An advertisement on a forum that sells data breach information is also offering the personally identifiable details and voting history of millions of US residents. The estimated size of the cache is in excess of 35 million records.
The announcement says that the data sold is from updated statewide voter lists, and includes millions of phone numbers, full addresses, and names for 19 states.
The seller provides the number of records only for the lists in three of the states: Louisiana (3 million), Wisconsin (6 million) and Texas (14 million), offering them for prices between $1,300 and $12,500.
Other states on the list are Montana, Iowa, Utah, Oregon, South Carolina, Wisconsin, Kansas, Georgia, New Mexico, Minnesota, Wyoming, Kentucky, Idaho, Tennessee, South Dakota, Mississippi, and West Virginia.
All the lists can be purchased at different prices, probably according to the number of records they contain. For instance, the cheapest one is for Minnesota, currently available for $150.
Researchers at Anomali Labs and Intel471 have reviewed a sample of the records and "determined the data to be valid with a high degree of confidence."
The peddler says that the information in his possession is updated every Monday, via contacts in the state governments. To entice potential buyers, he says that the database includes the freshest information along with previous data. This strategy allows him to sell the same data multiple times.
"Certain states require the seller to personally travel to locations in-state to receive the updated voter information. This suggests the information disclosure is not necessarily a technical compromise but rather a likely targeted campaign by a threat actor redistributing possibly legitimately obtained voter data for malicious purposes on a cybercrime forum," Anomali Labs write in a report today.
The seller, does not have to look that hard for buyers. At least two members of the forum have expressed they would like to check what they would be paying for, adding that they have the money ready.
Although some of the prices are low, other members of the forum set up campaigns to raise the money for buying voter registration databases voted by participants.
The end goal of the crowdfunding campaign is to share the data publicly. At the moment, the database for Kansas has been acquired this way and shared with the financial backers. Next on the list appears to be Oregon.
Update 10/24/18: On October 19th 2018, the seller of the US Voter Record databases has begun offering a masterfile containing all of the states for $61,000 USD. In total, this masterfile contains 200 million records from "every single state".