Noncitizens on State Voter Rolls

DHS claims that a review of public voter files from states not using its immigration-status verification system (SAVE) found over 250,000 non-citizens illegally registered to vote in California, Pennsylvania, New Jersey and Nevada, and says those states' election officials have been notified. The fact sheet reports the investigation is expanding and that DHS will support the Justice Department's review of voter files under the National Voter Registration Act of 1993 and the Help America Vote Act of 2002. As of June 22, 2026, it says 25 states had run more than 68 million registration records through the enhanced SAVE system (10 processing full voter lists), identifying over 400,000 deceased registrants and over 28,000 non-citizens; a table of ten "proactive" states is led by Texas (111,573 deceased; 2,296 non-citizens) and Georgia (2,549 non-citizens). It notes SAVE enhancements were suspended pending appeal, blaming "activist Judge Sparkle Sooknanan," and attributes the problem to Biden-era "open border policies," contrasting "alien-first" with "American-first" states.

• DHS claims over 250,000 non-citizens are illegally registered to vote in just four states — California, Pennsylvania, New Jersey and Nevada — based on review of public voter files from states that have not used the SAVE system.
• State election officials in California, Pennsylvania, New Jersey and Nevada have been notified; DHS says the investigation is expanding to multiple additional states.
• DHS states it will support the Department of Justice's review of voter files obtained under the National Voter Registration Act of 1993 and the Help America Vote Act of 2002.
• As of June 22, 2026, 25 different states had processed more than 68 million registration records through the SAVE system; 10 states processed their full voter lists.
• DHS says SAVE processing enabled states to identify over 400,000 deceased registrants and over 28,000 non-citizens who illegally registered to vote.
• A 'Proactive SAVE User States' table lists deceased/non-citizen counts: Georgia 42,776/2,549; Ohio 59,774/769; Tennessee 37,850/1,009; Texas 111,573/2,296; North Carolina 34,622/1,599; Idaho 4,328/49; Alabama 33,165/465; Missouri 10,660/1,112; Louisiana 15,231/419; Kansas 10,197/449.
• The document states that other states signed Memoranda of Agreement with USCIS to use SAVE, but that many SAVE enhancements 'have been suspended pending appeal' due to the actions of 'the activist Judge Sparkle Sooknanan.'
• The closing 'UNAMBIGUOUS CONTRAST' section attributes the situation to 'open border policies of the Biden administration' and asserts states with 'alien-first policies' have disproportionate numbers of non-citizens on voter rolls.
• The document characterizes non-citizen registration as a 'serious threat to national security' and warns US citizens 'are at risk of having their votes diluted by ineligible alien voters.'

The report tells state and local election officials that recently declassified records revealed China breached multiple state voter registration systems before the 2020 election, that hackers have attempted breaches in all 50 states with confirmed successes in at least 20, and that experts have routinely minimized these breaches. It catalogs incidents from 2016-2023: Russian actors accessing county voter files and stealing about 500,000 voter records, a Riverside County, California party-affiliation alteration scheme, Russian hacking of a voter-verification software vendor, a January 2017 federal assessment that at least seven states' networks were compromised, Kennesaw State University exposing nearly 7 million Georgia voter records, Iranian actors obtaining voter data in at least one of 12 targeted states, and a New Hampshire vendor's replacement database software configured to connect to Russian servers. The report warns stolen data could be used to request absentee ballots at scale or quietly alter or delete registrations, cites non-election breaches affecting 143 million (2017), 2.9 billion records (2024), and 22.65 million people (2025), and prescribes safeguards including offline backups, multifactor authentication, network segmentation, 15-day patching of critical vulnerabilities, and collaboration with DHS.

• The report states that recently declassified records revealed China breached multiple state voter registration systems prior to the 2020 election.
• Hackers have attempted to breach voter registration systems in all 50 states, with confirmed successes in at least 20 states, while experts have routinely minimized the significance of these breaches.
• In June 2016, Russian government cyber actors exploited SQL database vulnerabilities and, in at least two instances, accessed voter registration files from a US county website, per FBI reporting.
• In July 2016, the Riverside County, California District Attorney revealed a bad actor used the state's voter registration website and voters' personal data to change the party affiliation of a large number of registered voters without consent.
• In July 2016, Russian actors hacked a state board of elections website and stole information on approximately 500,000 voters, including names, addresses, partial Social Security numbers, dates of birth, and driver's license numbers; in August 2016 they hacked a U.S. vendor supplying voter-registration verification software.
• DHS and FBI confirmed Russian actors probed voter registration databases in all 50 states in 2016; in January 2017 White House officials reported the federal assessment that networks in at least seven states were compromised.
• In March 2017, Kennesaw State University, which supported Georgia's voter registration database, was found to have exposed nearly 7 million voter records, including driver's license and Social Security numbers, possibly for as long as seven months.
• In September 2020, CISA and FBI reported members of the Iranian Republic Guard Corp obtained voter registration data in at least one state and targeted 11 others where success could not be determined.
• In 2023, New Hampshire officials discovered a vendor replacing the state's voter registration database had offshored part of the project; the software was configured to connect to servers in Russia and a programmer had hard-coded the Ukrainian national anthem into the database, corrected before deployment.
• The report warns stolen VRDB data does not go stale: breach data from 2021 could be used to request absentee ballots in 2028, or to alter or delete registrations at scale in ways that might go unnoticed if carefully distributed.
• Recommended mitigations include offline database backups, multifactor authentication, DMARC, network segmentation, endpoint detection, .gov domains, Malicious Domain Blocking and Reporting, remediating critical vulnerabilities within 15 calendar days, and backups recoverable to at least 30 days prior.
• Non-election breaches cited as election-relevant: a July 2017 credit reporting firm breach affecting a potential 143 million U.S. citizens; a February 10, 2020 DOJ indictment of four Chinese PLA members; an April 2024 background check firm breach of 2.9 billion records covering 170 million individuals offered on the Dark Web for $3.5 million; and a June 2025 insurance provider breach affecting 22.65 million individuals.