The Unsexy Threat to Election Security
Summary: A San Mateo County civil grand jury report released this week found that the county's election office, ACRE, does not protect its Twitter, Facebook, Instagram and YouTube accounts with two-factor authentication, even though it added text-message 2FA to employee email after a 2016 spear-phishing breach. The report cites a 2010 hijack of ACRE's election results web page and warns that stolen social media or email accounts could spread false results or phony voting instructions to the roughly 43,000 voters subscribed to county election information.
Key Takeaway: The county's own report says its protections are inadequate against current threats, and the recommended fix - FIDO hardware keys instead of text-message codes that can be intercepted through SIM-swapping - is a concrete gap a security leader can check against their own election-facing accounts today.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026