Voter Information for 191 Million Leaked; Be On the Lookout for Phishing and Vishing Scams

A big part of the 24 hour news cycle lately is the story about a self-proclaimed white hat hacker who found a database leak containing possibly the registration information on every voter in the United States; that’s 191 million people. He was able to download 30 gigabytes of data before he stopped and realized that there was definitely an issue that needed to be corrected. The information included names, addresses, phone numbers, registered political party, and information on whether or not the voter had cast a ballot in primary or general elections. Those details go back to the year 2000.

The information is usually publically available by other means, although not so easily and not in such a cleaned form. The information retrieved isn’t the story in this case. The story is two-fold:

1. There is a very large database, owned by someone that needs to be secured from public access. There is not much known about the database, at least that the “researcher” has disclosed, but anyone in charge of database management needs to be aware that this is an issue. All databases on a network should be reviewed to make sure the information in them is secured and not leaking out.

In the case of recent incidents, such as the Sanriotown online fan site and MacKeeper, it was an issue with MongoDB.

2. The information leaked in this incident can be collected and used for various purposes. Most obviously, anyone who wants to target a particular group; be it voters registered to a particular party or voters living in a particular district, can be marketed to in a very specific way. This also means, phishing and vishing (phone scams) can occur in a very targeted way.

In addition, the information can be collected and cross-referenced with other leaked or stolen information to complete “profiles” that may be used for identity theft or something else. It all depends on what the person who has it wants to do with it.

Targeted phishing is called spear-phishing. Traditionally it has been used to target employees of financial institutions and government organizations to get to very specific information. Therefore, it is very important that everyone understand how to detect phishing. Look for and do the following:

• Incorrect use of the language in which the message is written.

• Typos and missing punctuation.

• Links that don’t go where you expect them to. Hover the mouse over them to see where they are going and don’t click if they are suspicious. If you use a tablet or mobile device, you can hold your finger stylus on the link for a bit and the link address will appear.

• If an email with an attachment or link shows up and you are not expecting it, it could be phishing. Confirm that it is legitimate by placing a phone call or sending a new (non-reply) email to the sender.

• Vishing is when information that is retrieved by a scammer is used to phish using the telephone. Be aware of calls from people asking for information via that phone, even if they seem to know about you. This may become a bigger issue as the U.S. gets closer to election time in that scammers will use voting information to phish. Keep sensitive details about yourself and those in your home private and don’t give out credit card details via the phone unless you initiate the call and intend to pay for a product or service.

Sensitive information such as social security numbers and payment information of any kind was not part of this leaked data. However, if it is collected and put together with other information from breaches or other leaks, it can be used for identity theft. So make sure you also get you free annual credit reports and look for suspicious activity. Report it to the credit bureau immediately for resolution.

Jim Stickley of Stickley on Security provides some sound advice on this: Order one of those free credit reports every four months from each of the bureaus (Experian, TransUnion, and Equifax). Then you can react to potential fraud quicker. Remember, these are available from the government sanctioned annualcreditreport site at no charge. Other sites will provide the same reports, but may charge you or try to upsell you on other products and services. Make sure you read the fine print and if they ask for your credit card, it probably won’t be free in the end.