GOP data firm Deep Root Analytics accidentally exposed personal details, including addresses and birthdates, of 198M voters-roughly 61% of US population
Political data gathered on more than 198 million US citizens was exposed this month after a marketing firm contracted …
Context & Ripple Effects
Deep Root Analytics, a marketing firm working for the GOP, left a database holding addresses, birthdates, and issue-by-issue sentiment analysis on more than 198 million US voters exposed. It is the second mega-exposure of American voter files in under two years, after a misconfigured database leaked names, birthdates, addresses, and voting history for 191 million voters in late 2015 with its owner never identified 191 million voter records exposed by an unidentified owner.
The pattern has only widened since: researchers later found demographic details for over 80 million US households sitting on an unsecured Microsoft cloud database 80 million household records on an unsecured cloud database, and in 2024 a contractor's unsecured servers exposed Illinois voter and election records including Social Security numbers 4.6M Illinois voter records exposed by a contractor. Deep Root's lapse matters because it ties the failure to named political actors, not just anonymous database owners.
First-order effects
- Roughly 61% of the US population now has addresses, birthdates, and modeled political sentiment attributable to a publicly exposed file, and the GOP's data operation faces immediate scrutiny over how its contractors handle voter files.
Second-order effects
- Political campaigns and party committees must re-examine vendor contracts and cloud storage configurations, since the same misconfiguration class hit an unidentified owner in 2015 and a Microsoft-hosted database in 2019.
Third-order effects
- If contractor-held voter and consumer databases keep leaking at this cadence, pressure builds for rules governing who may aggregate and store this data — shifting political data work from loosely governed vendor relationships toward audited custody requirements.
The trend: Americans' personal data held by political and commercial aggregators keeps escaping through unsecured third-party databases, making broker-side security failures a recurring structural problem rather than isolated incidents.