Central Election Commission Candidate Asset Declaration Website Returns National ID Numbers of 1,573 Candidates; ACS Assists with Security Testing

Query responses from the Central Election Commission (CEC) candidate asset declaration website included non-public National ID numbers of candidates that could be retrieved via browser developer tools; after a civic developer discovered and reported the issue on October 27, the CEC suspended the service that same day to fix the bug and stated on October 28 that preliminary findings pointed to an outsourced vendor error ^[1][2]. The Administration for Cyber Security (ACS), MODA received the report on October 27, dispatched personnel on October 28 to assist with security testing, and noted that the exposure stemmed from improper field filtering during program processing and data transmission ^[2].

Industries mainly affected: Government

1. Agencies publishing public documents must verify PII redaction prior to release and purge unredacted files from CDN and search caches ^[1].
2. Affected individuals should monitor for unauthorized use of exposed national ID numbers .