Inside INEC’S data breach: What Emeka Ike’s incident reveals about Nigeria’s electoral vulnerabilities ahead of 2027

Featured, Politics

By Anthony Isibor

WHAT began as a political attack on social media has evolved into one of the most troubling electoral data controversies in recent years, raising fresh concerns about the security of Nigeria’s voter database and the preparedness of the Independent National Electoral Commission, INEC for the 2027 general elections.

On May 30, 2026, Lere Olayinka, Senior Special Assistant on Public Communications and Social Media to the Minister of the Federal Capital Territory, Nyesom Wike, posted on X (formerly Twitter) questioning the eligibility of Nollywood actor Emeka Ike to contest for a House of Representatives seat in the Abuja Municipal Area Council, AMAC/Bwari Federal Constituency.

In the post, Olayinka alleged that Ike had only recently transferred his voter registration from Imo State to the Federal Capital Territory and attached screenshots purportedly obtained from INEC’s Continuous Voter Registration, CVR, platform.

The screenshots contained sensitive personal information, including Ike’s Voter Identification Number, VIN, application number, registration details, passport photograph, registration centre and date of application.

The disclosure immediately shifted public attention away from the political argument toward a more pressing concern: how did a private citizen’s electoral data end up in the public domain?

Days later, INEC confirmed that the information had indeed been accessed through its voter registration system. In a statement issued on June 3, 2026, the National Commissioner and Chairman of the Information and Voter Education Committee, Mohammed Kudu Haruna, said that the Commission’s preliminary investigation found no evidence of an external cyber-attack.

Although INEC through its statement acknowledged that the data was retrieved using valid credentials assigned to personnel involved in the ongoing voter registration exercise, it, however, said that it was released without authorisation.

“Preliminary findings from the Commission’s audit trail indicate that there was no external breach of the CVR database, no hacking incident and no unauthorised external access to the Commission’s ICT infrastructure,” Haruna said.

“Rather, the information in question was accessed through valid user credentials assigned to personnel participating in the ongoing Continuous Voter Registration exercise but released without authority.”

The statement also confirmed what cyber-security experts classify as an insider breach, unauthorised disclosure carried out using legitimate internal access rather than through external intrusion.

INEC said that it had identified the account involved through its audit trail and had commenced internal investigations. The Department of State Services, DSS, also launched a parallel inquiry.

The Commission further maintained that the incident involved only a single voter record and did not compromise the personal information of the more than 90 million Nigerians currently on the national voter register.

That assurance, however, did little to calm public concerns.

Responding to the situation on Channels Television’s The Morning Brief, Emeka Ike condemned the disclosure, describing it as a gross abuse of power and a violation of his privacy.

He accused political actors of weaponising government-held personal data and threatened legal action against Olayinka, while also demanding accountability from both INEC and the office of the FCT Minister.

Beyond the actor’s reaction, the incident exposed a deeper problem within the Nigerian electoral infrastructure.

For years, discussions about election cyber-security have largely focused on external threats such as hackers, ransom ware attacks and foreign interference. The Emeka Ike controversy highlighted a different danger — the insider threat.

Because voter registration officials require access to personal records to process registrations, transfers and updates, the system necessarily grants authorised users access to sensitive voter information.

The critical question raised by the incident is not simply who leaked Ike’s data, but whether adequate safeguards exist to prevent such access from being abused.

The electoral transparency advocates argue that if one authorised account could retrieve and publicly disclose detailed voter information, then the public deserves answers about the scope of that access, the monitoring mechanisms in place and whether similar incidents may have occurred previously without detection.

These concerns resonate because they emerge against the backdrop of lingering doubts over INEC’s technology systems, following the 2023 general elections.

The introduction of the Bimodal Voter Accreditation System, BVAS, and the INEC Result Viewing Portal, IReV, was widely celebrated as a major step toward electoral transparency.

While BVAS generally functioned as intended, IReV experienced significant failures during the presidential election on February 25, 2023.

Although results from the National Assembly elections were uploaded, presidential polling unit results failed to appear on the portal for several hours, creating confusion and fuelling allegations of manipulation. The delay became one of the most controversial aspects of the election.

In its post-election review released in February 2024, INEC had acknowledged the failure, attributing it to technical complications involving server processes and system complexity. The Commission maintained that the problem did not affect the integrity of the election results.

However, opposition parties, election observers and many Nigerians remained unconvinced, arguing that the incident weakened public confidence in the electoral process.

Even before the 2023 elections, INEC officials had warned of sustained cyber threats against electoral infrastructure.

In January 2023 for example, senior ICT officials disclosed that foreign actors had repeatedly attempted to penetrate the Commission’s systems. Government agencies later reported that nearly 13 million cyber-attacks targeted electoral infrastructure during the election period, including Distributed Denial of Service, DDoS, attacks, email compromise attempts and unauthorised login efforts.

The Emeka Ike data leak adds a new dimension to those concerns. Unlike external attacks, insider breaches originate from individuals already authorised to access systems.

Cybersecurity specialists often regard insider threats as among the most difficult security challenges because they bypass many of the technical controls designed to stop outside attackers.

With preparations for the 2027 elections already underway, the timing of the incident has intensified concerns about the resilience of Nigeria’s electoral technology ecosystem.

Editorial commentators and civil society groups have warned that public trust remains one of the most important assets any election management body can possess. They argue that incidents involving unauthorised access to voter information risk deepening existing scepticism created by the controversies surrounding the 2023 elections.

The concerns are significant because INEC’s voter database contains personal information belonging to more than 90 million Nigerians, including photographs, voter identification numbers and biometric records. Such information represents a valuable target not only for criminals, but also for political actors seeking to profile, influence or manipulate voters.

Cybersecurity analysts have repeatedly called on the Commission to strengthen access controls, implement stricter authentication measures, conduct independent security audits and expand staff training programmes before the next general election cycle.

The Emeka Ike’s case suggests that these recommendations may no longer be optional.

While INEC has taken procedural steps by launching an investigation and involving security agencies, critics say important questions remain unanswered. No disciplinary measures have yet been publicly announced against the individual linked to the account used to access the information.

The Nigeria Data Protection Commission has not publicly disclosed any investigation into the apparent violation of personal data rights under the Nigeria Data Protection Act 2023. There has also been no public commitment to conduct an independent review of the voter registration system’s access architecture or to determine whether other voter records may have been similarly accessed.

For many Nigerians, the distinction between an external cyberattack and an internal breach is ultimately of little comfort.

The result remains the same: personal voter information was accessed and disclosed without consent.

As the country moves closer to another election cycle, the incident serves as a reminder that electoral integrity is no longer solely about ballot boxes and vote counting.

It is also about data governance, cybersecurity and public trust.

The Emeka Ike’s controversy may involve a single voter record, but it has exposed the larger question and INEC’s response to that question over the coming months may prove just as important as its preparations for the 2027 elections themselves.

A.I

June 8, 2026

Tags: Emeka Ike Independent National Electoral Commission INEC Lere Olayinka Nyesom Wike