There’s only weeks until the next election and things are, to put it nicely, a sh*tshow. The Republicans are running their mouths to encourage division and hate … and hackers are selling American voters’ information online.
The Associated Press reports that a whopping minimum 35 million voter records were available for purchase online. The information comes from 19 states and they were up for sale on a “dark web” forum.
The information available may not be due to direct database hacking, since buying voter data isn’t an uncommon practice.
The researchers said Monday the offering does not mean voter databases have been breached. The records could have been stolen from resellers who buy voter data from states for use by campaigns and get-out-the-vote efforts.
Policies vary by state on who can buy such records, which typically include phone numbers and addresses, sometimes voting histories. Commercial use and publication are generally prohibited.
What is uncommon is that hostile state actors could easily access this kind of information with November 6 quickly approaching.
The states affected are Georgia, Idaho, Iowa, Kansas, Kentucky, Louisiana, Minnesota, Mississippi, Montana, New Mexico, Oregon, South Carolina, South Dakota, Tennessee, Texas, Utah, West Virginia, Wisconsin, and Wyoming.
The research comes from folks at Anomali Labs and Intel 471, “a leading cybercrime intelligence provider,” who hypothesize that this is part of a targeted campaign.
Of note, the seller indicates they receive weekly updates of voter registration data across the states and that they receive information via contacts within the state governments. Certain states require the seller to personally travel to locations in-state to receive the updated voter information. This suggests the information disclosure is not necessarily a technical compromise but rather a likely targeted campaign by a threat actor redistributing possibly legitimately obtained voter data for malicious purposes on a cybercrime forum.
To our knowledge, this represents the first reference on the criminal underground of actors selling or distributing lists of 2018 voter registration data, including US voters’ personally identifiable information and voting history. [Emphasis added]
The entire post is worth a read, but they say that the forum started a crowdfunding campaign to buy the database and share it with other hackers on the forum for free. Kansas voter records—priced at $200—have already been bought and shared.
The conclusion is especially haunting: “Given the illicit vendor claims of weekly updates of voter records and their high reputation on the hacker forum, we assess with moderate confidence that he or she may have persistent database access and/or contact with government officials from each state,” the authors state.
AP reports that the main risk is “identity theft,” but it is a lot more sinister when we look at what that means.
“In a voter identity theft scenario,” the researchers wrote, “fraudsters can cause disruptions to the electoral process through physical address changes, deletion of voter registrations or requests for absentee ballots on behalf of the legitimate voter.”
The West Kentucky Star says the prices varied by each state. Wisconsin cost $12,500 compared to a measly $150 for Minnesota. Texas records were listed for $1,300.
It seems that federal and state governments are looking into the issue to verify the activity detailed in the report. The state’s Secretary of State Alison Lundergan Grimes says she’s working with agencies, including the Department of Homeland Security, to investigate.