“Most campaigns salt their lists (i.e. put bogus records into their database) so they can a) tell when mail is received after it drops and b) tell if someone has stolen their data. If you start getting mail addressed to a fictitious name that only appears in your database, you can tell your data has been compromised.

I’ve mostly heard of the FEC doing that to catch campaigns using public records, but not to many campaigns. Unless it’s a really big campaign that is very cognizant of the value of their data, you don’t usually see that. Even with mail delivery, cutting edge campaigns are able to to track indvidual deliveries (down to the DDU at least), so that’s not even necessary anymore.

Disable its DRM and share it on limewire?

After resolving the prolem we combed through the logs of reports accessed during the window, and the most likely case is that reports were only accessed by those who should have seen them and perhaps a few curious users (such as your source) who might have explored a link they hadn’t seen before and done nothing with the data. However, there is no way for us to completely rule out the contrary cases.

Sure there is. This guy either doesn’t understand the technical side of things or is BSing. You can examine the web server logs and see every individual request made, allowing you to trace back and see exactly what every client requested. According to Netcraft, ActBlue uses lighttpd, which of course has access logging capabilities. If the administrative features only appeared for logged in users then they could easily see exactly which users saw what data.

Whatever the case, they must have some awful developers if something like this happened. Either the user authentication/privilege system was disabled or a number of users were erroneously marked as administrators. Either way it’s a pretty big screw-up.

And I don’t see why CSV files would be difficult to handle. If you know how to view an Excel file then you know how to view a .csv.

The article doesn’t say anywhere that any data was stolen, only that it in this case it was viewed and screenshots were taken- just to clarify.

I don’t understand. What do you have to do to “steal” data other than viewing it?

The article doesn’t say anywhere that any data was stolen, only that it in this case it was viewed and screenshots were taken- just to clarify.

The real danger inherent in the ActBlue data being stolen is the fact that it’s direct from the source, so there would be no way to know if someone had pilfered your donor data.

Andrew Pass
http://www.pass-ed.com/Living-Textbook.html