District of Columbia Board of Elections says RansomVC hacker group stole voters' data

Ransomware12 Oct 2023

The District of Columbia Board of Elections said it suffered a major ransomware attack that compromised the sensitive personal information of voters such as their names, contact information, political party affiliation, and polling location.The District of Columbia Board of Elections (DCBOE) is an autonomous body within the District of Columbia government that oversees and regulates ballot access, elections, and voter registration.Recently, DCBOE said that it is investigating a cyber security incident that compromised the confidential data of DC voters.“On October 5, 2023, the District of Columbia Board of Elections (DCBOE) became aware that a hacking group known as RansomVC claimed to have breached DCBOE’s records and accessed 600,000 lines of US voter data, including DC voter record,” DCBOE said in a statement.“While DCBOE is still investigating this matter, DCBOE has found that voter records were accessed through a breach of the web server of DataNet, DCBOE’s website hosting provider. No internal DCBOE databases or servers were directly compromised.”DCBOE shared a similar post on X, saying, “On 10/5, DCBOE became aware of a cybersecurity incident involving DC voter records. While the incident remains under investigation, DCBOE’s internal databases and servers were not compromised.”

IMPORTANT: On 10/5, DCBOE became aware of cybersecurity incident involving DC voter records. While the incident remains under investigation, DCBOE’s internal databases & servers were not compromised. Our full statement is pictured below & will be available on our website soon. pic.twitter.com/VCuhXOJLqK
— DC Board of Elections (@Vote4DC) October 6, 2023

The agency launched an internal investigation to determine the impact of the security incident and began working with its data security and federal government partners, namely the Multi-State Information Sharing and Analysis Center (MS-ISAC), the Federal Bureau of Investigation (FBI), Homeland Security (DHS), and the Office of the Chief Technology Officer (OCTO).

DCBOE is also working with MS-ISAC’s Computer Incident Response Team (CIRT) to resolve the issue. The election management agency also took down its official website, displaying a maintenance message on the home page.According to DataBreaches, a group of threat actors going by the name Ransomedvc has listed DCBOE as a victim on its data leak site. “We have successfully breached the District of Columbia Board Of Elections and have gotten more than 600k lines of USA Voters,” the group posted.The hacker group claims to be in possession of sensitive personal information of registered voters including their VoterID, registration date, voter’s full names, partial Social Security Numbers, driver’s license numbers, phone numbers, dates of birth, addresses, political party affiliation, email addresses, and polling place. The group said it plans to sell the data to the highest bidder.The same group of threat actors previously infiltrated Sony corporation’s systems, gained access to the company’s data, and said they would sell it to the right buyer. “We have successfully compromised all of Sony’s systems. We won’t ransom them! We will sell the data due to Sony not wanting to pay,” RansomedVC posted on its leak site.