The app uploads and matches the user’s contacts with voter data supplied from TargetSmart, a political marketing firm that claims to have files on more than 191 million Americans.

By intercepting the data that flows in and out of the device, he saw far more detailed and private information, including the voter’s home address, date of birth, gender, ethnicity and political party affiliation, such as Republican or Democrat.

“We were made aware about how our third-party app developer was providing additional fields of information from commercially available data that was not needed,” Matt Hill, a spokesperson for the Biden campaign, told TechCrunch.

It’s not uncommon for political campaigns to trade and share large amounts of voter information, called voter files, which includes basic information like a voter’s name, often their home address and contact information and which political parties they are registered with.

Though a lot of this data can be publicly available, political firms also try to enrich their databases with additional data from other sources to help political campaigns identify and target key swing voters.

Reuters reported that one of those firms, Washington, DC-based SKDKnickerbocker, a political consultant to the Biden campaign, was targeted by Russian intelligence but that there was “no breach.”