Misconfigured RNC Server May Have Exposed Data of Nearly 200 Million

An analytic company that was contracted by the Republican National Committee (RNC) has left records of nearly 200 million potential voters exposed to the world. An Amazon Cloud account that held the information was discovered by a researcher who said anyone who knew how to get the information could have done so rather easily. This is not the first time a misconfigured system has left information exposed, but just may be the largest. If the numbers are correct and put into perspective, that’s over half the population of the U.S.

The account was left open without so much as a password and found by researcher Chris Vickery of security company, UpGuard. He said the information included 25 terabytes of information and 1.1 TB of that was downloadable. The information included names, addresses, an ID code that could be used to research the voters and some analytic models that predicted how an individual voter would feel about various issues and how they may vote on those and candidates in the future.

Misconfigured databases and cloud servers are, unfortunately, a common occurrence. These issues often leave a significant amount of critical and sensitive information exposed. MongoDB is frequently found misconfigured. Vickery has found several other instances of this misconfiguration problem, including exposed military engineering plans and databases of believed terrorists. In the past, the FBI has warned those responsible for healthcare data to secure their servers due to targeted threats and businesses have been advised often to ensure their databases are secured so that data is not exposed. A report of data breaches of the first quarter of this year has found misconfigured databases to be one of the most common issues.

The company responsible for this incident, Deep Root Analytics, has taken full responsibility. They also hired a company to help investigate the exposure and risks resulting from it. The data was left unsecured from June 1 to June 14 and according to Deep Root Analytics, has now been secured.

Although the data could have been accessed by “anyone,” fortunately they would also have had to know the web address of the files. Therefore, the risk is a bit lower than it would be otherwise.