Colorado's public-facing election results website briefly went dark Tuesday night after a bot attack hit the vendor behind the page, just as results were beginning to post. The Colorado Secretary of State's Office says the disruption never touched the actual vote count or ballot returns, but it did leave the public locked out of the results page for a stretch of election night.
The attack targeted the vendor that runs the Secretary of State's public-facing election webpage, according to The Denver Post, which first reported the outage. Jack Todd, a spokesman for the Secretary of State's Office, said access to the site became limited shortly after 7 p.m. Tuesday, right as results started posting. “There is no impact whatsoever to ballot returns or results,” Todd said, according to the same report.
By 7:45 p.m., Todd said the issue appeared to be resolved. The website began requiring visitors to complete a CAPTCHA verification to get through, a fix meant to filter out automated bot traffic while letting real voters and reporters check results. Todd said the Secretary of State's Office was continuing to work with its vendor to fully resolve the problem even after public access was restored.
What Was — and Wasn't — Affected
Todd was clear that the attack hit only the public results page, not the back-end systems counties use to report ballots. That distinction matters: the bot traffic could slow down or block the webpage people use to watch results come in, but it had no bearing on how votes were actually tabulated or transmitted. Todd also said it remained unclear who was behind the attack.
The Colorado incident wasn't isolated. Todd said other states using the same vendor also appeared to have been affected, and that other vendor reporting platforms may have been targeted as well, though he did not identify which ones.
Michigan Counties Hit by Similar Bot Traffic
Hours earlier the same night, several Michigan counties experienced their own election-results website problems tied to bot traffic, a county clerk told MLive. Ottawa, Macomb, Genesee and Oakland counties were among those named as affected, per that report. The outlet noted the issue was strictly with the websites displaying results, not with the results themselves.
The third-party vendor behind those Michigan sites, Clarity Elections, said it was aware of the problem and working on a fix, according to MLive. The company said it had added a security measure that can prompt a CAPTCHA check when it detects unusually high traffic from a single IP address — a response that echoes the fix Colorado's site adopted the same night. It is not established whether Clarity Elections is the same vendor used by Colorado's Secretary of State's Office.
A Rocky Week for Election-Adjacent Systems
The Colorado outage also follows a separate incident just a week earlier involving a different piece of the nation's election infrastructure. The Federal Election Commission's website was targeted by hackers on Oct. 27, disrupting the agency's electronic filing system, according to the Denver Gazette. That outage kept organizations from filing 24-hour and 48-hour campaign spending reports while agency IT staff worked to restore service, the paper reported. The Gazette noted the FEC does not administer U.S. elections, so the outage had no bearing on voters' ability to cast ballots.
The federal Cybersecurity and Infrastructure Security Agency has previously warned that denial-of-service attacks on infrastructure supporting election operations can hinder public access to election information without compromising the security or integrity of election processes themselves, according to CISA. The agency has also published guidance meant to help election officials plan for and coordinate with service providers during such incidents, per a separate CISA resource.
Colorado's election systems have faced scrutiny before this year. In a separate incident reported by the Associated Press, voting-system passwords were accidentally posted online, though officials said at the time that the election remained secure. That episode is distinct from Tuesday's bot attack, but it underscores the steady drumbeat of cybersecurity questions trailing Colorado's election infrastructure this cycle.
For now, the public results website is back up and running behind its new CAPTCHA wall, and officials maintain the vote count itself was never in jeopardy. Who launched the bot attack, and how widely it spread beyond Colorado, remains unclear.
