How the theft of 40M UK voter register records was entirely preventable

A preventable cyberattack on the U.K. Electoral Commission exploited unpatched ProxyShell vulnerabilities in a self-hosted Microsoft Exchange server during 2021–2022, allowing intruders to steal electoral register data for approximately 40 million people. The ICO reprimanded the Commission for basic security failings (patching and password management); the U.K. government later attributed the intrusion to China-affiliated actors, but the ICO did not issue a fine due to its public-sector enforcement policy and no evidence of data misuse.