Heritage Foundation wasn’t attacked; they leaked their own data – sources (Update2)

On September 2, Heritage Foundation spokesman Wesley Denton issued the following statement:

We experienced a malicious, unauthorized data breach of six-year-old documents on an external server that appear to contain personal information of private donors, who we are notifying. We are unable to verify the authenticity of files circulated online.

All Americans have the right to support causes without fear of harassment, and that is why we respect and work to safeguard our supporters’ privacy. The Heritage Foundation has over half-a-million members with diverse views who are united with a passion to advance conservative policies that make life better for all Americans.

Heritage is a nonpartisan research and educational institution and has a longstanding policy that we do not comment on private donor or internal staff communications.

Our internal servers were not part of this breach, and we have taken – and will continue to take – all appropriate steps to ensure that our members have the ability to support public policy organizations free from intimidation.

But their claims of a malicious breach or any attempt to intimidate are disputed by other details and evidence that subsequently came to this site’s attention. DataBreaches.net was sent a link to the torrent on Pirate Bay, which is prefaced with the following comments:

All the juiciest docs from the recent Heritage Foundation data leak.

And just so we’re clear, it wasn’t a hack. Heritage backed up an email archive to a PUBLIC Amazon server and it got downloaded. Big surprise.

They fucked up. Big time.

Enjoy

DataBreaches.net reached out to Heritage Foundation for a response to the allegations, but has received no response as yet.

In the interim, a commenter provided additional information that supports the claim above. On August 28, five days before Heritage announced the breach, Jay Fuller had tweeted:

Hey @cnn I have a story for you! Heritage Foundation leaks email archive: http://thf_media.s3.amazonaws.com/Debuhr/backup.zip

— jay fuller (@jfuller290) August 28, 2015

“Hey @cnn I have a story for you! Heritage Foundation leaks email archive: http://thf_media.s3.amazonaws.com/Debuhr/backup.zip …”

That link is now 404, as Heritage reportedly took the file down, but the subdomain (thf_media) supports the claim that this was the Heritage Foundation’s subdomain. Steve DeBuhr is an assistant director at the Heritage Foundation. Whether he was responsible for uploading the backup file to his directory or for the perms on the directory is unknown to DataBreaches.net. In any event,  however, it now seems clear that the foundation wasn’t attacked, but had exposed their own backup file.

Update: Post-publication, I received a note that there was another archive that was exposed on the Amazon server – this one an email archive from Steve DeBuhr. DataBreaches.net is in the process of obtaining it to inspect it, but even the first leaked backup contains a wealth of personal details about donors, including their names, addresses, phone numbers (including cell phone numbers), the amounts of their donations to the foundation, and personal notes about their health or family details (such as “married to <X>, who is his second wife”).

Update 2, Sept. 7: Today, another commenter pointed me to yet another file that was exposed on the same subdomain. This one, GSA Outlook Data.zip, is a 79 MB archive of files belonging to John Horton. Prior to working with Heritage Foundation, Horton was with the General Services Administration. Some of the files in this archive have government contact information – including White House personnel and cell numbers.

Of note, this file was uploaded to the Amazon subdomain in November 2009, so unless someone subsequently removed or altered perms, all the information in the files has been exposed for almost 6 years.

As a follow-up to the first update, the other archive did contain Steve DeBuhr’s emails. Some of them were of a personal nature, such as orders he placed for items, and correspondence with his child’s school. As such, none of them will be posted to DataBreaches.net.

And no, Heritage Foundation never responded to inquiries from this site.