Washington’s Secretary of State says a cyberattack struck his agency’s website, briefly leaving some pages unavailable after a rise in automated traffic...
Washington Elections Website Cyberattack: What Was Hit—and What Was Not
Washington’s Secretary of State says a cyberattack struck his agency’s website, briefly leaving some pages unavailable after a rise in automated traffic; Secretary Steve Hobbs said county vote-tabulation machines were not affected because they are not connected to the internet. The traffic’s link to the attack remains unconfirmed.
Key Takeaways
- Some Washington Secretary of State website pages were temporarily unavailable and have since been restored.
- Steve Hobbs described the incident as a cyberattack; a spokesperson separately said bots drove increased traffic but could not confirm whether that traffic was connected to the attack.
- Hobbs said county vote-tabulation machines are not internet-connected and were not affected.
- The incident remains under investigation. The attacker, method, duration, and any access to data have not been reported.
The distinction between a disruption to a public website and interference with vote counting is central here. Officials have reported a website problem, not a change to ballots or tabulation results; that distinction matters, though it does not make a public-facing outage trivial. Voters still need reliable access to election information, and public agencies need to explain what happened without claiming more than the evidence supports.
Frankly, the public account leaves important technical questions unanswered. It does, however, draw a clear line around the one operational point Hobbs addressed: the county machines used to tabulate votes were not affected, according to the secretary. The state says the pages have been restored, while investigators continue to examine the incident.
What Is the Washington Elections Website Cyberattack?
The reported incident is a cyberattack affecting the Washington Secretary of State’s website, according to Secretary Steve Hobbs during a Tuesday-night interview on KOMO News. An agency spokesperson said the site had experienced increased traffic over the preceding days, and that some pages became temporarily unavailable. Those pages have since been restored. The spokesperson attributed the higher traffic to bots but said she did not know whether it was connected to the cyberattack.
That account describes two related possibilities, not a proven technical explanation. A public website can become difficult to reach when it receives an unusually large volume of requests, including automated requests from bots. Such traffic can resemble, or form part of, a denial-of-service incident. But the spokesperson did not confirm that this was the mechanism behind the disruption, and the reported facts do not establish that the bot traffic and the cyberattack were the same event. Calling the incident a confirmed denial-of-service attack would go beyond what officials have said.
The word cyberattack is also broad. It does not, by itself, tell the public whether attackers tried to make a website unavailable, access information, alter content, or test agency systems. No technical description of the attack has been reported, and no attacker or country has been identified. Hobbs referred generally to nation and state actors and other bad actors who might try to disrupt an election; he did not publicly attribute this incident to a particular group.
I read that gap as a reason for care, not speculation. Officials have confirmed a disruption and an investigation, but they have not published findings about its cause or scope. For basic election information and state processes, Washington’s official elections site is the state’s public reference point. Federal guidance from CISA and the U.S. Election Assistance Commission gives broader context for election security, but it does not reveal the technical details of this specific incident.
The practical meaning, for now, is narrower than the most alarming interpretations online. The reported effect was temporary unavailability of some website pages, followed by restoration. The incident is under investigation. Any claim about stolen voter information, altered election records, or compromised vote totals would need evidence that has not been reported.
Core Details and Context
The public account contains a few concrete facts. It also contains clear limits. Keeping those two things separate is the simplest way to avoid turning an outage into a claim about the integrity of an election.
- The affected service was the Secretary of State’s website. The spokesperson said some pages were temporarily unavailable. The report does not identify every affected page, specify how long each page was down, or describe whether visitors could reach other parts of the site.
- The pages were restored. That is a useful service update, but restoration alone does not explain how the outage happened or whether investigators found other effects. Those findings have not been reported.
- Traffic increased over several days. The spokesperson said bots caused the higher traffic. She did not know whether this traffic was connected to the cyberattack. That qualification is not a footnote; it is a key part of the account.
- Hobbs said county tabulation machines were not affected. He said the machines counties use to count votes are not connected to the internet. The report does not provide an independent technical review or details about each county’s equipment, so the careful attribution is to Hobbs and his statement.
- An investigation is underway. No findings, timeline for a public report, or details about the investigators have been announced in the account provided.
Why does a website disruption matter if vote-counting machines were unaffected? Because elections involve more than the final count. Government websites carry practical information, including details that voters may need to locate, understand, or check before and after casting a ballot. If official pages are hard to reach, residents can lose access to a trusted source, even when ballot handling and tabulation continue normally. The available report does not say voters missed a deadline or lost access to a particular service, so those outcomes should not be assumed.
At the same time, the public should resist treating every online disruption as evidence that election results were changed. Website availability and vote tabulation are different security questions. A website outage can create real inconvenience and erode confidence; it does not automatically establish that ballot data or counting equipment was reached. The federal election-security resources from CISA and the Election Assistance Commission explain the broader need to protect election systems, but general guidance is not proof about what happened in Washington.
