Hackers targeting the U.S. Federal Election Commission forced officials to shut down its electronic filing system days before the November 3 midterm elections, blocking campaign finance disclosures during a critical spending period.
The disruption affects how political committees report money flowing into races, not how Americans vote. The FEC does not run elections, and Reuters says the outage should not affect voters’ ability to cast ballots, according to Reuters.
The shutdown began late on October 26 after campaign compliance staff could no longer submit mandatory reports. An email Reuters reviewed described an active attempt to break into agency systems. “We have a bad actor attempting to breach FEC systems. As a result, we’ve had to temporarily shut down our web-facing services,” an FEC electronic filings officer told several compliance firms.
Hackers Target U.S. Election Commission
The FEC’s official status page recorded an investigation into the electronic filing outage at 10:15 p.m. Eastern time on October 26. Further updates followed overnight and the next morning. At 8:17 p.m. Eastern on October 27, officials said they had identified the issue and were implementing a fix. However, that message did not confirm a completed recovery, and the incident remained listed as unresolved.
The agency said its IT staff were working to restore service, while previously filed reports remained available for public searches. That distinction matters. The confirmed disruption affects submitting new disclosures, not access to existing campaign finance records. The status page also listed a related FECfile+ submission outage, showing that officials were tracking problems affecting filing services.
Public details remain limited. Neither the FEC statement nor the reporting reviewed identifies the attackers, their location, their entry method, or a specific software flaw.
Those sources also provide no public confirmation that attackers stole records, changed filings, deployed ransomware, or gained lasting access. The email describes an attempted breach and a defensive shutdown, which should not be mistaken for proof of a successful data breach.
Technically, the key distinction is between an attacker directly disabling a service and defenders taking it offline to contain a suspected threat. The available account supports the latter. It does not establish whether malicious traffic, stolen credentials, or an application flaw triggered the response. Assigning a particular attack method before investigators release evidence would go beyond the facts currently available.
Earlier incidents show why clear distinctions matter. Cybersecurity News previously covered the UK Electoral Commission breach, where attackers accessed email systems and electoral register copies. That case involved confirmed access to stored information. No comparable disclosure has been made for this FEC incident, and no evidence links the two cases.
The immediate cost is reduced transparency. The outage prevents organizations from submitting 24-hour and 48-hour spending reports, which help reveal who is paying to influence individual races. Steven Mele, president and CEO of compliance firm MBA Consulting Group, told Reuters he had never seen anything like it in 26 years.
The timing makes the disruption especially serious. OpenSecrets research director Brendan Glavin told Reuters that super PACs and dark money groups spent more than $50 million on average per day over the previous week. On October 20 alone, more than $250 million was reported. Delayed filings leave voters and watchdogs with less timely information about that spending.
Political cyber incidents can have different goals. Previous reporting on the Trump campaign hack described an attributed Iranian operation. No such attribution exists here. For now, the central questions are when filing access will return and what investigators can establish about the attempted intrusion. Clear recovery updates will help separate verified findings from speculation as Election Day approaches.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
