Beaufort County notifies 3K poll workers of data breach. SLED says it discovered the hack
One week after Beaufort County election officials learned of a breach in a voting software company’s servers that exposed the personal information of at least two poll workers, the county’s elections board on Thursday told its roughly 3,000 current and former poll workers it’s still unclear how many people were affected.
Some Beaufort County officials have questioned the election board’s responsiveness in the wake of the breach, saying the board should have been more forthcoming with information.
The election board, in the email, said EasyVote Solutions, the Georgia-based company that experienced the data breach, is working with a credit monitoring service to assist any person whose data was affected.
The letter said those affected by the breach would be contacted. It did not say by whom, or when.
“To date we know that two (2) poll worker records from Beaufort County were accessed,” the email said. “Unfortunately, until the investigation is completed, we do not yet know to what extent this breach has affected other poll workers in our County.”
The board’s email, which was sent a day after The Island Packet and Beaufort Gazette reported on the breach, apologized for the “unfortunate incident” and assured poll workers that the breach did not compromise South Carolina’s or Beaufort County’s election integrity.
The board discussed the breach in executive session on Tuesday, but did not release any public information about it until after the newspaper’s report.
“I should not learn about these things in the paper,” Beaufort County Council member Chris Hervochon said. “It raises questions, whether or not council has exercised an appropriate amount of oversight over the elections board. Are we communicating things to the public efficiently and are we being proactive enough? In this case, the answer is ‘no.’”
Beaufort County Chair Joe Passiment, reached by phone, emphasized that the elections board — which is overseen by the Beaufort County Legislative Delegation — is separate from Beaufort County.
“We (Beaufort County Council) have no idea how the breach happened, when it happened, we were in the dark when it happened,” he said. “[The elections board is] a separate entity. We have to have a hands off on them.
We would hope that, from here, they will devise a means and method of communicating with the community at large to ensure that they’re aware of the situation and they’ve made corrections.”
County Council member York Glover, reached by phone, said the board should evaluate how it will respond to similar breaches in the future.
“We’re getting ready to go into the primaries, it’s right before us, and I can’t tell you what’s going to happen, but we have to ensure the people, the citizens of Beaufort County, that ... it’s a fair and good election,” he said. “That’s going to be a hard thing if we have that kind of crisis.”
Separately on Friday, the S.C. Law Enforcement Division, which is investigating the data breach along with the Federal Bureau of Investigation, said in a statement that its cybersecurity program discovered a discussion about the hack on a web forum Jan. 31.
“The discussion was regarding hackers gaining access to data by EasyVote Solutions,” said SLED spokesperson Ryan Alphin.
Beaufort County, along with five other counties, contracted with EasyVote Solutions for election management software, Alphin said.
Unlike the other counties, however, Beaufort County used the software to upload hiring documents which included poll workers’ personally identifiable information like Social Security cards and driver’s licenses, a spokesperson for the state elections commission previously told The Island Packet.
SLED notified the state election commission, the FBI and the state Division of Information Security the same day it discovered the discussion about the hack, Alphin said.
EasyVote’s software is not connected to the state’s voter registration system, its voting system or its electronic pollbook system, the company’s CFO previously said. The company does not generate or record ballots and is not used to determine election results.
Alphin, in his statement, said no additional information about the data breach was available.
The elections board, in the letter to poll workers, said it would release more information “as soon as it becomes available.”
This story was originally published February 11, 2022 at 4:04 PM.
