Voter registration data from nine states has been found for sale online, raising serious privacy concerns.

The initial finding comes from LookingGlass Cyber Solutions Inc., via a story in Dark Reading Monday. The firm discovered nearly 10 million voter records for sale on a darknet site called RaidForums, finding that the records from at least two of the states — Arkansas and Ohio — were sold for a mere $2 each over the last few days.

The same report claims that the data available includes full first, last and middle names, voter IDs, birthdates, voter status, party affiliations and residential addresses of voters in Arkansas, Colorado, Connecticut, Delaware, Florida, Michigan, Ohio, Oklahoma and Washington state.

The first guess is that the data may have been obtained through the hacking of voter systems during the 2016 Presidential election, but it would appear that the person selling the data had obtained it through legal methods, specifically through freedom of information requests. Obtaining the data is completely legal, but selling the data for commercial purposes is not.

SiliconANGLE investigated the claims and confirmed that the voter registration data was available. However, although it may well be for sale on the darknet, accessible only through special software, it’s actually available on the regular world wide web and is an easy Google search away to find.

The first search result in Google for “raidforums voter registration” links to a result for “Arkansas 2017 Voter Database” on RaidForums and offers 1.7 million voter records for members of the forum to download for free.

The second result, listed by a user called Malkian, offers “Utah Voter Database – Leaked, Download!” and offers IDs, full names, date of birth, genders, phone numbers and the citizen status of the 731,639 people on it. Unlike the Arkansas listing, the data is claimed to be from a hack in December 2015. The third result in Google links to voter registration data from Pennsylvania, with the fourth result offering data from Michigan.

Whether available on the darknet or general Internet, the availability of these databases for download raises serious privacy concerns given that the data within them could be used for nefarious activities ranging from phishing to identity fraud.

Photo: kheelcenter/Wikimedia Commons