Republican Polling Firm Hacked, Personal Donor Information Revealed

Victory Phones, a Republican phone polling and research firm, was hacked after the 2016 United States presidential election, resulting in information on tens of thousands of Americans who donated to Republican political campaigns being exposed.

The breach of the Grand Rapids, Mich.-based polling firm occurred in January and exposed several database files to attackers—one of which contained 223 gigabytes of information, including about two billion individual records.

Included in the massive database assembled by the polling firm was some personal information about Republican voters. A total of 166,046 unique email addresses were included in the database, along with names, postal addresses, genders and the amount of donations an individual has given to Republican campaigns.

Another file stolen from Victory Phones contained details about employees at the polling firm. The file included employee usernames, passwords, postal addresses and IP addresses of where the users logged in from.

Luckily, the passwords associated with the employee accounts were hashed and salted, a cryptographic practice that adds random characters and jumbles the password—making it difficult, though not impossible, to crack.

According to public records, Victory Phones gave $207,602 to the campaign of Senator Rand Paul, R-KY, and $79,646 to Congresswoman Martha Roby, R-AL. The polling firm also gave $103,977 to the Republican Party of Michigan and $64,229 to the Republican National Committee, along with a number of other donations.

Victory Phone’s chief executive David Dishaw told ZDNet he wouldn’t comment on the “veracity or validity” of the stolen data but did confirm the company was one of thousands to fall victim to a wave of hacks against MongoDB databases that occurred earlier this year.

About 27,000 unsecured MongoDB databases were targeted and had information stolen. The databases contained no password to protect against unauthorized access. In some cases, hackers would steal information and leave a ransom note. Victory Phones never received a ransom but did fall victim to a breach.

The organization claims to have taken steps to “enhance the security of our data.” However, a server with an open database port belonging to Victory Phones is still listed on Shodan, a search engine that reveals unprotected internet-connected devices and databases.

The stolen database from Victory Phones—including the more than 166,000 email addresses—were provided to security expert Troy Hunt, who maintains the breach notification service Have I Been Pwned.

Individuals who fear their information may have been exposed in the Victory Phones breach can check the Have I Been Pwned database to see if their email was included and can sign up for notifications to be alerted if their email is in a future breach.

According to Hunt, about 75 percent of the email addresses from Victory Phones were already in the Have I Been Pwned database, meaning those email addresses have already been exposed in a previous breach.