UK’s Electoral Commission had its Microsoft Exchange servers compromised in a cyberattack by Chinese state-backed threat operation APT31 three years ago that exposed almost 40 million individuals’ data due to its failure to remediate ProxyShell vulnerabilities, tracked as CVE-2021-31207, CVE-2021-34473, and CVE-2021-34523, according to The Record, a news site by cybersecurity firm Recorded Future. Aside from not applying the fixes for the ProxyShell flaws, the Electoral Commission also had its servers impacted by eight other security issues, which could have been leveraged in additional compromise, a report from the UK’s Information Commissioner’s Office revealed.

Source: SC Magazine