The Arizona secretary of state, Adrian Fontes, asked the state attorney general Monday to investigate and potentially charge the losing Republican candidate for governor with a felony for sharing images of voters’ signatures online.

Fontes, a Democrat, said GOP gubernatorial candidate Kari Lake may have violated a state law that protects a voter’s signature from being accessed or shared by anyone other than the voter or an “authorized government official in the scope of the official’s duties”. Violations of this law carry a class six felony charge, the lowest-level felony in Arizona.

Lake posted the voters’ signatures on Twitter on 23 January, claiming they were part of a “bombshell” that showed mismatching signatures that shouldn’t have been counted, a frequently repeated claim after Republican losses in 2020 and 2022. The signatures she posted were from 2020 ballots.

In his letter to the Democratic attorney general, Kris Mayes, Fontes asked that Mayes “investigate and take appropriate enforcement action against Kari Lake”. Mayes’ office confirmed receipt of the referral but said it wouldn’t have further comment on the matter at this time.

Despite her loss, Lake has continued to fundraise based on the false premise that she actually won the governor’s race and that the election results will be overturned. Lake’s run for governor focused heavily on the false assertion that the 2020 election was stolen. She held a rally in Scottsdale on Sunday when Donald Trump appeared by phone and said Lake will be “victorious” in her effort to overturn the 2022 election.

Since Fontes’ referral became public, Lake has retweeted several accounts who called Fontes’ election into question and who have said the referral was proof that Lake was correct in her claims of a stolen election.

Lake wasn’t the first to share voters’ signatures to make claims about their validity. The signatures have been shared by state lawmakers and election-denial groups in presentations at the state legislature, Votebeat’s Jen Fifield pointed out on Twitter, though it’s not clear how the confidentiality of the signatures was originally breached.