The year in failed redactions: 2026 so far

Every year brings a few redaction failures that make the news. 2026 has had more than its share. Here are the most instructive, all from primary reporting, and the one pattern they share.

The Epstein files releases

The US Justice Department's releases of Epstein-related files, from December 2025 into early 2026, became the year's biggest redaction story. In some files, black boxes could be bypassed by copying the text out. Lawyers for survivors told the court about thousands of instances of identifying details left visible, and the department said it would take down and repost corrected files. NPR also found one presentation redacted six different ways across the files. We covered the lessons in detail in the Epstein files: redaction at scale.

A federal court filing, September

In Mercante v. Tarzia, in the Eastern District of New York, a lawyer filed an exhibit with a white box marked "REDACTED" over the other side's law firm's bank details. As Eugene Volokh reported, the text could be copied out, or revealed by moving the box. The details were posted and circulated online. The court found no contempt, citing the lawyer's attempt to redact and quick acceptance of responsibility, but ordered him to pay $2,316 toward the costs of mitigating the data breach.

Volokh's post adds a common variant: black highlighting in a word processor, saved to PDF. It looks redacted on screen, but the text is just set in a different colour, and pasting it elsewhere strips the highlight away.

A hidden spreadsheet, revisited

In July 2026, a UK parliamentary committee reported on the 2022 Ministry of Defence breach, in which a spreadsheet emailed to a trusted contact contained hidden records on nearly 19,000 Afghan relocation applicants. ITV reported the committee's finding that the breach was "foreseeable." We covered how spreadsheets leak in hidden tabs and rows.

The pattern

None of these failures needed sophisticated tools to uncover. In every case, what looked hidden was still in the file:

• a box drawn on top of text, not text removed;
• highlighting that changed the colour, not the content;
• data hidden in a spreadsheet, not deleted from it.

And in every case, a two-minute check would have caught it: select all, copy, paste into a plain text note, and unhide everything before sending.

Where Ombly fits

Ombly is built so these failures can't happen: every export is rebuilt from pixels, so there's nothing underneath a black area and no hidden data carried across. A person reviews every suggestion first. For firms, it runs on your own servers with an audit trail. Book a call, or read what public mistakes teach law firms.