A report published Monday in The Intercept raises more questions about the extent of Russian hacking of the 2016 U.S. elections and specifically details the alleged hacking of a voting software supplier headquartered in Tallahassee.
The details of the cyber attack by the Russian military are part of a National Security Agency memo dated May 5 that was obtained by the Intercept.
According to the report, the Russian plan was to trick local government officials into opening Microsoft Word documents that contained hidden malware that could give hackers complete control of infected computers.
To deceive local officials, the hackers needed a disguise to provide them authenticity. In late August of last year they sent emails intended to look like they came from Google to workers at an unnamed election software company.
The NSA memo doesn’t specifically mention the election software company, but it was later determined to be VR Systems. The firm is based in Tallahassee and provides election software to eight states
The Interceptor says the NSA found “potential victims” at the company and that at least one of the employee accounts was likely compromised.
In a statement released by VR Systems Tuesday afternoon, the company says it took action after it first received reports of fraudulent email.
“When a customer alerted us to an obviously fraudulent email purporting to come from VR Systems, we immediately notified all our customers and advised them not to click on the attachment,” the statement said. “We are only aware of a handful of our customers who actually received the fraudulent email and of those, we have no indication that any of them clicked on the attachment or were compromised as a result.”
VR System’s statement goes on to say:
“Phishing and spear-phishing are not uncommon in our society. We regularly participate in cyber alliances with state officials and members of the law enforcement community in an effort to address these types of threats. We have policies and procedures in effect to protect our customers and our company.”
A spokeswoman for the Florida Secretary of State, which oversees the state’s election office, acknowledges the state was contacted by federal authorities shortly after the alleged hacking incident occurred.
“It was an informational call and the FBI alerted officials for the need to maintain security measures,” said Sarah Revell, the agency’s communications director. “They did not provide any information specific to VR Systems.”
“Florida’s online elections databases and voting systems remained secure in 2016. We have multiple safeguards in place to protect against elections fraud and prevent any possible hacking attempts from being successful,” Revell added.
Two months after the initial attack, the hackers had obtained enough information to create a Gmail account that appeared to belong to a VR Systems employee. More than 120 spear-phishing emails were sent from that account.
In its memo, the NSA says it’s uncertain about the results of the attack and whether the hackers achieved their desired goals.