The U.S. Federal Election Commission (FEC) took its electronic filing system offline late on Monday, 26 October 2026, after what one of its own staff called a "bad actor attempting to breach FEC systems." The shutdown came one week before the 3 November midterm elections. Reuters first reported the incident, citing an email from an FEC electronic filings officer to campaign compliance firms. The agency has confirmed the outage in public statements and on its status page. It has not said whether the attacker got in. The FEC does not run elections, which are administered by the states, and voting is not affected. What the outage does block is the 24-hour and 48-hour spending reports that show who is spending on which races in the final days of a campaign. Reuters puts advertising spending this cycle at about $11.21 billion, making these the most expensive U.S. midterms on record.
What Happened
- Monday night: The FEC status page says e-filing went down at around 10 p.m. ET. Gizmodo, also citing the status page, gives the time as about 10:15 p.m. ET. That evening, campaign finance officers found they could not submit mandatory reports.
- Same night: An FEC electronic filings officer emailed several compliance firms: "We have a bad actor attempting to breach FEC systems. As a result, we've had to temporarily shut down our web facing services." Reuters reported the email.
- Tuesday: The FEC said in a statement that "the FEC's electronic filing system is currently offline and our IT staff are actively working to restore service." FEC deputy press officer Myles Martin told Newsweek that "the website search for FEC reports is not affected." Gizmodo reported that the public filing portal returned a "504 Gateway Time-out" error.
- Tuesday, about 8 p.m. ET: A new status message said the issue "has been identified and a fix is being implemented," according to Reuters. Filing was still offline at that point, and the FEC has not given a time for restoring service.
According to the FEC status page, as reported by DysruptionHub, the shutdown affected online web forms, electronic filing submissions and the tools that filing-software vendors use. Searches of campaign finance data and PDFs of existing reports stayed available.
The Cybersecurity and Infrastructure Security Agency (CISA) referred questions to the FEC. The FBI had not commented at the time of reporting.
There is a gap between the headlines and what has been confirmed. Many reports describe a "hack" or "cyberattack." The FEC's own wording describes an attempt to breach its systems, followed by a protective shutdown that the agency chose to make. So far, the confirmed disruption is the shutdown itself. Nothing published shows that the attacker caused the outage directly.
What Was Taken
Nothing has been confirmed as taken. The FEC has not said whether the attempt succeeded, whether anyone gained unauthorized access, or whether any data was viewed or removed. No ransom demand, data leak, or claim of responsibility has been reported.
For context, much of what the FEC collects (campaign finance reports) is published anyway. The more sensitive parts of a filing system are the filer login credentials, unpublished reports still in progress, and the integration points used by vendors. Nothing published so far says whether any of these were exposed.
The clearest harm so far is lost disclosure. Steven Mele, president and CEO of compliance firm MBA Consulting Group, told Reuters: "I've never seen this in 26 years. The result is there will be less disclosure on the elections" until the system is fixed.
Why It Matters
Disrupting transparency is a goal in its own right. An attacker does not need to touch a ballot to affect an election. Late spending reports from super PACs and outside groups are what reporters, opponents and voters rely on in the closing week. An outage at this point delays that information during the window when it matters most, whoever is behind it.
A defensive shutdown can still achieve what the attacker wanted. Taking web-facing services offline was likely the right call to contain a possible intrusion. Even so, the result is the same as a successful denial-of-service attack. Organizations with fixed public deadlines should plan for the possibility that their own incident response becomes the outage.
The rules have not caught up. DysruptionHub, citing FEC guidance, notes that electronic filers who switch to paper reports can be treated as non-filers. The commission cannot extend filing deadlines, although it may decline to pursue fines when filers could not submit for reasons outside their control. The FEC has not said how reports delayed by this outage will be handled.
Election-period targeting is predictable. The incident fits a familiar pattern: government services with fixed deadlines get attacked when downtime does the most damage. Peripheral election systems such as finance portals, registration lookups and results websites carry less security attention than voting equipment, but their failure still damages public trust.
The Attack Technique
Unknown. The FEC has not identified the attacker, the method of entry, or any affected system beyond its web-facing services. Taken together, the following details are consistent with an attack on internet-facing infrastructure:
- The internal email refers to an attempt to breach.
- The agency responded by shutting down "web facing services" specifically.
- The portal returned 504 gateway errors.
- Search and archived PDFs kept working, which points to an isolated or separately hosted search tier.
Possible explanations include exploitation of an application vulnerability, credential attacks on filer accounts, or unusual traffic that triggered containment. None of these has been confirmed, and nothing published supports any one of them over the others. Treat any claim of attribution as unverified until the FEC, CISA or the FBI makes a statement.
What Organizations Should Do
- Plan for downtime around deadlines. If your service handles legally required submissions, agree on fallback filing routes and deadline-relief procedures with regulators or legal counsel before a crisis. Don't leave them to be worked out during an outage.
- Keep the read side separate from the write side. The FEC's search and archive stayed online while submissions went dark. Design public-facing systems so that the parts serving public information can stay up while the parts accepting submissions are taken down for containment.
- Harden third-party and vendor integration points. Filing-software vendor tools were caught in this shutdown. Inventory API keys and vendor connections, enforce mutual authentication, and make sure they can be rotated or revoked quickly without taking the whole service offline.
- Raise monitoring during high-value periods. Ahead of predictable high-stakes dates such as elections, tax deadlines and earnings releases, tighten web application firewall and rate-limiting rules, review the logs and alerts on authentication systems, and keep on-call staff ready to respond.
- Communicate early and specifically. The FEC's status page and email to compliance firms limited confusion. Publish what is affected, what still works, and how users should keep records of failed submission attempts.
- Filers: keep evidence of every attempt. Political committees and compliance firms should save timestamps, error screenshots and copies of reports they could not file. This documentation supports any request not to be fined later.
Sources: Hackers target FEC system, disrupting campaign finance ... | Federal Elections Commission Offline After Hacking Attempt: Report | Hackers Target U.S. Federal Election Commission Website | Hackers disrupt US election watchdog's filing system days ... | Cyber intrusion attempt shuts down FEC filing services | Exclusive-Hackers target US FEC system, disrupting campaign finance... | US campaign finance watchdog faces cyberattack ahead of ... | Cyberattack Shuts Down US Campaign Finance Filings Ahead of Midterm...