US voter database containing 186 million records on sale months before election

A rolled up dollar bill
Support us and go ad-free

A new dark web analysis has shown that almost the entire US Voter database was up for sale months before the US presidential election began.

While it’s not news that voting information has been sold on the dark web in the past, the analysis found that the database contained 186 million records. Which, if authentic, would account for almost all US voters.

186 million records for sale

Cybersecurity company TrustWave infiltrated dark web marketplaces and found almost whole sets of the US voter and consumer database.

During investigations around the elections, the Trustwave SpiderLabs team discovered massive databases with detailed information about US voters and consumers offered for sale on several hacker forums. [Those databases] contain a shocking level of detail about citizens including their political affiliation.

The sellers of the US voter database claim that it includes 186 million records, and if that is correct, that means it includes information about nearly all voters in the US The information found in the voter database could be used to conduct effective social engineering scams and spread disinformation to potentially impact the elections, particularly in swing states.

The members-only site RaidForums, where the dataset was sold. was described by TrustWave as being:

widely known in certain circles as a place where members can obtain leaked and hacked data.

Read on...

Support us and go ad-free
The seller has earned over $100m in 5 months

While it hasn’t been confirmed that the entire database was sold, Trustwave has confirmed that the seller has received payments since May.

Based on Bitcoin transaction information also obtained by TrustWave SpiderLabs during the investigation, the cybercriminal group made a fortune worth $100m USD in the last five months alone.

TrustWave explained:

We managed to obtain details of one of the bitcoin wallets that can be used to pay to GreenMoon2019 for those databases. Money that is collected in that wallet was transferred to a bigger wallet. Hundreds of other wallets transferred amounts into that main wallet.

Many of the transfers were in hundreds of dollars or a bit more, much like showing in the price list above.  This main wallet was created in May and already received bitcoins in the value of over 100 million USD. GreenMoon2019 (the seller) probably is part of a group of cybercriminals that draw amazing revenues from selling these databases and potentially other services and deliverables.

However, GreenMoon2019, was not the only seller on the market.

While GreenMoon2019 gained attention by investigators for selling data on almost the entire US voter population, other sellers were re-selling free government information for a quick payday.

Voting data was available for as little as $9.99

Cybersecurity firm TrendMicro released a report in May showing that marketplaces for US voter data had been available for as little as $9.99.

TrendMicro investigated 600 dark web forums and found that there were several market places which offered state voting databases. The sellers had been active for year before the US presidential election, some with 100% satisfaction or ‘feedback’ rates. 

And when The Canary checked several sites on 5 November, we found that these datasets are still available:

Clicking on the question mark in the above image gives more information about what’s contained in the dataset. For example, the Florida voter database apparently contains the details of 12.5 million voters:

However, it’s likely given the low value of these datasets that they are either outdated or public information.

TrustWave stated:

Interestingly, at least some of the data stems from publicly available government resources and hackers happily mention that in forum discussions. Other parts of the data were likely obtained from various data leaks.

TrendMicro explained that even outdated voter information is valuable:

Outdated voter databases are often shared for free, while more current databases are put up for sale. Compromised voter databases combined with other user data can help malicious actors craft effective propaganda. For example, key data points can be used to create a target profile for a specific countries’ electorate.

The real deal?

While TrustWave has not confirmed if they attempted to access the US voter database, it did access part of the US consumer database.

The US consumer database was also up for sale and contained 245 million records, which would account for almost the entire US voter population.

TrustWave fact-checked one million data sets against public records and found that the data was “consistently accurate”.

It stated:

We managed to obtain a sample file of one million records from this actor. We checked the data against various public legit sites and social media networks, and the data was found consistently accurate. It includes information about citizens such as:

  • Full name
  • Physical address
  • Phone number
  • Email address
  • Number of children and their ages
  • Gender
  • Age
  • Marital status
  • Ethnic group
  • Their home value and purchase date
  • Their mortgage amount and lender name
  • A very long list of potential interest areas

TrustWave added:

Not all fields are populated. Some have data almost fully filled out while others are only scarcely populated. It is so detailed, that this file looks like a professional profiling database prepared by a government organization or enterprise.

Super databases could be used to sway voters

While re-selling freely available information may seem like a small scam, this information can be used along with leaked data to create super databases.

What makes these databases so super is that they can be used to influence opinions and spread information that isn’t true. As TrustWave summed up:

In our investigation of criminal activities surrounding the U.S. elections, we uncovered massive amounts of information on U.S. voters up for sale along with other databases detailing individual consumers. This information can be used for social engineering and disinformation campaigns before, during, and after elections to help sway opinions toward one party or another.

As we have shown these activities are extremely profitable and there is a real demand for these databases. We have also shown that cybercriminals are most likely mixing illegally obtained data from leaks with publicly available information on citizens and correlating them to create super databases with detailed information on almost every U.S. citizen and citizens of other major countries.

A very real threat

In a changing market, where marketplaces shift from platform to platform, once data is out there, it is very difficult to control its spread and use.

But one thing is certain, as TrustWave states, this information can “easily be used” for “disinformation campaigns”:

In the right hands, this voter and consumer information can easily be used for geo-targeted disinformation campaigns over social media, email phishing, and text and phone scams. The world is concerned about the spread of disinformation to sway public opinion – yet sensitive information on citizens is widely available.

While it remains unclear at the stage whether the US database was sold and used for disinformation purposes during the US election, it is clear that that the potential for such campaigns is a very real threat.

You can stay up to date with this series by bookmarking our #FollowTheMoney page or our investigations page.

Featured image Pexels – Karolina Grabowska

Support us and go ad-free

We need your help to keep speaking the truth

Every story that you have come to us with; each injustice you have asked us to investigate; every campaign we have fought; each of your unheard voices we amplified; we do this for you. We are making a difference on your behalf.

Our fight is your fight. You’ve supported our collective struggle every time you gave us a like; and every time you shared our work across social media. Now we need you to support us with a monthly donation.

We have published nearly 2,000 articles and over 50 films in 2021. And we want to do this and more in 2022 but we don’t have enough money to go on at this pace. So, if you value our work and want us to continue then please join us and be part of The Canary family.

In return, you get:

* Advert free reading experience
* Quarterly group video call with the Editor-in-Chief
* Behind the scenes monthly e-newsletter
* 20% discount in our shop

Almost all of our spending goes to the people who make The Canary’s content. So your contribution directly supports our writers and enables us to continue to do what we do: speaking truth, powered by you. We have weathered many attempts to shut us down and silence our vital opposition to an increasingly fascist government and right-wing mainstream media.

With your help we can continue:

* Holding political and state power to account
* Advocating for the people the system marginalises
* Being a media outlet that upholds the highest standards
* Campaigning on the issues others won’t
* Putting your lives central to everything we do

We are a drop of truth in an ocean of deceit. But we can’t do this without your support. So please, can you help us continue the fight?

The Canary Support us