A leaked database containing the voting records of millions of Mexican voters has been discovered by a security researcher.

Chris Vickery, who works for MacKeeper, said he first spotted the Mexican voters' roll—containing the records of 87 million voters in Mexico—on April 14. Vickery told Ars that he found the database with Shodan, a search engine that can find pretty much anything connected to the Internet.

"The search term that returned this database was just 'port:27017' (the default MongoDB port)," Vickery said. "There really was nothing special about the search terms. It was just a stroke of luck that I saw it and followed up."

He added that the database was not accessible over HTTP: "You had to use a MongoDB client, but all you needed was the IP address. There was nothing protecting it at all."

The database has since been taken down, however it took Vickery a while to alert Mexican authorities of its existence, he told the BBC. After mentioning the leak during a talk at Harvard University, he was approached by a Mexican person, who helped to authenticate the data.

A journalist, who also happened to be at the talk, helped Vickery to inform the Mexican National Electoral Institute about the database leak.

The institute has issued a statement (in Spanish) in which it said that the data had been hosted on Amazon Web Services (AWS).

"A copy of the electoral register has been found in a file storage site of the US company Amazon," according to the BBC's translation of the org's statement. "An internal investigation has been launched and the case has been reported to the special prosecutor for electoral crimes."

Amazon said:

All AWS security features and networks continue to operate as designed. On April 21, AWS was notified that an unsecured database containing sensitive information was being hosted on the AWS Cloud and was publicly accessible via the Internet. We then notified the customer by both email and phone. As of 1:00 am on April 22, this database was no longer publicly accessible. Customers who have questions about security best practices can find information at our Security Resources page.

"The Mexican government says that when they give out these data sets, each set is 'watermarked.' That means they put in a few fake records and different fake records for each set, Vickery said.

"That makes it possible to determine who was responsible for the set that got leaked. So, soon enough we'll at least know which non-governmental authority was responsible for the particular data that was leaked," he added.

"I also believe Amazon should be able to reveal quite a bit about who owns the account responsible for the upload."

Massive data leaks of this kind have been uncovered a number of times in recent months. In December, Vickery himself reported a publicly available database that contained data on 13 million users of MacKeeper. He found it in a similar way—browsing through unprotected MongoDB databases. Shortly after that incident, the company hired him to head up its analytical and security centre.

Earlier this month, an electoral register with data on 50 million Turkish citizens—including that of the country's president Recep Tayyip Erdogan—popped up online. An Icelandic hacker group was reported to be behind that particular data leak.