A listing for the database recently appeared on a dark web marketplace called The Real Deal, a popular site many cyber criminals use for buying and selling everything from illegal drugs to zero-day software exploits. The seller, "DataDirect," is offering the records at a "bulk rate" of 12 Bitcoin, or about $7,800.
The listing contains purported screenshots of the databases, which are .json files, with file names of apparent states, such as az.json for Arizona, and fl.json for Florida. Another screenshot appears to show the information contained on voters, which includes full name, address, date of birth, phone number, date they registered to vote, state voter ID number, political party, and whether they voted in the general or primary elections for a given year going back to the year 2000.
There were no Social Security numbers present in the data viewed by Tech Insider.
It is unclear how "DataDirect" obtained the database. When asked, the seller told TI that the source could not be revealed since it would prevent them from continuing to have access in the future. We also cannot fully confirm its contents are legitimate without being given a full look.
However, a look into the purported California voter shown in the seller's screenshot shows that the data about him is correct: The man's name, age, address, and phone number all match up with what TI could cross-check against public sources.
The Real Deal
Furthermore, the file sizes of the state databases seem to match up with how many voters would be in a given state. For example, the California file is roughly 31 megabytes for its approximate 17 million voters. The Washington, D.C. database is much smaller - about 880 kilabytes - which suggests a smaller database keeping in line with its much smaller voter footprint.
The seller also gave TI a sample with five other voters taken from the Florida database.
We were able to verify the name, address, and phone number of one voter in Pasco County. Another voter, whose name Tech Insider will not reveal due to privacy concerns, had the phone number of a Florida middle school in the database, which had his name listed as a teacher on its website.
All of the voter records in the sample, and the screenshot on the seller page, show a line of when they were updated as being in 2014.
This suggests the database may be of an older variety, though it is only showing up for sale now. It's also not all that clear how valuable this data would really be, since much of the voter information can already be found on a publicly-searchable website like VoterRecords.com. However, it could potentially be useful due to it being a database with a multitude of voters all in one place.
It's hard to pin down exactly where this database may have come from.
A large database like this would be a prize to hackers and cyber criminals who can use it for further scams, and there have been hacks on state voting networks in the past, such as one that occurred in Illinois this week.
The problem of where it could be from is further compounded by the amount of third-party firms who share and sell such databases. Campaigns will purchase such lists for voter outreach efforts, such as direct mail and telephone marketing campaigns.
The Election Assistance Commission did not immediately respond to a request for comment.