Here’s the kicker: the same restraint applies in both directions. Officials should not declare the incident harmless before the investigation is complete, and commentators should not imply that the vote count was compromised without supporting facts. The public deserves a clear account of what was disrupted, what was checked, and what remains unknown. That is basic accountability, not a special standard for elections.
Washington’s official elections information can help residents find routine guidance, while the investigation should answer the narrower technical questions. Keeping those channels distinct is good public administration: voters need usable information now, and investigators need room to establish the cause before naming one.
Timeline: What Has Been Reported
The timeline is short because the public account is short. It does not give a calendar date, minute-by-minute sequence, or detailed incident log. The following order captures what has been reported without filling in missing timestamps.
- Traffic rises over several days. A Secretary of State spokesperson said the website saw increased traffic over the prior few days and attributed the higher volume to bots. She did not confirm that the bots were connected to the cyberattack. The report does not identify when the traffic first rose or how much it increased.
- Some pages become temporarily unavailable. The agency spokesperson said some pages could not be accessed for a time. The number of affected pages and the length of the disruption have not been reported. Nor has the state publicly described the exact errors visitors saw.
- Hobbs discusses a cyberattack in a KOMO interview. During a Tuesday-night live interview, the secretary said the website had been hit and described election-season attempts to disrupt elections as a recurring concern. He did not identify an attacker or describe the method used in this incident.
- Hobbs addresses vote-tabulation equipment. He said the machines counties use to count votes are not connected to the internet and were not affected by the website incident. That is the reported official statement about the equipment; no separate technical findings were included in the account.
- The affected pages are restored. The spokesperson said the pages had returned. Restoration marks an end to the reported access problem, not necessarily the end of the investigation.
- Investigators continue their work. The incident remains under investigation. The agency has not reported a public conclusion, an attribution, or whether any data was accessed or altered.
When I separate the sequence from the speculation, the important point is what remains unresolved: the relation between the bot traffic and the attack. They may be connected, but the spokesperson expressly said she did not know. A sound timeline preserves that uncertainty instead of silently turning two observations into one verified cause.
The account also does not say whether the investigation has found evidence of a broader intrusion. Absence of a public finding is not proof that no such evidence exists; it means the finding has not been reported. That distinction is especially important in the first days of an incident, when technical teams may still be examining logs, systems, and service records.
Comparison: Public Website vs. County Tabulation Machines
There is no meaningful commercial competitor to compare with a cyberattack on a state election website. The useful comparison is between the affected public-facing service and the vote-counting equipment Hobbs said was not affected. They serve different functions, and the reported incident should not blur them together.
| Point of comparison | Secretary of State website | County vote-tabulation machines |
|---|
| Role described in the report | Public-facing state website; some pages were temporarily unavailable | Machines counties use to tabulate votes |
| Reported incident effect | Increased traffic and temporary page unavailability; pages later restored | Hobbs said the machines were not affected |
| Internet connection | The report does not describe the website’s technical architecture | Hobbs said the machines are not connected to the internet |
| Relationship to bot traffic | A spokesperson attributed higher traffic to bots but could not confirm its link to the attack | No connection to the website traffic was reported |
| What remains unknown | Attack method, duration, exact scope, possible data access, and whether bot activity was part of the attack | Further equipment-specific inspection results were not included in the public account |
The table is not proof that one system is invulnerable or that every operational risk has been ruled out. It simply separates the known website disruption from the reported status of tabulation machines. Hobbs’s statement is reassuring on the specific issue he addressed, but public confidence is better served by precise attribution than by turning one statement into a blanket guarantee about every part of election administration.
The distinction matters because systems have different jobs. A public website can provide information and services; counting equipment is used for a different stage of the election process. An incident affecting one does not, by itself, prove the other was reached. Conversely, an unaffected tabulator does not erase the need to investigate the website problem or maintain access to official voter information.
The Washington Secretary of State’s elections page offers the state’s official public information, and federal election-security resources from CISA and the Election Assistance Commission explain why election systems need layered protection. These references provide background, not an incident report. They cannot answer whether this website attack involved data access, whether the bot traffic was related, or what investigators have found.
Common Misconceptions and What to Know
Misconception: A website cyberattack means vote totals were changed. Nothing in the reported account establishes that. Hobbs said the county tabulation machines were not affected, and the report does not say that ballots or vote totals were altered. A claim of changed results would require specific evidence, not a leap from the word cyberattack.
Misconception: Bots prove the source or purpose of the attack. They do not. The spokesperson said bots accounted for increased traffic, but she did not know whether that activity was related to the cyberattack. Automated traffic can have different causes. Without technical findings, the public cannot identify its operator, motive, or connection to the outage.
Misconception: Restored pages mean the investigation is over. Restoration shows that the reported access problem was resolved. It does not tell us whether investigators have finished examining what happened. The report explicitly says the incident remains under investigation, and it gives no public findings.
