I own a few services that rely on voterfile data we acquire from many sources and I am aware of quite a few others (so I feel like I need to chime in here haha). I suppose sources aren't going to disclose the actual resource or IP address until law enforcement tracks them down? I haven't been able to find any reports of anything specific.
It may not be Nation Builder per se but it could be one of their many integration points maintained by third parties: