Colorado’s confidential voter records were reachable for eleven days

On 14 August 2026 the Colorado Secretary of State’s office updated its Find My Voter Registration tool — a change meant to let pre-registered teenagers check their own status. The update switched off the limit that keeps confidential voters out of that lookup. It stayed off for eleven days, until late in the afternoon of 25 August, when an employee of the office who is a confidential voter herself found her own record showing. The office says the fix went in within an hour, that 59 confidential profiles were accessed during the window, and that most of those searches were voters looking up their own information. Secretary of State Jena Griswold apologised, and the office has said it is adding safeguards including automated quality-assurance checks. The story ran wide in the last days of August, helped along by an election season — but the part that matters to the people in the programme has nothing to do with the politics.

Headlines carried 133,000 and the follow-ups carried 59, and they are not competing claims. The first is roughly how many active confidential voters Colorado has — the group whose records the tool could have returned while the limit was off. The second is how many profiles the department says were actually opened in those eleven days. One describes the size of the opening, the other describes traffic through it. If you are a confidential voter, the first number includes you by definition; the second is the one worth asking your county clerk about, because the office says it tried to reach every voter whose profile was accessed.

This is the detail that makes the incident make sense. Colorado’s confidential status works partly by exclusion: confidential voters give up the online self-service tools — ballot tracking, the public lookup — specifically so no public-facing screen ever has a reason to draw their record. The block that enforces that was what the August update removed. So this was not a break-in and nothing was stolen from a database; a record that was never meant to be rendered started rendering, to anybody who typed the right name. For the people this status protects, that distinction changes very little. The harm model was never a hacker — it was one person, who already knows your name, finding out where you live.

Confidential voter status withholds your voter information from the public side of the file. That is real and worth having, and in Colorado the request goes to your county clerk and recorder; counties have been moving the form online since January 2026, so check your county’s elections page rather than an older description of the process. Survivors of domestic violence, sexual offences or stalking can go further with the state’s Address Confidentiality Program, which supplies a substitute address to use with agencies generally and withholds voter information as well. What neither one does is reach backwards. Colorado sells voter data to any member of the public who asks; every copy already made stays made, and the state has no lever to pull it back.

Voter-record sites exist because voter files are purchasable in most states, and they are only one input. People-search profiles assemble an address from property records, court filings, utility and marketing data and old registrations, then republish it in a page that ranks for your own name. That is why becoming a confidential voter and then finding your address on the first page of results is such a common and demoralising sequence: the two systems have nothing to do with each other. Removing the published copies is a separate job, done site by site — our opt-out guide for VoterRecords covers the voter-file republishers, and the guide to removing your home address covers the wider set.

No email addresses or passwords were published here, so this incident will never appear in the known breach databases that checking tools search — ours included, and anyone claiming otherwise is guessing. The check that does return something useful is the everyday one: which breaches your email address has genuinely turned up in, and what a stranger can pull up about you by name today. The first is our free breach check; the second is the exposure scan, and for someone in a confidentiality programme it is the more revealing of the two.

Four things, in order of how much they change. Ask your county clerk and recorder whether your profile was among the 59 accessed, and while you are there confirm your confidential flag is set the way you think it is. Search your own name on the big people-search sites and note where your current address appears — that is the exposure the voter file was never the biggest part of. File removals for what you find, starting with the voter-record republishers. And if you are in the Address Confidentiality Program, use the substitute address consistently, including with the utility, the pharmacy and the delivery apps, because a single form filled in with the real one puts it back into circulation. The general version of the post-incident routine is in our post-breach guide, and your state-level rights are summarised on our Colorado privacy rights page.

A confidentiality programme is a promise that one particular organisation will not publish your address. It is narrow by design, it depends on software behaving, and August showed what happens when the software does not. The broader exposure — the copies sitting on commercial sites, rebuilt from public records whether or not you ever registered to vote — is not something any state office can fix for you, and it is the part that is still there after the story stops running. It is also the part you can act on without asking anyone’s permission.