Reported Compromise of California Voters’ Personal Information
Security researchers at the Kromtech Security Center, providers of MacKeeper and PCKeeper Anti-virus services, reportedly discovered that unidentified hackers obtained the personal information of 19+ million California voters. It is currently unknown if the data was obtained via an intrusion into the California state information systems. Nevertheless, the Secretary of State’s Office – responsible for storing and securing voter data – released a statement saying there was, “no evidence that any of the Secretary of State’s systems have been hacked or breached.”
How the Data was Stolen
According to Kromtech, the data was stolen sometime around 31 May 2017. While it is still unknown how this happened, it does appear that it may have been stored on a MongoDB database that was reportedly exposed due to a critical vulnerability in January 2017. As such, this data may have been hosted by any number of political parties, political action groups, and other special interest groups in addition to the California Secretary of State.
What Data was Stolen
The compromised personal data appears to consist of each person’s full name, home address, email addresses, phone numbers, gender, date of birth, and voting precinct. The cybercriminals who are in possession of the data are reportedly holding it hostage. They are requesting .2 bitcoin, which as of today (18 December 2017) is worth approximately $3,745. If paid the hackers have stated that they will delete the data. The low asking price may indeed convince California to pay the ransom, however, there is no completely verifiable way for the state to ensure that the data was actually deleted.
Impact and Mitigation
The compromise of this data comes on the heels of the Equifax breach reported in September and the U.S. Government Office of Personnel Management breach reported in 2016. In both breaches and many others, millions of individuals’ personal information was stolen. It yet again opens up California residents to the risk of identity theft and further demonstrates the criticality of organizations and companies to make information security a priority. California residents should closely monitor their credit and consider investing in an identity theft monitoring service.