IEC leak: Information regulator notified of security breach

The Information Regulator has confirmed it has received two notifications from the
Independent Electoral Commission (IEC) regarding a leak at the weekend involving the
unauthorized publication of candidate lists from the African National Congress (ANC) and
uMkhonto we Sizwe Party on various social media platforms.

“The ANC and uMkhonto we Sizwe Party candidate lists were unlawfully published on
various social media platforms less than 24 hours after parties submitted their lists on Friday
to meet the deadline outlined in the commission’s elections timetable ahead of the 29 May
2024 general elections,” stated the IEC.

On Saturday, the IEC assured the public it had launched internal processes to determine the
source of the breach and informed the relevant authorities, including the regulator. However,
according to the regulator, the notifications received are not compliant with the Protection of
Personal Information (Popi) Act.

“Some of the information that we are requesting from the IEC includes proof that both
political parties have been informed of the breach and a confirmation of the number of data
subjects impacted by this security compromise,” said Mukelani Dimba, the education and
communication executive at the Information Regulator.

The regulator has also requested more details on how the unauthorized person accessed
the information and how the IEC implemented technical and organizational measures to
mitigate the risk of the information being unlawfully accessed or processed.

The IEC has stated that it had taken additional measures through the night on Friday to
prevent any further leaks of election lists, highlighting the seriousness of the security breach
and its potential implications for the upcoming general elections.