Log in Request a demo

Significant cyber incident

INEC result portal failure and cyberattack claims, Nigeria, 2023

On 25 February 2023 Nigeria's election commission (INEC) could not publish presidential result sheets on its public results portal, IReV, for many hours and in some places for weeks.

In short

On 25 February 2023 Nigeria's election commission (INEC) could not publish presidential result sheets on its public results portal, IReV, for many hours and in some places for weeks. INEC blamed technical hitches and said there was no intrusion. A federal minister later cited more than 12 million attacks on public sites. No source opened shows a break-in, so sources differ on cause.

Last updated 9 October 2026

What happened

Nigeria voted for a new president on 25 February 2023. INEC had promised to publish scans of polling unit result sheets on its results viewing portal, IReV, so that citizens could compare them with official totals. The EU observers say presidential forms only began to appear after 10 pm on election day and reached 20 per cent by noon on 26 February. Senate and House forms were uploaded at least in part.

On 26 February INEC said the cause was technical hitches from scaling the portal up from small state elections to a national one, and that it was not due to any intrusion or sabotage. INEC announced Bola Tinubu president-elect on 1 March. On 14 March the Communications minister said more than 12.9 million attacks hit public websites and portals around the presidential election. In early April the Information minister said INEC, suspecting a cyberattack, held back uploads. Sources differ on whether any attack caused the failure.

No source opened shows a successful intrusion, a named attacker or stolen data. The dispute went to the petition court, which affirmed Tinubu’s win on 6 September 2023, and to the Supreme Court, which dismissed the appeals on 26 October 2023.

Timeline

  1. June and July 2022

    INEC says hackers attacked its results system during the Ekiti and Osun governorship elections; it says the attacks failed.

  2. 25 February 2023

    Presidential and National Assembly elections. Presidential result forms start to appear on IReV after 10 pm (EU observers).

  3. 26 February 2023

    INEC issues a statement blaming technical hitches and denying intrusion or sabotage. Forms reach 20 per cent by noon (EU observers).

  4. 28 February 2023

    Al Jazeera finds only 46 percent of result sheets (81,569 of 176,846 polling units) on the portal.

  5. 1 March 2023

    INEC announces Bola Tinubu president-elect.

  6. 6 and 8 March 2023

    A Galaxy Backbone training event is reported to include a claim of 1.2 million blocked attacks; on 8 March the company disassociates itself from the quote.

  7. 14 March 2023

    The Communications and Digital Economy minister says 12,988,978 attacks were recorded on public websites and portals around the presidential election.

  8. Early April 2023

    The Information minister says INEC, suspecting a cyberattack, withheld uploads (Peoples Gazette, 5 April). Voice of Nigeria says his words were taken out of context.

  9. 19 June 2023

    At the petition court, INEC presiding officers say presidential results failed to upload; a cloud engineer's report says INEC's server had no glitches.

  10. 28 and 29 June 2023

    EU observers' final report says results were barely uploaded; INEC says it was a glitch.

  11. 6 September 2023

    The petition court affirms Tinubu's victory.

  12. 26 October 2023

    The Supreme Court dismisses the appeals.

How the attack worked

This page does not describe a confirmed attack chain. No source opened names an attacker, a method or any stolen or altered data. It describes how the system was meant to work and the competing accounts of why it failed.

How the portal was meant to work

INEC used a device called BVAS to check voters with fingerprints and faces and to scan and upload result sheets after paper voting. The scans were published on IReV so that anyone could view them.

What failed

EU observers say scans of presidential forms were often impossible to upload, while Senate and House scans at least partly were. They say an offline upload option for weak internet was largely unused, and that delays in the portal prevented smooth viewing. Three INEC presiding officers told the petition court the same pattern, and accepted under cross-examination that network glitches were the cause.

Competing accounts of the cause

INEC: technical hitches from scaling up, and no intrusion. The Communications minister: more than 12.9 million attacks were recorded and blocked. The Information minister: INEC suspected a cyberattack and held back uploads. A cloud engineer’s report admitted by the petition court says INEC’s server had no glitches on election day. Sources differ, and none opened gives technical evidence of an intrusion.

The attack counts are counts of attempts on public websites and portals, as the minister’s statement words it. They do not show that any attempt succeeded or that IReV in particular was the target of all of them.

Earlier attacks on the same portal

INEC’s chairman said before the 2023 election that engineers reported several cyber attacks on the portal during the 2022 Ekiti and Osun elections, some from as far as Asia, and that all failed.

