The Independent National Electoral Commission (INEC) has launched an investigation into claims of unauthorized access to its Continuous Voter Registration (CVR) database.
Other News
In a statement issued on Tuesday by Mohammed Kudu Haruna, the National Commissioner and Chairman of the Information and Voter Education Committee (IVEC), the Commission said its attention was drawn to allegations circulating on social media and some media outlets.
The Commission, however, said its preliminary findings indicated no evidence of external hacking or compromise of the wider voter register.
These claims suggested unauthorized access to the CVR database and the subsequent publication of information on a political candidate during recent party primaries in the Federal Capital Territory.
INEC assured the public that the incident was specific to a single voter record and stressed that its broader voter registration infrastructure, including personal data of over 90 million registered voters, remains secure.
What INEC is saying
According to INEC, the record in question was accessed using valid user credentials assigned to personnel involved in the ongoing nationwide CVR exercise.
- “Preliminary findings from the Commission’s audit trail… indicate that there was no external breach of the CVR database, no hacking incident, and no unauthorized external access to the Commission’s ICT infrastructure,” the statement said.
- “Rather, the information in question was accessed through valid user credentials but released without authority.”
The Commission explained that authorized Registration Officers have controlled access to specific components of the CVR system to register new voters, process transfers, and update records.
Access is strictly limited to official duties and withdrawn at the conclusion of the exercise. The audit trail has already identified the user account used, and personnel involved are cooperating fully with the investigation.
More insights
INEC said it is reviewing technical, administrative, and operational factors to establish individual responsibility, determine circumstances surrounding the misuse of credentials, and identify any internal protocol breaches. Appropriate action will be taken against anyone found culpable.
The Commission reiterated its commitment to data security, emphasizing that the incident does not indicate any compromise of its broader systems or the personal data of registered voters.
It also confirmed that the Department of State Services (DSS) has begun an independent probe, and INEC will cooperate fully with all relevant security agencies.
- “The Commission wishes to state categorically that it takes the security, confidentiality, and integrity of voter data with the utmost seriousness,” the statement read.
INEC urged the public and media to disregard speculation while the investigation continues and promised to publish final findings along with any legal or disciplinary measures taken.
The probe comes as INEC continues its nationwide CVR exercise ahead of future elections, with growing scrutiny over the integrity of digital voter systems.
What you should know
Nairametrics previously reported that Nigeria recorded 281,500 leaked accounts in the first quarter of 2026, ranking 34th globally for data breaches, according to cybersecurity firm Surfshark.
The global total for the period was 210.3 million breached accounts, with the United States accounting for 29% of reported breaches.
Since 2004, Nigeria has experienced 24.1 million compromised user accounts, making it the third most affected country in Sub-Saharan Africa.
Surfshark noted that 7.5 million unique Nigerian email addresses have been exposed, alongside approximately 13 million passwords.
The report highlighted that 54% of breached Nigerian users face elevated risks of account takeovers, identity theft, extortion, and other cyber-related crimes.
These statistics underscore the broader cybersecurity challenges in Nigeria, highlighting the importance of secure data management in critical systems like voter registration.
