Voter Registration Database for Sale on Dark Web

The ZeroFOX Alpha Team observed a posting on the popular hacking forum RaidForums advertising “Voters Affiliation 2020 - 186Million Records” by the user “greenmoon2019” on September 21, 2020. The seller provided a small sample of records in the listing containing information for voters in a variety of US states. This database is particularly noteworthy at the moment due to the upcoming election and the potential for misuse of this data. In addition, this data can be used for a number of malicious activites by threat actors looking to scam, steal from, or otherwise impact voters contained in the database. The ZeroFOX Alpha Team assesses that databases will probably increase in popularity in the time leading up to the US election.

Recommendations

Be vigilant when responding to or engaging with political emails or ads that you receive, especially ones requesting donations.
Be cautious taking unsolicited calls (cold callers) where they provide your personal information in order to verify their identity. Always ask to call the company back on a publicly listed number to verify the caller.

Details

On September 21, 2010, the user “greenmoon2019” posted on RaidForums advertising a database of 186 million voter registration records, with 60 million entries containing phone numbers. The seller provided a small snippet of data containing 20 users data from all over the United States with information including the following:

First Name
Middle Initial
Last Name
Address
City
County
State
Zip
Phone
Gender
Age/Year
Party affiliation

The account selling the data has been active since January 2019 and during that time has obtained a reputable data breach broker within the marketplace, selling multiple databases and records containing sensitive data.

The data “greenmoon2019” has for sale includes sensitive information of customers from multiple verticals across multiple geographical locations, which could indicate they do not target a particular sector to resell data on.

The ZeroFOX Alpha Team was able to obtain another sample from the seller with 5,000 voter registration records. There were records for each state including in the sample, with the top 5 states being:

PA - 211 records
NY - 271 records
FL - 417 records
CA - 478 records
TX - 497 records

The data contained data on the following party affiliations:

183 - Liberal
1098 - Independent
1470 - Republican
2233 - Democrat

Due to a warning from government agencies of potential political interference from other countries attempting to spread disinformation, voter registration databases have become more popular for abuse by threat actors. The Alpha Team has observed an increase of voter registration databases being sold on the dark web, which could indicate the amount of interest in this data along with the potential for malicious activity is also increasing. There are approximately 120 postings on RaidForums alone advertising some form of voter registration data.

Entities attempting to sow discord in the 2020 election can use this data in a variety of ways and could use the data in these dumps to target specific political parties. In addition, non-political based attackers could use this information as pretext for phishing campaigns, for instance, targeting users in a given political party for donations to their candidate and stealing financial data or funds intended for their party candidate. This data could also be used to perform targeted Vishing, where the attacker may impersonate a company and gain the victim’s trust by using knowledge of their address, date of birth and other personal information in order to verify the caller’s identity.

Sensitive information contained within the records, combined with OSINT, could be used by determined attackers in order to impersonate or harass potential victims. For example, using the victims name, address and phone number could allow an attacker to locate the individuals date of birth, which could potentially lead to identity theft, SIM swapping and other attacks. It is also not uncommon for this type of data to be sold to marketing firms or advertising networks for targeted advertisements.