A reported FEC hacking attempt knocked the Federal Election Commission's electronic campaign-finance filing system offline at about 10 p.m. ET on Monday, October 26. The system stayed down for roughly 41 hours, and the outage landed one week before the November 3 midterms, when campaigns and outside groups file some of their most time-sensitive spending reports. Reuters first reported the story on Tuesday, October 27, citing an internal email. The FEC has not confirmed an attack.
The gap between that internal email and the agency's public statements is the central fact here. The FEC's account is narrow, while the email was blunt. Committees that need to know whether they missed a deadline, and readers who want to know what was visible during the final week, need both halves of the story.
What the FEC says about the hacking attempt
The agency's public position is limited. Yahoo News, citing Newsweek, reported that FEC deputy press officer Myles Martin wrote in an email, "IT staff are actively working to restore service." The FEC has said the system is offline and has not confirmed a hacking attempt or a successful attack, according to Yahoo News.
The sharper language came from inside the agency. Reuters, citing an internal email, reported that an FEC electronic filings officer told campaign compliance firms that an unauthorized party was trying to breach the agency's systems and that the FEC shut down its internet-facing services in response. eSecurityPlanet quoted the email directly: "We have a bad actor attempting to breach FEC systems." The officer is not named in the reporting, and the Jerusalem Post's version of the Reuters story carries the same account of the email.
The FEC has not said whether any data was accessed, and no source attributes the attempt to a specific person or group.
Outage timeline from Monday night to Wednesday
The sequence below comes from the reporting on the outage. Times are Eastern.
| When | What happened |
|---|---|
| Monday, Oct. 26, about 10 p.m. | Electronic filing system becomes unavailable |
| Tuesday, Oct. 27 | Reuters reports, citing an internal email, that an unauthorized party tried to breach FEC systems |
| Tuesday evening, Oct. 27 | FEC says it has identified the issue and is implementing a fix |
| Wednesday night, Oct. 28 | Reuters reports the system is restored after roughly 41 hours offline, and managers must reset passwords to log in |
| Wednesday, Oct. 28 | Other reports say filing-search functions and report-validation tools remain offline |
The FEC said most affected services had been restored. The CDO Magazine report described several systems, including filing-search and report-validation tools, as still offline on October 28. Those accounts overlap in time and do not fully reconcile, so treat "fully restored" as unconfirmed until the agency says so.
Why the 24-hour and 48-hour reports matter this close to Election Day
Federal campaign finance disclosure runs on deadlines. The 24-hour and 48-hour reports disclose independent expenditures, which show political spending on specific races, and they are the filings people watch in the final days before voting. When the system is down, a committee that cannot file on time creates a gap that the public cannot see until the report eventually appears.
Reuters said the outage temporarily concealed spending from big donors as political donations ramped up in the final days before the election. That is Reuters' characterization of the effect on public visibility. It is not a finding about who was spending or how much, and no source measured how much spending went unseen.
Molly White, a campaign finance watchdog who tracks crypto and Big Tech political spending, told Reuters: "We have no visibility into that when the filing systems are down." Her comment describes the practical problem. Final-week coverage depends on filings that arrive quickly, and a shutdown removes that input for everyone at once.
Who is affected and who is not
Political committees, campaign finance managers and compliance vendors bore the most direct cost. They had to meet 24-hour and 48-hour reporting deadlines while the system was down, and after restoration they had to reset their passwords before they could log in. Journalists, watchdogs and voters who follow late spending lost access to fresh disclosures during the final week.
Voters casting ballots are not affected. According to CDO Magazine, the agency says the incident does not affect people's ability to cast ballots, because the FEC does not administer elections or operate voting systems.
The outage also landed in a charged debate about election integrity. Verity reported that voter fraud had become a political flashpoint and that the President had offered $1 million for reports of voter fraud. Those matters are separate from this outage. The FEC enforces campaign finance disclosure rules, and it does not run elections. The outage follows other recent US federal cyber incidents, but none of the sources in this reporting connects the two.
What committees and filers should do now
These steps are general guidance rather than instructions from the FEC or any source cited here.
- Check the FEC's official website for current filing status before each deadline, and do not rely on secondhand summaries.
- Keep a written record of every attempted filing, including timestamps and error messages, so you can explain any late report.
- Expect password-reset prompts when you log in. Go to the FEC site directly rather than clicking links in emails or texts.
- Before you enter credentials anywhere, confirm that a reset message really came from the FEC.
- Brief your compliance vendor and staff on the outage window so everyone knows which deadlines were affected.
The same caution applies beyond this agency. The guide to what users should do after the Archive of Our Own security incident makes the same basic point: verify the sender before you act on a reset request.
What to watch before the midterms and after
Three questions will shape how this story reads. First, will the FEC confirm a hacking attempt, and if it does, will it say whether anything was accessed or copied? Second, will it describe who was behind the attempt? No source attributes it to anyone. Third, will 24-hour and 48-hour filings made after restoration show backlogs or late-report notices?
For a sense of what a useful breach statement looks like, the Chainalysis case, in which the company said hackers breached its systems and accessed customer data, shows the level of detail filers and reporters will want from the FEC.
The next useful signal is the agency's own written statement. If the FEC confirms an intrusion, committees and reporters will want to know whether filer accounts or stored reports were touched. If the agency stays quiet, the question will likely carry into post-election reporting, when reporters can compare late filings against the earlier record and see whether anything went missing from view.
