By Townhall News Editorial Board
A mayoral candidate who aspires to manage the City of Chicago’s massive data infrastructure first proved unable to protect the personal information of 1.5 million voters on his own campaign website. That failure deserves more than a shrug and a quiet takedown. It demands a serious conversation about data stewardship, competence and the obligations of those who seek public trust.
The Better Government Association’s Illinois Answers Project reported on Monday that a website associated with mayoral candidate George Cardenas, a Cook County Board of Review commissioner and former Southwest Side alderperson, left the voting histories, home addresses and birth years of what appears to be every registered voter in Chicago available for anyone to download. The exposed records included data belonging to Gov. JB Pritzker, Cook County Board President Toni Preckwinkle, Mayor Brandon Johnson and judges whose personal information is protected under Illinois state privacy law, the Illinois Answers Project reported.
The scale of the exposure is staggering, but the mechanics are almost worse. According to the Illinois Answers Project’s analysis, the campaign website lacked basic backend storage protections. The complete voter-roll dataset sat in the site’s publicly available file directory. Anyone who typed the correct URL could access it. A login page contained an exposed password. Large portions of the website itself appeared to have been generated by artificial intelligence, the investigation found. This was not a sophisticated cyberattack. It was elementary negligence.
To his limited credit, the login page with the exposed password was taken down by Sept. 3, the morning after Cardenas and his political director, Sabrina White, were notified of the vulnerability, the Illinois Answers Project reported. The voter data, including home addresses, was removed a few days later. But neither Cardenas nor White responded to subsequent requests for comment from the outlet. Silence is not accountability. A candidate asking voters to entrust him with city government owes them an explanation, not a disappearing act.
This episode illuminates a gap in how campaigns handle sensitive civic data. Voter files are public records available through the Chicago Board of Elections, and campaigns routinely obtain them for outreach purposes. That availability, however, does not relieve campaigns of the responsibility to safeguard what they acquire. Home addresses of domestic violence survivors, law enforcement officers and judges carry real safety implications when broadcast to the open internet. The fact that the data is technically public does not make its careless exposure harmless.
Chicago’s municipal government maintains enormous databases containing residents’ personal, financial and health information. The city’s 311 system, utility billing records, building permits, police records and public health data all require competent digital stewardship. A candidate who cannot manage the security of a single campaign website raises a legitimate question: What happens when that same judgment governs systems with far greater sensitivity and scope? This is not a partisan argument. It is a competence argument, and voters across the political spectrum should weigh it.
Some may counter that voter file data is already semi-public and that the real blame belongs to a system that makes such records broadly available. That point has merit. Illinois and other states should revisit how much personal detail accompanies publicly available voter rolls, particularly home addresses. Reasonable people can debate tightening those rules. But that debate does not excuse a campaign from protecting the data it already holds. Public availability is not an invitation to recklessness.
As the 2027 municipal election cycle accelerates, with candidate-filing procedures already underway at the Chicago Board of Elections, voters deserve candidates who demonstrate basic operational competence before asking for the keys to City Hall. Data privacy is not a secondary concern in modern governance. It is foundational. Cardenas owes Chicago’s 1.5 million affected voters a full public accounting of what happened, how long the data was exposed and what steps his campaign has taken to prevent a recurrence. Anything less suggests a candidate unprepared for the serious responsibilities of the office he seeks.
Sources: Illinois Answers Project, Oct. 27, 2026 — https://illinoisanswers.org/2026/10/27/mayoral-candidates-website-exposed-voting-history-of-1-5-million-chicago-residents/ | Chicago Board of Elections (2027 municipal election filing context), Oct. 26, 2026 — https://chicagoelections.gov/news
