Breached! – Nah, I Think We Should Consider Calling It Hacked – Update
2 weeks or so ago, my bank notified me that my debit card may have been part of a security breech and that a new card was on the way. It came last week and everything looked ok in my records, so I thought it was no big deal.Â
Then last night I got 2 disturbing emails.Â
Senator Norm Coleman supporter / contributor list leaked.
Your name, address and other details appear on a membership list
leaked to us from the Norm Coleman Senate campaign.If you have contributed financially to the Coleman campaign there
are additional details.We understand that Norm Coleman became aware of the leak in January.
The information has been passed around out of public view.
We have sent you this note as a curtesy in case Norm Coleman has
not contacted you previously.We have not released the material yet, but may do so within the
next few days.In line with our policy of completely neturality for whistleblowers
and political sources, the material will be treated impartially. Â We
support all those who engage in the struggle for political reform
and wish you well.For additional details, see:
http://news.google.com/news?ned=us&hl=en&q=wikileaks&scoring=n&nolr=1
I used one of my hosting tools and traced the email. It came from 88.80.13.160. I did a search for it, and guess who loves this website, The Democratic Underground. The tinfoil hat brigade seems to think publishing private, confidential, and secure documents is some sort of revolutionary patriotism.Â
Well, as someone who is involved in this one, I am a little more concerned that these people seem to be bragging about how they are going to publish private and confidential information.Â
Following our earlier email over the Coleman leak, we have discovered
that all on-line Coleman contributors had their full credit card
details released onto the Internet on 28 of Jan, 2009 by Coleman’s
staff.Senator Coleman was made aware of this yet elected not to
inform supporters in violation of Minnesota Statute 325E.61:https://www.revisor.leg.state.mn.us/statutes/?id=325E.61
We provide proof of here (Windows Excel spreadsheet), which if you
are a contributor will provide the last 4 digits of your Credit
card and the security numbers on the back. Please check:http://wikileaks.org/leak/coleman-contributions-2009.xls
Since the database has been floating around the internet, we
suggest you call your bank and cancel the card.However if you are one of our supporters and appreciate this warning
don’t forget to donate to Wikileaks (Sunshine Press) first!For additional details, see:
I forwarded this email to Cullen Sheehan and he said the authorities had been looking into it. Frankly I think the Wikileaks people are involved in something more than just whistleblowing here. It isn’t like Minnesota Republicans haven’t had Democratic operatives and officials commit cyber warfare and hack into private websites before, and I am just not willing to believe that Coleman would leak his contributor database to a left wing organization (or one with connections to the Democratic Undapants).Â
I got this email from the Coleman campaign moments ago.Â
Dear Supporter,
Last evening, we began receiving emails and phone calls from donors – and non-donors – who reported receiving messages from an email address: press-office@wikileaks.org stating that they possessed information about the individual and were threatening to post that information online.
We immediately contacted the appropriate federal law enforcement authorities and they are aggressively investigating this matter.
We take the privacy and confidentiality of our donors and supporters extremely seriously.
In January, an event occurred that made us fearful that our firewalls might have been breached. We contacted federal authorities at that time, and they reviewed logs from the server in question as well as additional firewall logs. They indicated that, after reviewing those logs, they did not find evidence that our database was downloaded by any unauthorized party.
Let me be very clear: At this point, we don’t know if last evening’s email is a political dirty trick or what the objective is of the person who sent the email.
What we do know, however, is that there is a strong likelihood that these individuals have found a way to breach private and confidential information.
But because of this uncertainty, and out of an abundance of caution, we have begun contacting our supporters to provide them with as much information as we currently have available.
Given the nature of this threat, if you have concerns about whether or not your credit card that was used to make a donation to the campaign has been compromised, we encourage you to contact your credit card company to cancel the card. If you have any questions, please contact us at the Coleman for Senate Campaign at (651) 645-0766.
All of our donors and supporters should be assured that our campaign will work with all appropriate federal and state law enforcement agencies to take all appropriate legal action to identify the individual or individuals who may be involved in this matter and to pursue all appropriate legal action against them.
My information was never at risk, once my bank was alerted, they cancelled my card. I can’t believe that the Coleman campaign would ‘leak’ their own contributor list. I have the strong suspicion that this was actually a case of cyber political warfare. Hey, Noah Kunin, a DFL official and blogger with credentials to the State Legislature, hacked into Mark Kennedy’s adman’s website and sent private information to Kennedy’s DFL opponent, now Senator Klobuchar’s campaign where staff viewed it and did polling on what their response to an ad should be.Â
I don’t think it was far fetched to think that maybe someone was digging to get the identities of Coleman supporters given the gravity of the US Senate election court trial underway in Minnesota. It isn’t like Franken’s lawyers were trying to get anyone possibly supportive of Coleman’s side thrown off the witness list.Â
Take a look at your banking records, cancel your cards if you donated to Coleman. Someone appears ready to publish your information wide and proud for some political thuggery. the timing is just way too convenient. Franken is resting his case in the trial today, I have the feeling this is to sway public opinion against Coleman.
Update:
Another email just came through from the Wikileakers. It included this line from who they claim gave them the stolen database, which Ithink explains this whole ordeal. It was a politically motivated hit job! (emphasis mine)
That said, I feel it is very important that the actual database be provided to a trusted media liaison, for several reasons:
   A) The Coleman campaign’s effort to impugn the election processes in the State of Minnesota have gone beyond mere political rigor into partisan malfeasance of the sort that has plagued this country for the past eight years, to the benefit of nobody and the great detriment of the citizens of this State;Â
It also looks to me to be from someone with intimate knowledge of Minnesota laws, IE: a political opponent or Government bureaucrat using anonymity to wage a partisan attack.Â
Doesn’t the public have the right to know who it was that is convicting Coleman of wrong doing (the email lays it out) in the public’s mind?Â
Oh and what happened to count every vote?
