Independent National Electoral Commission (INEC) has started looking into reports of unauthorized access to its Continuous Voter Registration (CVR) database, according to Mohammed Kudu Haruna, national commissioner and chairman of the Information and Voter Education Committee (IVEC),

Haruna, in a statement on Tuesday said that was aware of the allegations spreading on social media and in some news outlets.

“The Independent National Electoral Commission is aware of rumors currently circulating on social media and in certain media about unauthorized access to the Commission’s Continuous Voter Registration  (CVR) database.

These claims include the publication of information about a candidate from recent political party primaries in the Federal Capital Territory.

“The Commission takes this allegation very seriously and has quickly begun a thorough investigation to find out what really happened,” the statement noted.

INEC clarified that during the ongoing nationwide CVR process, registered officers were given limited access to specific parts of the registration system.

This access helps them manage voter registrations, transfer requests, and updates to voter records.

The commission stated that access to the information is only allowed for official duties and is taken away once the task ends.

Haruna revealed that initial findings from the commission’s audit trail helped pinpoint the user account used to access the information.

“The audit trail from our early investigation has allowed us to find out which user account was involved. As a result, we’ve questioned relevant staff, and all departments related to this matter are fully cooperating with the investigation,” it mentioned.

The commission also said it is looking into all technical, administrative, and operational details of the situation to figure out who is responsible and whether any internal access-control rules were broken.

However, INEC reported that its early findings indicated there was no outside breach of its systems.

Advertisement

“Our initial findings from the audit trail suggest that there was no external breach of the CVR database, no hacking incident, and no unauthorized outside access to our ICT systems.”

“Instead, the information in question was accessed using valid user credentials assigned to personnel involved in the ongoing CVR exercise but was released without proper authorization,” added the statement.

The commission emphasized that this incident involved retrieving a specific voter record and did not indicate any risk to the overall voter registration system or the personal data of over 90 million registered voters.

“The investigation is focused on the retrieval of a specific voter record and does not suggest any risk to the overall voter registration system or the personal data of over 90 million registered voters, according to the statement.

INEC emphasized that it is dedicated to safeguarding voter information and ensuring the integrity of its electoral systems.

“The Commission clearly states that it takes the security, privacy, and integrity of voter data very seriously. It remains committed to transparency, institutional integrity, and protecting voters’ personal details,” the statement noted.

The commission also announced that the Department of State Services has started its own investigation into this issue.

“Additionally, the Department of State Services has independently begun an investigation. The Commission will fully cooperate with all relevant security agencies and will not hesitate to take legal action against anyone found responsible,” the statement continued.

INEC encouraged the public and media to refrain from making assumptions while investigations are ongoing, promising that it will share its findings and any actions taken in due time.

QR codes embedded in emails have long been a tool for phishing and scams, and back in the second half of 2025 there was a fivefold surge in QR phishing attacks detected by Kaspersky.

Now Kaspersky researchers have identified a new phishing tactic in which attackers construct QR codes using text characters rather than traditional images. This method allows such malicious QR codes to bypass many email security solutions that rely on image scanning or link detection.

Early computers were incapable of rendering true graphics, and images on them were composed entirely of text characters. Historically this was done with symbols from the ASCII (American Standard Code for Information Interchange) character set, introduced in 1963. Images created using this technique were called ASCII graphics. Later other character sets (like Unicode) were also utilised to create images, but the term ASCII graphics remained.

In the 2000s, spam senders already used images built from text symbols. By using text-based graphics instead of embedded images, attackers tried to avoid detection mechanisms that analyse pictures for hidden URLs.

With ASCII graphics used to create QR codes, the phishing scheme follows a familiar pattern as with QR codes in images which Kaspersky described earlier. Victims receive an email allegedly coming from a business partner, claiming to include a confidential document for signature via DocuSign.

The message instructs the recipient to scan a QR code to access the document, leading to a fake website where corporate credentials are requested. With the QR code laid out in text characters, many protective solutions would fail to identify any suspicious links.

“We have previously seen phishers try to avoid link scanning by hiding URLs in images. Now they are attempting to evade image-based scanning by returning to text – this time to render a QR code. Any instance where a QR code prompts someone to enter corporate credentials on a mobile device should raise immediate suspicion.

When the QR code is formed using textual ASCII art, it is almost certainly a phishing attempt or a lure to a malicious URL. This trick has only one purpose: bypassing security technologies,” commented Roman Dedenok, Anti-Spam Expert at Kaspersky.

To defend against this threat, Kaspersky recommends deploying a proven mail server security solution such as Kaspersky Security for Mail Server that provides secure corporate email exchange, countering spam, email-borne infections, all forms of phishing, business email compromise (BEC), QR code attacks, and other threats.

Dr Vincent Olatunji, national commissioner and chief executive officer, Nigeria Data Protection Commission (NDPC), has disclosed that hackers launched more than 2,000 attacks on the commission’s service portal within one week, highlighting the growing cyber threats facing government institutions as Nigeria expands its digitalisation efforts.

Olatunji disclosed this on Monday in Abuja at a Technical and Organisational Drill on Data Protection Measures for IT Administrators across Ministries, Departments and Agencies organised by the NDPC.

