Garcia, Marin, Romero Roses, Diaz and Barreiro denied any involvement with the phantom-requests scheme.

So did Renier Diaz de la Portilla and a key consultant for his brother Alex, who declined to comment.

Naredo-Acosta, who did not visibly campaign, could not be reached. And Sternad, who pleaded not guilty Friday to charges that he lied on his federal campaign reports, declined to comment through his attorney, Rick Yabor.

There are links among some of the candidates who ran in different districts.

Sternad hired as his campaign manager Ana Sol Alliegro — an old flame of Alex Diaz de la Portilla who supported him in his race last year, according to rival Barreiro. Renier Diaz de la Portilla hired his brother to run his campaign, and both shared several political consultants.

But the family had nothing to do with phantom requests, Renier Diaz de la Portilla said.

“Absolutely not,” he said.

He was echoed by Elnatan Rudolph, head of the New Jersey-based Cornerstone Management Partners, a key political consultant for both Diaz de la Portillas.

“It doesn’t make any sense to me why someone would do that, because you’d still need the person to [vote for you],” he said.

Had the requests been filled, short of stealing the ballots from mailboxes, the campaigns would have been able to flood the targeted voters with phone calls, fliers and home visits to try to sway their vote.

Persuade enough of them, and you might flip the race.

The hacker adjusts

When the phantom requests were initially flagged, elections staff telephoned a dozen of the targeted voters to check whether they had really asked for absentee ballots. They hadn’t, said Rosy Pastrana, the deputy elections supervisor for voter services.

Lynn Sargent, 23, said she received an email July 8 confirming her absentee-ballot request — even though she had never submitted one.

“I was definitely concerned when I got it,” said Sargent, a Miami-Dade native who had recently moved to Connecticut. But the ballot never arrived, and she voted in her new state.

Once the department knew the requests were phony, it blocked the 15 IP addresses from which they originated. It took several tries — the hacker simply switched to a different address — before the requests stopped.

“Every time we saw that pattern, we would block the IP,” said Bob Vinock, an assistant deputy elections supervisor for information systems. “I guess they finally gave up.”

Then came the hardest part: trying to figure out who did it.

Pastrana, the deputy elections supervisor, sent a letter outlining the local findings and a list of 12 foreign IP addresses to the state attorney’s office on Aug. 8, records show.

On Aug. 21, Thomas Haggerty, a prosecutor in the cyber crimes unit, noted that the IP addresses were foreign, registered in India and the United Kingdom.

“The person requesting these ballots is obviously using a software/service/proxy servers to mask their true IP address,” Haggerty wrote in an email to Johnette Hardiman, the prosecutor leading the review. “These are probably a dead end.”

In December, as the state attorney’s office prepared its grand-jury report on absentee ballots, prosecutor Tim VanderGiesen, who was not involved with the August inquiry, got back in touch with elections. It wasn’t until then — four months later — that elections IT staffers realized Pastrana had never sent the state attorney’s office three additional IP addresses, corresponding with the very first phantom requests from early July.