Politics · Cybersecurity · Elections
FEC cyberattack filing system outage: for nearly 41 hours, the Federal Election Commission’s electronic filing system was dark in the final week before the Nov. 3 midterms — and with it went the public’s only real-time window into last-minute super PAC spending.
WASHINGTON — The Federal Election Commission restored its electronic filing system on Wednesday night, Reuters reported, after taking it offline for nearly 41 hours to contain a cyberattack — an outage that landed at the single worst moment in the American campaign calendar: the final week before the November 3 midterm elections, when outside money moves fastest and matters most.
The restoration is the good news, and it is real. But the 41 hours cannot be un-happened. During them, super PACs and other outside groups could not file the mandatory 24-hour and 48-hour reports that disclose, in near real time, the money being spent to help or hurt candidates in the closing days of the most expensive midterm cycle on record. The spending itself did not stop. The ads kept running. What stopped was the public’s ability to see who was paying — and that distinction, between an election that kept working and a disclosure system that did not, is the whole story.
Two boundaries need drawing at the outset, because this story will be misdescribed in both directions. First, what happened to the FEC’s filing systems had no effect on voting itself. The FEC does not administer elections and does not count ballots; casting a ballot was never touched by this outage. Commissioner Dara Lindenbaum put it in capital letters: the incident has “NOTHING to do with voter files or voter registration.” Second, the cause remains attributed, not established. The FEC has not publicly confirmed the details of what hit it, no source has reported that data was stolen or altered, and no one has been identified as responsible. What follows separates, carefully, what is confirmed from what is claimed — because in a story about a transparency failure, precision is the product.
What happened, hour by hour
The outage began on Monday night, October 26. At about 10 p.m. ET, the FEC took its electronic filing system offline. In a notice posted just after 10 p.m., the commission said it was investigating a problem causing “major” outages in its electronic filing systems. To a casual reader that language sounded like a technical failure. Inside the campaign-finance industry, a different and more alarming explanation was already circulating.
Late Monday, an FEC electronic-filing officer emailed campaign compliance firms — the specialists who file reports on behalf of campaigns and outside groups — with a blunt account, in an email later reviewed by Reuters: “We have a bad actor attempting to breach FEC systems. As a result, we’ve had to temporarily shut down our web-facing services.” That sentence is, at this writing, the closest thing to an official explanation of cause that exists in public. It is attributed to that officer’s email; the FEC as an institution has not announced the cause, did not return Reuters’ requests for comment on Wednesday, and has not said who the “bad actor” was, how they got in, or what they touched. The Cybersecurity and Infrastructure Security Agency and the FBI both referred questions to the FEC. Reuters could not establish a motive. No reporting to date describes a successful intrusion, stolen data or altered records — and readers should treat any claim to the contrary, from any direction, as unproven.
What the FEC did say publicly, it said sparingly. On Tuesday, October 27, the commission posted on X: “FEC’s electronic filing system is offline. We apologize for the inconvenience and are working to resolve the issue.” An FEC spokesperson separately confirmed to the Daily Caller that the system was offline, that IT staff were working to restore it, and that previously filed reports remained searchable — a detail that matters, because the archive never went dark; only the inflow of new disclosure did. The Washington Examiner likewise reported the outage and its hit to time-sensitive filings. By about 8 p.m. ET on Tuesday, the FEC’s status update said the issue had been identified and a fix was being implemented.
The fix landed on Wednesday night, nearly 41 hours after the shutdown began. Restoration came with homework: campaign finance managers had to reset their passwords before logging back in, according to an email reviewed by Reuters — a standard precaution that also hints at how seriously the commission treated the possibility of compromised credentials. The FEC said most affected services were restored, and filers were told, in an automated commission email reported by Reuters, that there would be no fines for missed filings provided they file within 24 hours of the restoration. The system, in other words, came back with a grace period attached — and a deadline that sets up the next act of this story.
What the outage actually hid: the 24- and 48-hour reports
To understand why 41 dark hours in late October are different from 41 dark hours in, say, March, you have to understand the two fastest clocks in campaign finance law. In the final stretch before an election, independent spenders — super PACs and similar groups making expenditures to support or oppose candidates — must report their spending almost as it happens. Large independent expenditures trigger 24-hour reports; a slightly lower tier triggers 48-hour reports. These filings are the campaign-finance system’s live feed: they are how journalists, opponents, researchers and voters learn, while it can still inform a decision, that a group with a patriotic name has just bought a million dollars of advertising against a Senate candidate in a state where the margin is two points.