Sphere: Related Content




I’m happy that you posted this, but I think you’ve missed something very important, here. I, too, received both emails, but, on reviewing the list of supposedly “stolen” information, my email address was NOT on that list? So how do you suppose these “wiki’d” people got it? It is my suspicion, based on the evidence of history, that this is one more leftist dirty trick to try to discredit Norm and dry up his donations. They could do this easily by using DFL voter ID lists and, if that’s the case, there ought to be some prosecutions. In fact, if it is false, as I suspect, somebody ought to go to jail.
So does this mean that Andy has been making financial donations to a RINO???
you’re an idiot.
this wasn’t “hacked”
hell, i found the database link back in January at the same time as Adria (when she initially posted about it), i didn’t download it (didn’t care, nor did i think Norm’s IT staff would be dumb enough to put f’n DONOR data in an unsecure MySQL database in an UNSECURE publicly accessible web folder.
http://www.flickr.com/photos/adriarichards/3234833407/
Ah, debating whether the server was “hacked” or not is about as useful as a burglary investigation quibbling over the whether the door was “locked” or “unlocked.” In either case, something was still stolen, and the same with the Coleman situation. Whether someone can be lauded for doing a true “hack” doesn’t change the fact that someone stole information they did not have a right to.
This isn’t about a locked or unlocked door. This is about a guy having a garage sale and forgetting that among the magazines he was going to sell there were statements with his credit card information. Or that among the tapes he was going to sell there was the special tape he made with his wife during their honeymoon, a tape he had stored among his other tapes for easy viewing.
These things should have been inside his house, instead he, by mistake or stupidity, left these among the things he was going to sell.
Also, nothing was stolen, the campaign still has the information. Only problem is that other people has the information too. It was copied. Not stolen.
PJ, the voice of reason.
the point was, the data was accessible for MONTHS and nothing was done about it, which is more scary and illegal than what the people who copied the data did honestly.
to paint this as some “crazed liberal hacker” is to ignore the ineptitude of the Coleman campaign who allowed it to happen so easily. i hope you all feel suckered for donating to his horribly run campaign (sidebar, both candidates were terrible imo, i didn’t vote in that election)
Copying isn’t stealing? Haha, that’s a new one.
Anyways, according to the links posted by wikileaks, this is about a “locked or unlocked” door. No one is arguing that Coleman’s staff put the information on coleman.com, but that someone, somehow was able to access what should have been internal databases. These are clearly documents that these people should not have had access to, but someone clearly stole them and is now using them to intimidate the Coleman campaign and its supporters.
Is that clear?
oh PS, according to all reports, the FBI was involved in January, so clearly the argument that “nothing has been done about it for months” is also false.
Bmetzler, no it’s not clear.
This isn’t stealing. Fraud if anyone would use the credit card information. And so on. But it’s not stealing. The backup was still there.
The reason why other people had access to what should be internal databases was that for some stupid reason, you were allowed to see the directories on the site and for a lot more stupid reason the campaign decided to put a backup of the database so that it could be accessed from a browser.
What should have been done in January was to contact the people who had their information comprimised. The campaign didn’t, maybe becuase it probably wasn’t a good idea to tell your doners this when you were in need of money, who knows. I’m guessing there are both donors but also banks that are a bit unhappy about not being told about this.
But I agree, these aren’t documents people should have had access to. But the ones you should ask about why people had access to them is the Coleman campaign.
Bmetzler,
the fact that Coleman’s campaign didn’t notify his donor list until this week, that is the point that is illegal. you can’t debate that, sorry.
and it wasn’t even a case of “finding” them, they were widely accessible for anyone to view. i saw them myself, and i wasn’t even “snooping”, i only went to his site back in Jan after the supposed “overwhelming of the server” to see if it was real or fake (it was faked btw), and was shocked to find not only open wide directories, but also unsecure MySQL databases. i’m a systems administrator by trade and I was aghast at what i found.
it was the same as going to the Drudgereport.com and all the sudden it had a link to view private nude photos of you and your wife hosted on the drudgereport server. who is at fault if someone looks at those or downloads them? wait for it… wait for it… Matt Drudge.
again, PJ = 100% otm
Andy, any idea how the campaign could have missed this one? And how they failed to follow it?
325E.61 DATA WAREHOUSES; NOTICE REQUIRED FOR CERTAIN DISCLOSURES.
Are you sure that your “interpretation” of the law is correct? Are you absolutely positive that the FBI and other lawyers led the Coleman campaign to break the law? Because that is what you are inferring here…
The only person or people who did something wrong here were the people who stole the information off of the servers they had no right to and are now using that information to intimidate and harrass Coleman’s supporters.
yep. i am.
two of by best friends are lawyers, and we also deal with lawyers & the FBI ALL he time on IP security issues at my company.
and you’re wrong… you are DEAD wrong. Coleman broke the law by not notifying his donors back in January. just man up and admit that his “IT staff” are incompetent, it’s not that hard. not even discussing the “stolen” information.
look, it’s clear you do not understand data security, you’re out of your league here, sorry.
this is pointless. it’s like discussing chemistry with a 4 year old, no matter how much i type, you are not going to understand, and it’s clear.
but thanks for playing i guess.