Misconception: No reported data theft means no data was accessed. That conclusion also goes too far. The account does not report data theft, but it does not provide a forensic result ruling out access either. The honest answer is that data access has not been reported as a finding.
Misconception: An official’s reassurance removes the need for scrutiny. Hobbs’s statement about the tabulation machines is important. It should be reported accurately and considered alongside the investigation, not treated as a substitute for further information. The public can accept what officials say and still ask for an account of the disruption, the evidence reviewed, and the safeguards checked.
Let's be real: election security is not served by either panic or premature comfort. A website that voters rely on should be dependable, and a disruption merits a candid explanation. At the same time, speculation about foreign actors, compromised votes, or stolen data can do damage when it outruns the evidence. Public trust depends on disciplined reporting and proportionate claims.
There is also a mundane but important responsibility here: agencies should maintain backup routes for essential election information and tell residents where to find it if a website is unavailable. The report does not say whether a backup channel was needed or used. It is still a fair question for public administrators, because access to accurate information is part of serving the common good, not merely keeping a web server running.
What Investigators Still Need to Establish
The investigation needs to turn a broad public description into a specific account. First, officials can clarify the scope: which pages were unavailable, when the disruption began and ended, and whether other services were affected. The spokesperson said some pages were temporarily unavailable and later restored, but the public account gives no detailed outage record.
Second, investigators need to determine what caused the disruption. Was the website overwhelmed by automated requests? Was there another technical failure? Did the bot traffic form part of the cyberattack, or was it separate? The spokesperson did not know whether the bot activity was related, so that relationship remains a question, not a conclusion. Technical evidence, rather than guesswork about timing alone, should decide it.
Third, the state should say what kind of access, if any, investigators found. A service becoming unavailable is different from unauthorized access to records or changes to website content. The report does not identify the attack method, confirm access to data, or describe any alteration. Officials should say plainly whether those possibilities were assessed and what the review found, subject to any legitimate investigative limits.
Fourth, the public needs a careful account of the tabulation equipment check. Hobbs said the machines counties use to count votes are not connected to the internet and were not affected. The report does not describe the checks behind that statement. A later update could explain, in language ordinary voters can understand, what was reviewed and whether the finding applies to all counties’ relevant equipment.
Finally, officials should provide a timetable for updates, even if the investigation has no fixed completion date. A brief statement that the case remains open is not enough forever. Residents need to know where official information will appear, whom to contact if they cannot reach an election page, and when the state expects to report findings. Transparency does not require publishing sensitive technical details; it does require explaining the conclusions that matter to voters.
I would watch for specific findings, not dramatic labels. The useful measures are scope, cause, impact, recovery, and the evidence supporting the conclusion that vote-counting systems were unaffected. Careful public disclosure helps the state protect both operational security and civic confidence without pretending every technical detail belongs in public.
Frequently Asked Questions
Were Washington’s vote-counting machines affected?
Hobbs said the county machines used to tabulate votes were not affected and are not connected to the internet. The report does not include additional equipment-specific findings, so that statement should be attributed to the secretary rather than expanded into claims about every election system.
Did bots cause the cyberattack?
That has not been confirmed. A Secretary of State spokesperson said bots caused increased website traffic, but she did not know whether the traffic was connected to the cyberattack. Investigators have not publicly reported a cause.
Was voter information stolen or changed?
No theft or alteration of voter information was reported. The public account also does not provide a forensic finding that rules out access. At this stage, the accurate answer is that data access or alteration has not been reported as a finding.
Are the affected website pages available again?
Yes. The spokesperson said the temporarily unavailable pages had been restored. The incident itself remains under investigation, and restoration does not tell the public what caused the disruption.
Final Thought
A brief website outage and a functioning vote count are not mutually exclusive facts. The public account says the Secretary of State’s website was disrupted, that pages were restored, and that Hobbs said county tabulation machines were not affected. Those statements should be reported together, with the unresolved questions left visible rather than patched over with guesses.
The next useful update will be specific: what investigators determined about the bot traffic, what caused the outage, whether any information or content was accessed or changed, and how officials verified the status of county tabulation equipment. If the state has no answer yet, it should say so and provide a reasonable point for another update. That is more credible than certainty unsupported by a completed review.
Public institutions have a duty to protect the systems entrusted to them and to explain disruptions plainly. That duty is a form of stewardship: public resources and public confidence are held for the benefit of residents, not for the convenience of officials. In election administration, trust is earned through evidence, clear distinctions, and equal regard for every voter who depends on accurate information.
For now, the firmest account is also the least theatrical: some state website pages were temporarily unavailable after increased bot traffic; a spokesperson could not confirm whether the traffic was tied to the cyberattack; Hobbs said county vote-tabulation machines were not affected; and the investigation continues. Anything beyond that should wait for findings.