A website built for George Cardenas's Chicago mayoral campaign left the home addresses, birth years and voting histories of more than 1.5 million Chicago voters publicly available for anyone to find, according to findings reported this week. The exposed dataset reportedly included residential information for state court judges who are supposed to receive strict privacy protections, and it sat accessible through security vulnerabilities on the campaign's own site last month.
The breach came to light through reporting detailed in Capitol Fax, which said the complete dataset could be downloaded straight from the website's publicly available file index. The site, the outlet reported, simply was not built with any backend storage protecting the sensitive files, meaning anyone who entered the correct URL could pull the records. Cardenas, a Cook County Board of Review commissioner and longtime former 12th Ward alderman, entered the mayoral race in June, per Block Club Chicago.
Separate reporting from Chicago Korea Times confirmed that the exposed records included residents' names, addresses and voting histories, as well as the home addresses of state court judges, a category of information typically held under strict legal protection. That outlet reported the disclosure has fueled broader calls among political and election-administration experts to re-examine the security of election systems and the integrity procedures surrounding them, including calls for stronger photo identification and citizenship-verification steps at the polls.
Login Page And Data Came Down Within Days
The website's exposed login page, which had an accompanying password visible in the source code, was taken down by Sept. 3, according to the Capitol Fax account, after Cardenas and campaign political director Sabrina White were notified of the vulnerability. The voter data itself, including home addresses, followed a few days later. Still, it remains unclear for how long the data was publicly available or whether anyone actually accessed it while it sat exposed, the same reporting noted.
Large portions of the campaign website itself appear to have been generated by artificial intelligence, Capitol Fax reported, though the outlet did not establish who built it or how. Neither Cardenas nor White responded to later requests for comment, according to that reporting.
A Pattern Illinois Has Seen Before
This is not the first time Illinois voter information has turned up somewhere it should not have been. Illinois Attorney General Kwame Raoul previously sued a publishing company, Local Government Information Services, after it published names, addresses, voting records and birth dates for people around the state, alleging the publication put voters at risk of identity theft, according to WBEZ Chicago. That case settled through a court-approved agreement in 2025 requiring the company to destroy data containing voters' street numbers and birth dates, though the company did not admit wrongdoing as part of the deal, WBEZ reported.
Illinois voter data carries more restrictions than in many other states, and the state's election board says the information is available only to registered political committees for bona fide political purposes, according to the Illinois State Board of Elections. Political committees seeking that data must sign a form agreeing to the same restriction, per a state election form reviewed by the board.
What Remains Unknown
Key questions about the exposure remain unresolved. It is not established how long the files sat accessible, whether anyone downloaded them, or what specific statute, if any, the campaign may have run afoul of in how the data was obtained or displayed. Those gaps have not stopped the episode from becoming a flashpoint in a mayoral race already crowded with questions about technology, money and transparency, as the data breach adds a new layer of scrutiny to a campaign that has also faced questions about its use of artificial intelligence in building the site that exposed the records in the first place.
