The Independent National Electoral Commission (INEC) has launched an investigation into allegations of unauthorised access to, and disclosure of information from, its Continuous Voter Registration (CVR) database.
The commission announced the development in a statement issued on Tuesday in Abuja by Mohammed Haruna, National Commissioner and Chairman of the Information and Voter Education Committee (IVEC).
The investigation follows reports circulating on social media alleging that the voter registration data of a candidate who participated in the recent Federal Capital Territory (FCT) political party primaries was leaked using official access credentials.
Haruna said that although preliminary findings revealed no evidence of an external cyberattack on the commission’s systems, INEC considered the allegation serious enough to warrant a comprehensive investigation.
According to him, authorised Registration Officers participating in the ongoing nationwide CVR exercise are granted controlled access to designated sections of the voter registration platform to carry out official duties.
These duties include registering new voters, processing transfer requests, and updating voter information where necessary. He noted that such access is strictly limited to official assignments and withdrawn at the end of the exercise.
Haruna disclosed that the commission’s audit trail had already identified the specific user account through which the information was accessed.
“Relevant personnel have been questioned, and all units connected to the incident are fully cooperating with the investigation.
“The commission is examining all technical, administrative, and operational aspects of the matter to determine individual responsibility,” he said.
He explained that the investigation would establish the circumstances under which the credentials were used and determine whether any internal access-control protocols were violated before appropriate disciplinary or legal action is taken.
Haruna stressed that preliminary findings showed no external breach of the CVR database, no hacking of INEC’s systems, and no unauthorised access to the commission’s ICT infrastructure.
“Rather, the information in question was accessed through valid user credentials assigned to personnel engaged in the ongoing CVR exercise and was subsequently released without authorisation,” he said.
He further clarified that the incident involved the retrieval of a single voter record and did not suggest any compromise of INEC’s wider voter registration infrastructure or the personal data of more than 90 million registered voters.
“The commission wishes to state categorically that it treats the security, confidentiality, and integrity of voter data with the utmost seriousness.
“INEC remains committed to transparency, institutional integrity, and the protection of voters’ personal information,” he added.
Haruna also revealed that the Department of State Services (DSS) had independently commenced its own investigation into the matter.
He said the commission would continue to cooperate with relevant security agencies and would not hesitate to prosecute any individual found culpable.
The INEC spokesman urged the public and media organisations to avoid speculation while investigations are ongoing, assuring that the commission would provide updates on its findings and any actions taken once the probe is concluded.
