1.5 Million Chicago Voters' Records Exposed via Mayoral Candidate's Website

More than 1.5 million Chicago residents found their home addresses, birth years, and voting histories publicly accessible on the website of mayoral candidate George Cardenas last month. The data, which appeared to cover every registered voter in the city, was left exposed due to security vulnerabilities on the campaign's online platform.

An analysis by the Better Government Association's Illinois Answers Project identified the breach. The website offered a password-protected dashboard for campaign staff to look up voters by age, history, and sex. However, the login password, "GoTeam," remained visible in the website's public source code. Additionally, the complete dataset was available for download through a public file index, a directory listing that revealed files stored on the server without the usual backend storage protections.

The exposed records included the personal information of high-profile figures such as Gov. JB Pritzker, Cook County Board President Toni Preckwinkle, and Mayor Brandon Johnson. All three had voted in the four most recent elections and selected Democratic primary ballots, according to the data. The dataset also contained the addresses and voting histories of judges, whose personal information is protected under a specific state privacy law.

Illinois Answers Project contacted the Cardenas campaign about the issue in late September. The login page was removed by Sept. 3, the morning after Cardenas and his political director, Sabrina White, were notified. The voter data was taken down a few days later. It remains unclear how long the information was publicly accessible or if anyone accessed the files before the fix.

Cardenas, a Cook County Board of Review commissioner and former 12th Ward alderman, attributed the error to a programming glitch. "It’s got to be a programming glitch," Cardenas said when informed of the risk. "The website is proprietary, and we’ve been working on it with developers, programmers. I’ve been heavily involved in that." Neither Cardenas nor White responded to later requests for comment.

Bill Budington, a senior staff technologist at the Electronic Frontier Foundation, described the situation as a "complete lapse in essential data security practices." Three Chicago-area cybersecurity professors agreed with this assessment. Budington noted that while many states publish voter addresses, Illinois has stricter laws protecting that data, making the exposure more problematic.

The campaign website shows strong indicators of artificial intelligence generation. The Pangram detection tool flagged the text on the homepage and platform page as 100% AI-generated. Two images on the homepage carried digital watermarks from OpenAI, the maker of ChatGPT. A previously available file contained instructions for the site's developer, generated by a coding tool, which Pangram also flagged as AI-generated.

Cardenas denied using AI tools to build the site. "The website is HTML code, it’s not written by ChatGPT," he said on Sept. 2. "It’s HTML code and other programming languages, no AI tool was going to be able to do that." However, experts note that AI tools are commonly used for web development and require careful review to avoid security issues.

Illinois law tightened rules on voter data usage in 2024 after a lawsuit against Local Government Information Services. That company was sued by the state attorney general for publishing names, addresses, and voting records. The case was settled last year, requiring the company to destroy specific voter data. Political committees must sign forms agreeing to use voter rolls only for bona fide political purposes, but no specific penalty exists for wide publication of the data.