-8.png?w=1024)
The Federal Election Commission (FEC) has taken its electronic filing system offline following a reported hacking attempt, disrupting campaign finance disclosures less than a week before the November 3 US midterm elections.
The outage began late Oct. 26, preventing political committees and other organizations from electronically submitting time-sensitive reports on campaign spending. Previously filed reports remain searchable, according to the agency.
While the FEC has confirmed the disruption, it has not publicly confirmed a successful breach or disclosed whether any information was compromised. The incident affects campaign finance reporting, not voting systems or ballot counting.
Reported intrusion attempt prompts FEC shutdown
According to Reuters, an FEC electronic filings officer warned campaign compliance firms that an attacker was attempting to breach the agency's systems.
"We have a bad actor attempting to breach FEC systems. As a result, we've had to temporarily shut down our web-facing services," the officer wrote in an email reviewed by the news agency.
The FEC separately confirmed that its electronic filing system was unavailable and said IT staff were working to restore service.
In an Oct. 27 status update, the agency said it had identified an issue and was implementing a fix. As of Oct. 28, its website continued to display a notice that electronic filing was offline.
The disruption affected electronic report submissions, online filing forms, and tools used by organizations that prepare campaign finance disclosures. Additional filing-related services were also reported unavailable.
The FEC has not identified the attacker, disclosed the suspected intrusion method, or confirmed that anyone gained unauthorized access.
Outage interrupts critical campaign spending disclosures
The timing creates an immediate transparency concern.
During the final days before an election, certain political expenditures must be reported within 24 hours, while qualifying last-minute contributions or loans are subject to 48-hour disclosure requirements.
With electronic filing unavailable, affected organizations cannot submit those reports through the usual system, potentially delaying public access to information about political spending.
Michael Centrella, head of public policy at SecurityScorecard, said the agency must address how new disclosures will be received and made available during the outage.
"The timing is particularly alarming, with the midterms just a week away. The FEC says past reports remain searchable, but my immediate concern is what happens to new information during the outage," Centrella said in comments provided to eSecurity Planet.
"With organizations reportedly unable to submit their 24-hour and 48-hour spending reports, officials need to establish how those disclosures can be received securely and made available to the public."
The incident does not indicate that election administration systems have been compromised. The FEC regulates federal campaign finance activity, while state and local authorities administer voting.
"The FEC does not administer voting, and this outage should not be presented as evidence that ballots or vote counting are compromised," Centrella said.
His concern is that officials communicate the distinction clearly while maintaining access to campaign finance information.
Previous audit raised patch management concerns
The disruption comes against a backdrop of previously documented cybersecurity challenges at the agency.
A July 2025 audit by the FEC Office of Inspector General examined the effectiveness of the commission's security patch and vulnerability management programs.
The audit found that the FEC had established policies and procedures that were generally effective and aligned with applicable federal guidance. However, it also identified areas requiring improvement, including risks associated with legacy technology and the agency's ability to address vulnerabilities.
The findings do not establish that a known vulnerability caused the current outage.
John Bruggeman, virtual chief information security officer (vCISO) at CBTS, said the audit provides important context for evaluating the agency's response.
"A lot of organizations treat these as table stakes. That context matters here: if remediation was already behind before this incident, 'we patched the thing that let them in' is a lower bar of confidence than it would be for an organization with a mature, tested program," Bruggeman said in comments provided to eSecurity Planet.
The distinction matters because patching a suspected weakness does not, by itself, establish whether an attacker entered a system or retained access.
For organizations managing older infrastructure, the incident reinforces the importance of effective patch management and routine verification of security controls.
Experts warn against restoring systems without sufficient evidence
The FEC faces pressure to restore electronic filing quickly, but security experts say recovery decisions should depend on what investigators can establish about the reported attack.
Bruggeman said the first question is whether the suspicious activity was stopped before an intrusion occurred.
"I'd want to know whether logs show anyone actually got in, or whether this was blocked at the perimeter," he said.
"If it was blocked, the team needs to verify those defenses hold when service resumes. If someone got in, investigators need to establish what they reached and confirm that access is fully removed, not just that the immediate vulnerability was patched."
He also questioned how the agency would determine when it was safe to resume operations.
"Who has the authority to approve the restart, and what evidence do they require before signing off?" Bruggeman asked.
Those decisions involve more than repairing a technical fault. Investigators must consider the integrity of affected systems, whether suspicious access persists, and what monitoring will be in place after restoration.
Bruggeman said teams do not need every forensic question answered before reopening a service, but they need enough confidence that operations can resume safely.
"Reopening too soon and having to shut down a second time would be far more damaging to public confidence than taking the extra day to get this right," he said.
The challenge is familiar to organizations operating essential services. A recent cybersecurity incident at UNM Health similarly highlighted how security disruptions can force difficult decisions about operational continuity.
What comes next for the FEC
The immediate priorities are restoring electronic filing, clarifying how affected organizations should submit required disclosures, and determining whether the reported intrusion attempt resulted in unauthorized access.
The agency has not publicly confirmed data theft, identified a threat actor, or provided a definitive explanation of the incident.
For security teams, the broader lesson is the importance of preparing recovery procedures before a disruption occurs. An effective incident response plan should address evidence preservation, service restoration, alternative operating procedures, and communication with affected users.
Centrella said clear public messaging is especially important because the outage involves an election-related federal agency.
"People should not have to interpret a cyber incident themselves to understand whether it affects their ability to vote," he said.
With Election Day approaching, the FEC must restore a critical reporting service without compromising its security. The outcome will depend not only on how quickly the system returns, but also on whether the agency can demonstrate that new campaign finance disclosures can be submitted and made public reliably.
Other news: Japanese companies GMO Internet and Park24 are compensating customers following separate cyberattacks, with GMO covering verified unauthorized trading losses and offering additional payments for exposed information, while Park24 faces an estimated ¥5.5 billion in breach-related costs.