[Breaches](/breaches) The Chicago Way: An Electronic Voting Firm Exposes 1.8M Chicagoans [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # The Chicago Way: An Electronic Voting Firm Exposes 1.8M Chicagoans ##### [UpGuard Team](/team/upguard) Published Aug 17, 2017 ##### Join 27,000+ cybersecurity newsletter subscribers *While this blog post provides a description of a data exposure discovery involving Election Systems & Software, this is no longer an active *[*data breach*](/blog/data-breach)*. As soon as ES\&S was notified of this publicly exposed information, immediate action was taken, securing the open repository and preventing further access.  * UpGuard’s Cyber Risk Team can now disclose that a data repository owned and operated by Omaha-based voting machine firm Election Systems & Software (ES\&S) was left publicly downloadable on a cloud-based storage site, exposing the [sensitive data](https://www.upguard.com/blog/sensitive-data) of 1.8 million Chicago voters. The database, which included voter names, addresses, phone numbers, driver’s license numbers, and partial Social Security numbers, appeared to have been produced around the time of 2016 general election [for the Chicago Board of Election Commissioners, an ES\&S customer since 2014](http://www.prweb.com/releases/2014/01/prweb11483809.htm). This data exposure highlights the continuing danger of sensitive voter information being exposed to the public internet by [third-party vendors](https://www.upguard.com/blog/third-party-vendor) hired by party organizations and electoral supervisors to assist in their efforts. While ES\&S’s prompt remediation of the breach is welcome news, the breadth of the exposure, affecting virtually every registered Chicago voter, is a stark reminder of how endemic [cyber risk](/blog/cybersecurity-risk) is to any process with a digital surface - including, in recent years, the processes of democracy. ## The Discovery On August 11th, 2017, UpGuard Director of Strategy Jon Hendren discovered an Amazon Web Services S3 bucket configured for public access, the contents almost entirely downloadable to anyone accessing the bucket’s web address. Located at the AWS S3 subdomain “chicagodb,” the main repository contains two folders, “Final Backup\_GeneralNov2016” and “Final Backups\_6\_5\_2017,” as well as a 12 GB MSSQL database file. Many of the file names indicated the name of ES\&S, one of the nation’s most prominent provider of voting machines and associated software. Following Hendren’s notification of the discovery to UpGuard Director of Cyber Risk Research Chris Vickery, Cyber Risk Team analysis revealed that this 12 GB file, as well as a 2.6 GB file and a 1.3 GB file stored in each folder, each constitutes a separate copy of a database containing the [personal information](https://www.upguard.com/blog/personally-identifiable-information-pii) of 1.864 million Chicago voters. After notifying the affected municipality, the exposure was closed on the evening of August 12th. While the databases contain a large number of SQL tables, with file names including such phrases as “BallotImages,” “polldata\_summary,” and “pollworker\_times,” of perhaps greatest interest is the table set titled “dbo.voters.” This data set lists the 1.864 million Chicago voters, each assigned a unique, internal voter ID, as well as their names, addresses, dates of birth, and more identifying details across dozens of columns. This reporter, a Chicago resident and registered voter, verified the data’s accuracy by looking himself up. The column “Status,” with possible inputs of “A” or “I,” likely refers to whether the voter in that row is active or inactive. As [Chicago only had 1.5 million active voters as of the November 2016 election](http://www.prweb.com/releases/2014/01/prweb11483809.htm), the listing of inactive voters in this database likely accounts for the discrepancy in numbers - indicating that this most likely constitutes a comprehensive list of all of Chicago’s voters. While all of the unique IDs in the database are associated with the voters’ names, addresses, gender, and DOBs, as well as more logistical electoral information, for most of those listed, more sensitive data is also included. Most of the rows also contain the voters’ driver’s license numbers and phone numbers. Perhaps most critically, the last four digits of the Social Security numbers of all 1.8 million people are also in the data set, a highly sensitive type of data often used as PIN codes or for verification purposes. ## The Significance As previously seen with [the UpGuard Cyber Risk Team’s discovery of the much larger exposure of 198 million US potential voters by a Republican National Committee vendor](/breaches/the-rnc-files), the danger of voter data being unwittingly exposed by private companies tasked with its storage remains a real threat, one that transcends any partisan concerns. Such