Approaching the November midterm elections, researchers discovered 35 million U.S. voter records from 19 states being sold on a hacking forum. The voter data records being sold reportedly include “full name, phone numbers, physical addresses, voting history, and other unspecified voting data.”

After hearing dark web communications about the sale of voter databases, Anomali Labs and Intel 471 researchers tracked down a post offering to sell tens of millions of 2018 voter registration records for 19 states.

Anomali Labs wrote:

To our knowledge, this represents the first reference on the criminal underground of actors selling or distributing lists of 2018 voter registration data, including US voters’ personally identifiable information and voting history. With the November 2018 midterm elections only four weeks away, the availability and currency of the voter records, if combined with other breached data, could be used by malicious actors to disrupt the electoral process or pursue large-scale identity theft.

They estimate that the sale could exceed 35 million voter records.

Three of the listed states represent 23 million U.S. voter records. While the number of voters is not listed for the other states, each was assigned a price tag. Below are the 19 states and prices listed on the hacking forum under “USA Voter Lists 2018,” but listed in order of most expensive to the least expensive.

The voter records for Wisconsin, advertised as having 6 million voters, is for sale for $12,500. Louisiana, which is advertised as having 3 million voters, is listed for $5,000. New Mexico – $4,000 South Carolina – $2,500 Tennessee – $2,500 South Dakota – $2,500 Kentucky – $2,000 Texas, which is advertised as having 14 million voters, is priced at $1,300. Iowa – $1,100 Utah – $1,100 Mississippi – $1,100 Montana – $1,000 Idaho – $1,000 West Virginia – $500 Oregon – $500 Wyoming – $500 Georgia – $250 Kansas – $200 Minnesota – $150

The seller promised to update the voter registration data every week as he or she receives “information via contacts within the state governments.” Anomali Labs added, “Given the illicit vendor claims of weekly updates of voter records and their high reputation on the hacker forum, we assess with moderate confidence that he or she may have persistent database access and/or contact with government officials from each state.”

Hacker forum crowdfunding to buy the voter records

Within hours of the voter lists going on sale on Oct. 5, 2018, Anomali Labs noted that a crowdfunding campaign popped up to buy the voter records. “The purchased databases would be made available free of charge to all registered members of the hacker forum, with early access given to donors of the project.” The first voter records acquired through the crowdfunding were for Kansas.

A second crowdfunding project took a vote for which state was most wanted; Oregon won. If and when that crowdfunding goal is met, then there will be another vote to pick a state and another round of raising funds to buy the voter records.

The crowdfunded buyers are reportedly not the only buyers of the voter records.

Voter records from 5 more states

Anomali Labs told ZDNet that they believe the seller may be the forum admin using a different alias, as that person previously shared 2018 voter records on his forum for the following six states: Washington, Pennsylvania, North Carolina, Florida, Connecticut, and Ohio.

Law enforcement is aware of the voter records sales.

Another sale on Dark Web was not publicly disclosed before

Security researcher Chris Vickery added that after he reported the massive leak of 191 million voter records back in 2015, an unnamed government entity claimed a separate investigation of U.S. voter registry records being sold on the dark web had been going on for months. Although Vickery was asked not to speak about it at the time, he tweeted:

It's been 3 years since then. I feel it is now appropriate to cautiously say one thing:

When I reported the Dec 2015 leak, at one point a gov entity informed me that a separate investigation had been going on already for months involving a similar nationwide US voter registry... — Chris Vickery (@VickerySec) October 15, 2018