More Sensitive US Voter Records Leaked

A cache of voter records on over a half-million Americans has been found online. The records, totaling 593,328 individual sets of records, appear to contain every registered voter in the state of Alaska, according to security researchers at the Kromtech Security Research Center, who found the database.

The records were stored in a misconfigured CouchDB database, which was accessible to anyone with a web browser, no password needed, until Monday 11th September, when the data was secured and subsequently pulled offline.

The exposed data is just a portion of a larger voter file compiled by TargetSmart, which said its national voter file, that contains 191 million voters, is the "most comprehensive and up-to-date voter file ever assembled."

The data is collected and used to help political campaigns with their fundraising, research, and voter contact programs, the company said.

ZDNet was provided a small sample of the records for verification.

Each XML-formatted record contained details, some sensitive and personally identifiable information, on prospective voters, including names, addresses, dates of birth, their ethnic identity, whether an individual is married, and the individual's voting preferences.

But the data also contained highly personal information, such as household income, the age ranges of an individual's children, and if an individual is a homeowner.

The records, some are more complete than others, also have fields for the types of issues that an individual can be lobbied on, such as climate change, gun control, and tax reforms.

When reached, TargetSmart said that a third-party company was to blame for the data exposure.

"We've learned that Equals3, an artificial intelligence software company based in Minnesota, appears to have failed to secure some of their data and some data they license from TargetSmart, and that a database of approximately 593,000 Alaska voters appears to have been inadvertently exposed," said Tom Bonier, Targetsmart chief executive.

Bonier said the data was not accessed by anyone other than the security researchers at TargetSmart and the team that identified the exposure.

"None of the exposed TargetSmart data included any personally identifiable, non-public financial data," he said.

"To be clear, TargetSmart's database and systems are secure and have not been breached. TargetSmart imposes strict contractual obligations on its clients regarding how TargetSmart data must be stored and secured, and takes these obligations seriously," Bonier added.

Equals3 chief executive Dan Mallin confirmed it had "experienced an intrusion of a sample data set on one of our development servers." He said that the server wasn't in use by any of the company's clients and was shut down.

"This was an isolated intrusion, stemming from a white hat group who was searching for a known vulnerability in CouchDB," referring to Kromtech security researchers.

"We have diligently conducted a forensic audit confirming the data set was not downloaded," he said.

This is the second known data exposure of voter records this year.

The first, and largest ever to date, saw 198 million records on individuals from every state exposed. Deep Root Analytics, a data company working for the Republican party, took responsibility for the exposure.

Kromtech has in recent years discovered and reported on several US voter databases online, totaling 18 million voters, as well as the state of Louisiana's entire database of 2.9 million voters.

Kromtech's Alex Kernishniuk said the exposure was "yet another wake-up call" for companies and governments to audit their networks.

"There seems to be no end in sight for improperly secured data making its way onto the web, and with little or no accountability for proper storage and security measures, it is up to regulators to decide the best way to manage an aging electoral system that seems to be struggling to keep up with the digital age," he said.

ZD Net:

You Might Also Read: 

Hong Kong’s 3.7 Million Voters Exposed in Massive Breach:

Russia's US Election Hacks More Persistent Than First Thought:

 

« In Demand: New Tech Against Drone Attacks
Wanted: A New Microchip For The AI Era »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

GovCERT.HK

GovCERT.HK

GovCERT.HK is the Government Computer Emergency Response Team for Hong Kong.

Gemserv

Gemserv

Gemserv is a specialist market design, governance and assurance services consultancy.

CYSEC NG

CYSEC NG

Cyber Security Challenge Nigeria Initiative (CYSEC NG) is the first, and largest offensive premier Cyber Conference and Hacking event in Africa.

ETSI

ETSI

ETSI is a European Standards Organization dealing with telecommunications, broadcasting and other electronic communications networks and services including cybersecurity.

Cyan Securiy Group

Cyan Securiy Group

Cyan provide best-in-class cyber security solutions for mobile Internet and mobile devices that are extremely effective and highly intuitive in their use.

Intel Capital

Intel Capital

Intel Capital, Intel's strategic investment organization, backs innovative technology startups and companies worldwide. We invest in a broad range of hardware, software, and services.

DreamIt Ventures

DreamIt Ventures

DreamIt Ventures is an early stage venture fund that accelerates startups building transformative tech products in the fields of Healthtech, Securetech, and Urbantech.

Cybersec Infohub

Cybersec Infohub

Cybersec Infohub is a Hong Kong government programme to enhance the exchange of cyber security information with industry and enterprises to jointly defend against cyber attacks.

Quintillion Consulting

Quintillion Consulting

Quintillion Consulting is a strategic risk based consulting firm. We help companies safeguard the core business and IT capabilities that deliver competitive advantage.

Talon Cyber Security

Talon Cyber Security

Talon delivers the leading enterprise browser designed to bring security to managed and unmanaged devices, regardless of location, device type or operating system.

LBMC

LBMC

LBMC is a professional services solutions provider in accounting and finance, human resources, technology, risk and information security, and wealth advisory services.

Alpha Mountain AI (alphaMountain)

Alpha Mountain AI (alphaMountain)

alphaMountain provides up-to-date domain and IP intelligence for cybersecurity investigational and protection platforms.

endpointX

endpointX

endpointX is a preventative cyber security company. We help companies minimize their risk of breach by improving cyber hygiene.

Orca Technology

Orca Technology

Orca is a UK-based Managed Service Provider delivering end-to-end managed IT services, support, hosted desktop, cloud solutions and strategic guidance.

Cyberlocke

Cyberlocke

Cyberlocke is dedicated to finding inventive solutions to meet the distinct IT obstacles of each organization we support.

St Fox

St Fox

St. Fox is a leading consultancy helping enterprises secure their Cloud, Data, endpoints, and applications.