Researcher finds trove of political fundraising, old voter data on open internet

Hacken says the server had authentication disabled and was openly visible on an IoT search engine.

A consulting firm that works with Democratic campaigns unknowingly left sensitive fundraiser information and credentials to old voter record databases open on the internet, according to a report published on Wednesday.

Cybersecurity company Hacken says it discovered an unprotected network-attached storage (NAS) device managed by Rice Consulting, a Maryland firm that provides fundraising and mass communication to Democratic clients. Authentication was reportedly disabled on the NAS, and Hacken says that it was indexed by Shodan, an Internet-of-Things search engine.

With its contents publicly accessible, the NAS revealed details about Rice Consulting’s clients as well as details about “thousands of fundraisers,” Hacken says. Those details include names, phone numbers, emails, addresses and companies. There were apparently also contracts, meeting notes, desktop backups and employee details.

Rice Consulting did not respond to an email request for comment on the Hacken report. When CyberScoop called the firm, the person who answered said “There’s no one here who can tell you anything,” and hung up.

Hacken said it tried contacting Rice Consulting, initially to no avail. The company also reportedly did not respond to emails and hung up when Hacken called.

“Finally, on October 18, public access to NAS device and sensitive files has been disabled and we received a ‘thank you’ note from Rice Consulting,” Hacken said. “With so many unreliable emails floating around, sometimes it is difficult to discern what is legitimate and what is not. Nevertheless, it’s not so hard to at least answer a call.”

Hacken also said that it found unencrypted spreadsheets full of credentials to databases managed by a company that collects voter information and provides technology services for Democratic campaigns. The company, NGP VAN, said that the databases in question were outdated and haven’t been accessed in years.

“NGP VAN confirmed that the accounts in the Rice documents were all old and currently inactive, with the last login for any of those accounts being in 2015,” the company said in an emailed statement.

As for Rice Consulting’s NAS, Hacken says that its access logs show activity by IP addresses from Turkey, South Korea and Thailand, as well as IP scanning services like GrayNoise.

“We suppose that NAS information could have been accessed by non-authorized and even malicious actors,” Hacken says in its blog post.

This isn’t the first instance of a private organization apparently exposing election-related information. In July, it was reported that hundreds of thousands of voters’ records were left exposed by a Virginia robocalling firm due to a misconfigured server.

Voter data can be coveted by malicious actors, with the possibility of trying to interfere in the voting process or using the data for identity fraud. A recent report from Anomali and Intel 471 showed that some people are crowdfunding to buy voter data off hacker forums. Voter registration information is often public information, but there are some restrictions to obtaining it.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure