from its Continuous Voter Registration (CVR) database was accessed and released without authorisation, following public controversy around a voter record linked to a candidate in recent Federal Capital Territory party primaries.
In a statement dated June 2, 2026 and signed by National Commissioner Mohammed Kudu Haruna, the commission drew a firm distinction between what occurred and a cyberattack. INEC said its systems were not hacked, no outsider breached its ICT infrastructure, and the personal data of more than 90 million registered voters remains secure.
Instead, preliminary findings point to an internal lapse. According to the commission, valid login credentials assigned to a registration officer involved in the ongoing CVR exercise were used to access a specific voter record, which was subsequently disclosed without approval.
INEC explained that registration officers are granted limited system access strictly for official duties such as new voter enrolment, record updates, and transfer requests. This access is meant to be temporary and tightly controlled. In this instance, however, the commission’s audit trail traced the unauthorised disclosure to a specific user account.
“Findings so far show no external intrusion or hacking incident,” the statement said. “The information was accessed using legitimate credentials issued to authorised personnel but was released without authority.”
The commission confirmed that the user account involved has been identified, relevant staff questioned, and internal units are cooperating fully with the investigation.
Security agencies step in
Beyond INEC’s internal probe, the Department of State Services (DSS) has launched a parallel investigation. INEC said it will work closely with all security agencies and will pursue legal action against anyone found responsible for wrongdoing.
A familiar challenge: insider risk
The incident highlights a recurring issue across Nigerian public institutions—data risks originating from within rather than from external attackers. Cybersecurity analysts often note that insider threats are more difficult to detect because staff already have legitimate access to systems, allowing them to bypass traditional safeguards such as firewalls or intrusion detection tools.
Similar concerns have surfaced in recent months. The Nigeria Data Protection Commission (NDPC) has investigated alleged data exposure involving Remita Payment Services and Sterling Bank, as well as unauthorised system access reported by the Corporate Affairs Commission. In each case, attention has focused not only on what data was accessed, but on who had authorised access in the first place.
INEC says its audit mechanisms worked as intended by quickly identifying the account involved. The broader question now, however, is whether existing access controls are sufficiently restrictive and whether personnel fully understand the consequences of misusing their credentials.
The commission said it will release further updates once investigations are concluded and urged the public to ignore speculation in the meantime.
