Mexican voter database exposure (Mexico, 2016)

In April 2016, security researcher Chris Vickery discovered that the entire Mexican national voter registry — 93.4 million records — had been sitting on a publicly accessible, password-free MongoDB database hosted on Amazon AWS for months. It was, at the time, one of the largest exposures of government-held citizen data anywhere in the world.

What happened

The 132 GB database was configured for public access with no authentication of any kind — anyone who knew the IP address could connect and read the full contents. Vickery located it using the Shodan search engine, which indexes internet-connected systems, by scanning for MongoDB's default port 27017. Records had reportedly been exposed since September 2015.

Each record corresponded to a registered Mexican voter and included the full name, home address, date of birth, and national identification (credencial / CURP-linked) numbers — precisely the data used for in-person voter identification. Mexico's electoral authority, the Instituto Nacional Electoral (INE), later confirmed the records were authentic.

Impact

• 93.4 million voter records — effectively the entire adult electorate — were exposed.
• The data included home addresses, a particularly sensitive detail in a country with serious concerns about kidnapping, extortion and cartel violence.
• Under Mexican law, voter-roll data is strictly confidential, and its unauthorised extraction can carry penalties of up to 12 years in prison, making the exposure a potential criminal matter, not merely a privacy lapse.

Why it matters

The case is a defining example of cloud-misconfiguration risk applied to a national-scale government dataset. No firewall was breached and no malware was used — the entire electorate's personal data was exposed by a single insecure default. It intensified scrutiny of how third parties and political actors obtain copies of the voter roll, of weak controls on government data shared with vendors, and of the broader wave of open-MongoDB exposures that defined the mid-2010s, prompting database vendors to ship secure-by-default configurations.