Who says who was behind it

No public attribution to a threat group or person. The Communications and Digital Economy minister said on 14 March 2023 that attacks came from both within and outside Nigeria (as quoted by CDD Fact Check). Sources differ on whether attacks caused the upload failure: INEC said technical hitches and no intrusion on 26 February 2023, while the Information minister said in early April 2023 that INEC suspected a cyberattack. A Galaxy Backbone quote about 1.2 million attacks was disowned by the company on 8 March 2023.

Impact

Presidential result forms were largely missing from the public portal on election night: 20 per cent by noon on 26 February (EU observers) and 46 percent after three days (Al Jazeera). BusinessDay found 94.68 percent of the 176,846 polling unit results uploaded 87 days after the vote. EU observers said the delay and operational failures reduced trust in the process. No source opened reports stolen or altered data, or a change to the declared result. INEC gave Tinubu 8,794,726 votes, Abubakar 6,984,520 and Obi 6,101,533. The courts held that failure to transmit results electronically did not change the outcome.

Government and regulator response

  • 26 February 2023: INEC attributed the failure to technical hitches and denied intrusion or sabotage.
  • 14 March 2023: the Communications and Digital Economy minister said a ministerial committee on protecting Nigerian cyberspace blocked the attacks.
  • Early April 2023: the Information minister’s remarks that INEC suspected a cyberattack differed from INEC’s line; Voice of Nigeria reports he said they were taken out of context.
  • June 2023: the petition court heard INEC presiding officers and admitted a cloud engineer’s report on server health.
  • 29 June 2023: INEC called the EU report unfair and said one upload glitch should not define its whole performance.
  • 6 September and 26 October 2023: the petition court and the Supreme Court dismissed challenges and held INEC could not be obliged to send results to IReV electronically.

Lessons

  1. Say what you know and no more

    Two ministers and INEC gave three different causes in six weeks. Public bodies should state one agreed account and label what is unproven.

  2. Counts of attempts are not proof of impact

    12.9 million recorded attacks on public sites says little about whether any reached the portal. Report what was blocked and what, if anything, got through.

  3. Trust is the asset

    EU observers said operational failures reduced trust, even without evidence of a breach. Availability of a transparency tool is part of its security.

  4. Test at real scale

    INEC said the problem was scaling a state-election portal to a national one. Load test at the largest expected volume before the day.

  5. Keep fallbacks used and understood

    An offline upload option existed but was largely unused. Train staff on the fallback, not only the main path.

  6. Keep clean logs for later review

    Courts heard conflicting evidence about server health. Keep server and network records that can be shared with independent reviewers.

What to check in your own organization

  1. Public portals

    Do you publish anything the public relies on in real time, such as results, status or payments? Name an owner and a fallback.

  2. Load tests

    Have you tested at the highest volume you could face, including a spike of hostile traffic?

  3. Traffic filtering

    Can you block bulk hostile requests to public sites and see the numbers per site, not only in total?

  4. Fallback paths

    Is there an offline or alternate route for uploads and have staff practised it?

  5. Single account of events

    Who signs off the public statement during an outage, and how do ministers or executives avoid giving a different cause?

  6. Evidence retention

    Are server, network and application logs kept long enough to answer a court, observer or regulator?

  7. Dependency on a host

    Do you know which government or cloud host serves the portal and what its own attack and uptime reports say?

Questions

Was INEC hacked in 2023?

No source opened shows a successful break-in. INEC said there was no intrusion and blamed technical hitches. Other officials spoke of a suspected cyberattack, so sources differ.

How many attacks were there?

The Communications and Digital Economy minister's statement of 14 March 2023 said 12,988,978 attacks were recorded on public websites and portals around the presidential election, 6,997,277 of them on election day.

Who was behind the attacks?

No public attribution. The minister said they came from within and outside Nigeria.

Did the failure change the result?

The Supreme Court said on 26 October 2023 that the outcome was unaffected by the failure to transmit results electronically.

What did the EU observers say?

They said presidential forms started to appear after 10 pm, reached 20 per cent by noon on 26 February, and that operational failures reduced trust.

Did the Galaxy Backbone figure of 1.2 million attacks hold up?

No. The company said on 8 March 2023 that the quote did not come from it and should be disregarded.

Sources

  1. European Union Election Observation Mission NIGERIA 2023 Final Report European Union External Action Service (EEAS)
  2. Elections held on schedule, but lack of transparency and operational failures reduced trust in the process and challenged the right to vote European Union External Action Service (EEAS)

Browse the threat library