Data leak
Deep Root Analytics 2016 Voter Data Exposure β 198 Million Americans
Primary Source βIncident Details
In June 2017, UpGuard cybersecurity researcher Chris Vickery discovered an Amazon S3 bucket belonging to Deep Root Analytics β a data analytics firm that had been contracted by the Republican National Committee (RNC) for the 2016 presidential campaign β that was publicly accessible without authentication. The bucket contained 1.1 terabytes of data on approximately 198 million Americans β nearly every registered US voter β compiled from a variety of sources including voter registration rolls, commercial data, and political analytics. The data included names, dates of birth, home addresses, phone numbers, voter registration details, and highly granular political scoring data: ethnicity modeling, party affiliation, stance on issues including gun control, stem cell research, and 46 other modeled issue positions. The data had been compiled for campaign microtargeting purposes. Deep Root Analytics confirmed the exposure, acknowledging it was their data and that it was their mistake. The company stated the information is available to the public but should not have been stored this way. The discovery was made just weeks after similar exposures from Republican analytics firms RNC’s DataTrust and Targeted Victory. The incident highlighted the risks of political data brokers holding extensive voter databases and the inadequacy of AWS S3 access control practices.
Technical Details
- Initial Attack Vector
- Deep Root Analytics, a data analytics firm contracted by the Republican National Committee, misconfigured an Amazon S3 bucket that was set to public access; the bucket contained detailed voter data compiled from multiple sources including publicly available voter registration records, proprietary commercial data, and political modeling scores
- Vendor / Product
- Deep Root Analytics AWS S3 bucket
Timeline
- 2017-06-01 Breach occurred
- 2017-06-19 Publicly disclosed