According to him, the attacks underlined the urgent need for government institutions to strengthen their cyber defences and build the human capacity required to protect sensitive information and digital infrastructure.

He said, “Within one week, we experienced more than 2,000 attempts on our service portal.

More than 2,000 within one week. You can imagine what that means.”

The NDPC boss explained that cyberattacks could be motivated by different objectives, ranging from attempts to embarrass government institutions to financial extortion and other malicious activities.

Olatunji noted that government organisations had increasingly become targets of cybercriminals as more public services migrate online.

He said, “A lot of government organisations are being targeted recently. But I don’t think there’s anyone with any major impact on the economy or citizens’ data. But we don’t have to wait until they have a certain effect before we take action.”

The commissioner said the Federal Government’s ongoing digital transformation agenda was increasing the need for stronger cybersecurity safeguards across MDAs.

He recalled that Nigeria’s digitalisation journey gathered momentum after the issuance of the National Information Technology Policy in 2001, which paved the way for various digital initiatives and strategic roadmaps across government institutions.

According to him, the government is intensifying efforts to achieve full electronic governance and seamless interaction between citizens, businesses, and public institutions.

“A major announcement was made last week that will get 35 ministries fully digitalised in Nigeria within the next few weeks. Efforts are already ongoing. Some are fully digitalised already, while others are being encouraged to come on board. Over 100 agencies of government are already being involved in this,” he said.

Olatunji explained that many government agencies had already deployed platforms that enable citizens to access services remotely without physically visiting government offices.

He cited the commission’s own digital services, saying applicants seeking licences from the NDPC could complete processes online, including application submission and payments.

The NDPC chief, however, warned that greater digital integration also increases exposure to cyber risks.

“The truth is that all these integrations are driven by a lot of technologies developed by private sector organisations. When you move to full integration or when you interact, there is every likelihood that bad actors will target your network,” he said.

To address the challenge, Olatunji called for the development of “cyber warriors” capable of defending government systems and protecting citizens’ data.

He explained that the training programme aligned with key pillars of the commission’s roadmap, including human capital development, technology ecosystem growth, and inter-agency collaboration.

The NDPC boss identified different stages of e-governance maturity, ranging from agencies that only provide information on websites to those offering fully transactional, integrated services.

He stressed that data protection measures should not wait until institutions achieve full digital integration. Olatunji reminded participants that government institutions are classified under the law as data controllers because they collect and process information belonging to Nigerians and non-Nigerians.

He urged MDAs to establish the technical and organisational safeguards required under the Nigeria Data Protection Act to secure their databases and digital platforms.

According to him, technology alone cannot guarantee security without skilled personnel to manage and protect systems.

The commissioner commended public servants, describing them as among the most capable professionals available to drive government policies and programmes.

Olatunji also disclosed that compliance with data privacy requirements across the public sector had improved significantly in recent years. “When we started, the level of compliance with data privacy in the public sector in Nigeria was just four per cent. But now we are doing about 20 per cent and even over,” he said.

He added that many MDAs now make budgetary provisions for data privacy and protection activities, including the appointment of data protection officers and deployment of technical safeguards.

The NDPC chief urged participants to share the knowledge acquired during the training with colleagues in their respective organisations and to develop implementation plans to strengthen compliance.

He said the commission had embarked on various induction programmes, certification initiatives, and training courses for data protection officers across MDAs.

According to him, some participants in the commission’s six-week certification programme were already sitting for examinations, while additional support was being provided through the National Privacy Academy.

Olatunji disclosed that participants at the training would receive free vouchers to access the academy’s self-paced learning platform on data privacy and protection. He also revealed plans to extend training to permanent secretaries and other senior government officials to deepen understanding of data protection obligations across the public sector.

The commissioner encouraged participants to embrace emerging opportunities in the data protection sector, noting that certified data protection officers and licensed Data Protection Compliance Organisations could continue to provide compliance services even after retirement from public service.

In her opening remarks, Dr Tolulope Pius-Fadipe, head of Research and Development at the NDPC,  said the training formed part of the commission’s strategic roadmap for human capital development and efforts to build a strong data privacy architecture across ministries, departments and agencies.

She said the programme was designed to promote responsible data management, strengthen public trust, and protect the rights of data subjects, adding that it would help agencies test and improve their ability to protect sensitive public data and maintain critical services during crises.

Pius-Fadipe urged participants to actively engage in the sessions and implement lessons learned in their respective organisations, noting that public institutions were increasingly facing cyber threats.

Also speaking, Mr Olorunisomo Isola, head of Information Technology and Cybersecurity at the NDPC,  said the workshop was organised in response to rising cyber incidents targeting public infrastructure as government institutions deepen digitalisation efforts.

He said the training would equip IT administrators with the practical skills needed to implement the technical and organisational measures required under Section 39 of the Nigeria Data Protection Act and to prevent data loss or manipulation across government systems.

According to him, participants would undergo practical sessions on governance, risk and compliance, data protection impact assessments, encryption, data classification, data loss prevention, database security, cloud security and cyber incident response.

He added that the programme would culminate in the development of actionable implementation plans to strengthen data protection governance, improve security posture, reduce cyber risks, and ensure compliance with the NDPA across government institutions.