[Breaches](/breaches) Florida County Database Mistake: Election Officials’ Logins Among Exposed Data [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Florida County Database Mistake: Election Officials’ Logins Among Exposed Data ##### [UpGuard Team](/team/upguard) Published Oct 30, 2020 ##### Join 27,000+ cybersecurity newsletter subscribers UpGuard can now disclose that an [Amazon S3](/blog/s3-security-is-flawed-by-design) storage bucket containing publicly exposed backups of systems representing the intranet and web presence for Martin County, Florida has been secured. The dataset includes 1254 user account records, including password hashes for Martin County personnel including [third-party IT vendors](/blog/third-party-vendor) and six accounts for Martin County’s Supervisor of Elections office. Additionally, a Github access token was present among the publicly available data. In a battleground state during a presidential election cycle– in a state that George W. Bush won by 537 votes after the U.S. Supreme Court stopped a recount– this exposure illustrates the risk that [data leaks](/blog/data-leak) from cloud storage pose to an electoral system already embattled by pandemic, foreign threat actors, and voter suppression. Martin County is located in the Treasure Coast region north of Miami, with a population of around 140,000 residents. Like counties across the United States, Martin County is responsible for administering elections within its jurisdiction. And also like other counties, Martin makes use of IT infrastructure for some of the services they provide their constituents, and engages outside vendors to perform specialized web development work. These are the conditions that create the risk of data leaks– sensitive information inadvertently made public– and eventually lead to cases like this one. ## Discovery On September 18th, 2020, an UpGuard researcher discovered a publicly accessible cloud storage bucket named “martincounty”. The bucket contained two compressed SQL database backup files and a text file containing an authentication token tied to a project hosted on Github. Initial analysis of the contents indicated [sensitive information](/blog/sensitive-data) was present, including account login credentials for the Martin County Supervisor of Elections and several other county elections employees. The UpGuard Data Leaks research team then began the process of notifying Martin County. ‍ ‍ UpGuard Director of Risk Research, Chris Vickery, was able to get a message passed along to an attorney employed by Martin County, and received a phone call on September 22nd. Near the end of that call, the Martin County attorney requested a brief summary email from Vickery of details which would then be forwarded to the appropriate IT staff to review and fix. Chris sent the requested email as well as a follow-up email a few hours later with additional specifics highlighting one of the precise settings responsible for the files being publicly accessible. Public access to the Martin County bucket was removed around noon PST on September 23rd. ## Significance After the publicly available files were decompressed and restored into a MySQL database instance, the contents revealed a significant collection of data related to the administration of Martin County IT systems. Most significantly, a “users” table contained information for 1,254 accounts with access to Martin systems. Approximately 1,200 of those accounts were for Martin County employees. Six accounts had email addresses at martinvotes.com, the official website for the Martin County Supervisor of Elections. The remaining accounts belonged to third parties related to the development and maintenance of the county web systems. ‍ ‍ The data about each user included email address, hashed password, timestamps for the user’s creation date and last login. The password hashes were all unique, indicating they were not default passwords sometimes used in the set-up of a system, and the login dates were all around the same time as the file’s creation in 2017, again supporting what one would expect to see in real user data. ‍ ‍ The databases also had many other tables related to the broader administration of county services, like audit logs for the actions performed by each user and errors. Those logs show two requests for documents from an IP address allocated to a Russian internet service provider. Further investigation by UpGuard analysts discovered that this IP address had been flagged as the origin of SMB2 exploitation attempts in the past, unrelated to Martin County, but UpGuard is unable to corroborate the anonymous source of that flagging. ‍ ## Conclusion What a threat actor could accomplish with this data is unknown, but the nature of the data raises some potential scenarios. Hashed passwords, particularly common passwords, can potentially be cracked and made legible as plaintext again. Detailed logs of county employee’s interactions with the site, and a list of email addresses and user roles, provide fodder for social engineering attacks. What access election officials have to voter data is unknown, but this database was created in 2017, during the current election cycle. And as social media platforms have made clear in their recent policy changes warning against false claims that a candidate has already won, access to voting data isn’t necessary to have an adverse effect on free elections. Disinformation about voting sites, times, and election results can all affect elections, and that is also information distributed by counties, in part through their websites. [Hear directly from our research team at Protecting the Vote 2020, our live virtual event.](https://summit.upguard.com/events/details/upguard-upguard-summit-presents-protecting-the-vote-2020-election-security) ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ## Related breaches Learn more about the latest issues in cybersecurity. [](/breaches/cyber-risks-of-the-2026-world-cup) #### [Own Goal: Inside the Cyber Risks of the 2026 World Cup](/breaches/cyber-risks-of-the-2026-world-cup) Free World Cup streams and black-market betting sites are leaking fan data. UpGuard research reveals the hidden cyber risks of the 2026 tournament. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) June 30, 2026 [](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) #### [Social Insecurity: Billions of Social Security Number and Passwords](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) UpGuard research found a trove of sensitive information in an exposed Elastic database. Getting to the bottom of what it meant led us down an interesting path. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) February 18, 2026 [](/breaches/angelsense-data-leak) #### [Sixth Sense: GPS and AI Data Exposed for Assistive Devices](/breaches/angelsense-data-leak) UpGuard can now report that it has secured an Elasticsearch database for AngelSense, a GPS tracker for children and adults with special needs. [](/team/upguard) [UpGuard Team](/team/upguard) January 30, 2025 [](/breaches/pta-database) #### [Stolen Data: National PTA Database Available on Dark Web](/breaches/pta-database) On May 13th, UpGuard discovered a new set of data recently posted on a prominent dark web forum, this time allegedly belonging to the National Parent Teacher Association. [](/team/upguard) [UpGuard Team](/team/upguard) May 14, 2024 [](/breaches/smarterselect) #### [Student Applications: How an Education Software Company Exposed Millions of Files](/breaches/smarterselect) UpGuard can now report that a public Google Cloud Storage bucket containing approximately 1.5 terabytes of data used to administer funding programs for college students has been secured. The bucket belonged to SmarterSelect, a company that provides software for managing the application process for scholarships, grants, and awards. The more than 2.8 million files included documents like transcripts, resumes, personal essays, tax returns, and invoices for approximately 1.2 million applications to funding programs. [](/team/upguard) [UpGuard Team](/team/upguard) November 22, 2021 [](/breaches/power-apps) #### [By Design: How Default Permissions on Microsoft Power Apps Exposed Millions](/breaches/power-apps) 38 million records were exposed in multiple data leaks resulting from misconfigured Microsoft Power Apps portals. Data included sensitive information such as COVID-19 contact tracing data, COVID-19 vaccination appointments, social security numbers for job applicants, employee IDs, and millions of names and email addresses. [](/team/upguard) [UpGuard Team](/team/upguard) August 23, 2021 [View all breaches](/breaches) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)