government contractor risk is an avenue by which data used by the government for public processes might leak onto the internet. As more and more functions of daily life shift to a digital footing, so too grows the surface for a potential [cyber attack](/blog/cyber-attack), no matter whether this cyber risk is shifted off to a third-party vendor. Cyber risk is business risk, and a third party vendor’s cyber risk is the main enterprise’s business risk as well. Without a means of [cyber risk scoring](https://www.upguard.com/articles/a-brief-history-of-vendor-risk-scoring) for potential partners, enterprises will have no idea how securely their data will be handed if shared. [ES\&S’s CSTAR cyber risk score of 428](https://app.upguard.com/webscan?url=essvote.com), out of a possible 950, indicates the middling security posture to which this data was entrusted. In the case of this breach, as well as others, this data was only exposed because the Amazon S3 bucket in question was configured to allow public access, permitting anyone accessing the repository’s URL to download its contents. AWS default settings are built to ensure that only authorized employees are able to access this data. Should this access configuration be changed, the IT enterprise in question must have processes in place to ensure such exposures are caught and remediated. The rapid closure of this breach by ES\&S, and the ready cooperation of the City of Chicago in securing this data, is good news for all registered voters in the city. Once an exposure is found to have happened, it is imperative to move swiftly to foreclose upon the possibility of any exploitation of the data by malicious actors. However, for real [cyber resilience](https://www.upguard.com/blog/cyber-resilience) to take hold, IT enterprises must begin to craft processes capable of checking and validating any such openings before it reaches the public internet, lest the barn door be closed only after the horse has bolted. ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ## Related breaches Learn more about the latest issues in cybersecurity. [](/breaches/cyber-risks-of-the-2026-world-cup) #### [Own Goal: Inside the Cyber Risks of the 2026 World Cup](/breaches/cyber-risks-of-the-2026-world-cup) Free World Cup streams and black-market betting sites are leaking fan data. UpGuard research reveals the hidden cyber risks of the 2026 tournament. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) June 30, 2026 [](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) #### [Social Insecurity: Billions of Social Security Number and Passwords](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) UpGuard research found a trove of sensitive information in an exposed Elastic database. Getting to the bottom of what it meant led us down an interesting path. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) February 18, 2026 [](/breaches/angelsense-data-leak) #### [Sixth Sense: GPS and AI Data Exposed for Assistive Devices](/breaches/angelsense-data-leak) UpGuard can now report that it has secured an Elasticsearch database for AngelSense, a GPS tracker for children and adults with special needs. [](/team/upguard) [UpGuard Team](/team/upguard) January 30, 2025 [](/breaches/pta-database) #### [Stolen Data: National PTA Database Available on Dark Web](/breaches/pta-database) On May 13th, UpGuard discovered a new set of data recently posted on a prominent dark web forum, this time allegedly belonging to the National Parent Teacher Association. [](/team/upguard) [UpGuard Team](/team/upguard) May 14, 2024 [](/breaches/smarterselect) #### [Student Applications: How an Education Software Company Exposed Millions of Files](/breaches/smarterselect) UpGuard can now report that a public Google Cloud Storage bucket containing approximately 1.5 terabytes of data used to administer funding programs for college students has been secured. The bucket belonged to SmarterSelect, a company that provides software for managing the application process for scholarships, grants, and awards. The more than 2.8 million files included documents like transcripts, resumes, personal essays, tax returns, and invoices for approximately 1.2 million applications to funding programs. [](/team/upguard) [UpGuard Team](/team/upguard) November 22, 2021 [](/breaches/power-apps) #### [By Design: How Default Permissions on Microsoft Power Apps Exposed Millions](/breaches/power-apps) 38 million records were exposed in multiple data leaks resulting from misconfigured Microsoft Power Apps portals. Data included sensitive information such as COVID-19 contact tracing data, COVID-19 vaccination appointments, social security numbers for job applicants, employee IDs, and millions of names and email addresses. [](/team/upguard) [UpGuard Team](/team/upguard) August 23, 2021 [View all breaches](/breaches) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)