A Mexican political party called Movimiento
Ciudadano – or Citizens Movement - has hinted it was responsible for the
massive leak of 93.4 million voter records earlier this month (April).
However, instead of issuing an apology, the politicians instead launched
an attack against the "hacker" who found the data – even though no hack
took place.
As previously reported,
well-known security researcher Chris Vickery uncovered the electoral
database on an open port using the Shodan search engine. The trove of
data – which contained names, home addresses and National ID numbers on
millions of citizens – had no password protection or encryption in
place.
In the days following the leak going
public, many speculated the breach of data could have only come from
someone – or a group of people – who had access to such sensitive data
including the Mexican political parties.
Now, as reported by elfinanciero.com, Citizens Movement officials have acknowledged it was likely its data that ended up online. In a press conference
held at the Instituto Nacional Electoral (INE) on 27 April, politician
Delgado Ranauro said his party put the data online at the behest of a
technology firm called Indatcom.
Citizens Movement, Ranauro said, initially
received three copies of the electoral records and while it returned
two, the officials said it kept one in order to "perform security
safeguards in order to ensure their integrity." However, on 22 April,
the politician said he was when informed the data had been the victim of
a "cyber assault" and an "external attack."
Even though the data was left unprotected
online, Ranauro said he now intends to "present a criminal complaint
against person or persons responsible for the cyberattack." He added:
"Citizens Movement demands punishment for [the] cyber attackers who
violated our security protocols."
In response to the statement, researcher Chris Vickery told DataBreaches.net
he strongly denies any accusations of hacking. He said: "This database
had no password or any other protection enabled. It was being published
openly to the world. There simply was nothing to hack even if I had
wanted to do so.
"I have screenshot evidence proving this. If
the database was protected in any way, it would not have appeared in the
Shodan search engine. I have reached out to Amazon and am awaiting a
reply regarding whether or not Amazon informed the 'Citizens Movement'
that there was a hacking incident."
Post a Comment