Those were precisely the reports that could not be filed while the system was down. Routine, previously filed reports stayed searchable throughout the outage — the historical record was intact. What vanished was the present tense. Molly White, who tracks money in politics, described the practical result to Reuters: “We didn’t have access to the last-minute spending… We have no visibility into that when the filing systems are down.” And then, the sentence that will follow this story to Election Day: “It’s pretty devastating this close to the election.”
The scale of what flows through that window is difficult to overstate. According to OpenSecrets figures cited by Reuters, super PACs and dark-money groups spent an average of over $50 million per day in the week before the outage. On a single day, October 20, more than $250 million in spending was reported, OpenSecrets research director Brendan Glavin noted. And the cycle as a whole, by AdImpact’s reported tally, stands at about $11.21 billion — the most expensive election cycle on record. The outage did not interrupt any of that spending. It interrupted only its disclosure, at the exact moment when disclosure has its highest value and its shortest shelf life.
Why this matters
Campaign-finance disclosure rests on a simple premise: sunlight only disinfects if it arrives in time. A spending report filed before Election Day is information — it can shape a voter’s judgment, a journalist’s question, an opponent’s response. The identical report filed after the votes are counted is history. It may matter to historians, prosecutors and the next cycle’s strategists, but to the voter deciding this November 3, it might as well not exist. That is why Hilary Braseth, OpenSecrets’ executive director, said before the system was restored: “Disclosure delayed is disclosure denied… transparency is not an optional luxury, it is a fundamental public safeguard.”
Now do the arithmetic — carefully, and labelled for what it is. At OpenSecrets’ average of over $50 million per day in outside spending during the week before the outage, a blind window of nearly 41 hours covers on the order of $85 million or more in spending activity that could not be disclosed on schedule. That figure is an estimate derived from a daily average, not a confirmed hidden total: spending is lumpy, October 20 alone topped $250 million, and no one outside the filers themselves yet knows what was spent during the dark hours. But the estimate establishes the order of magnitude honestly. This was not a clerical inconvenience affecting a handful of late forms. It was a blackout over a sum comparable to the entire cost of many statewide races, falling in the six days before Americans decide whether Republicans keep their congressional majorities — the central question of these midterms, in a cycle where, as recent polling on the Trump voter enthusiasm gap suggests, turnout and late information may decide control of Congress.
The veterans of this industry heard the outage as something without precedent. “I’ve never seen this in 26 years,” Steven Mele of MBA Consulting Group told Reuters. A quarter-century of filing deadlines, system hiccups and election-eve chaos had not produced a multi-day, attack-driven shutdown of federal disclosure in the final week. Precedent matters here not for nostalgia but for calibration: the people who operate this system for a living are saying, on the record, that this is new.
Who benefits, and who loses
Start with the losers, because they are identifiable. Voters lose the last, best chance to know who is trying to persuade them before they vote — particularly voters in close races saturated with outside advertising in the final week. Journalists and watchdog researchers lose the raw material of accountability reporting at the moment of peak public attention. Opposing campaigns lose the ability to answer an attack ad whose funding they cannot identify. And honest filers — the groups that were ready to disclose on time — lose the competitive and reputational benefit of their own compliance.
The beneficiaries are harder to name, and honesty requires saying so. In the abstract, anyone who spent money in the window preferring that voters not know until after Election Day benefits from the delay, whether or not they had anything to do with causing it. White made exactly this observation to Reuters: the timing would be a good way to hide unpopular last-minute spending — while stressing, in the same breath, that there is no information indicating that is what happened. That pairing deserves to survive every retelling of this story: the outage’s effect resembles a favour to secretive spenders, but resemblance is not evidence of design. Meanwhile the fight over late money runs on other fronts too, including litigation over campaign ad rates and FCC rules — a reminder that the modern midterm is a contest over the terms of persuasion itself.
The silence problem
If the outage created an information vacuum about spending, the official response created a second vacuum about the outage itself — and vacuums, in an election’s final week, do not stay empty. Reuters reported that the lack of information stirred conspiracy theories within the campaign-finance industry itself: the professionals, not just the public, were left to speculate about who would attack the FEC, and why now. The commission’s public communications across 41 hours amounted to a notice of “major” outages, an apology on X, and a status line about an identified issue and a coming fix. It did not return Reuters’ comment requests on Wednesday. CISA and the FBI pointed back to the FEC. The result is a strange inversion: the agency charged with forcing disclosure from everyone else in politics has disclosed very little about the most consequential incident in its modern history.
And yet the balance must be struck, because there is a serious case on the other side. Kyle Sandy, cybersecurity director at Logically, defended the shutdown itself as the right call: “the FEC detected something they couldn’t immediately scope and chose a known outage over an unknown risk.” That is not a bureaucratic excuse; it is sound incident response. An agency that keeps a possibly compromised filing system online risks something far worse than delayed disclosure — corrupted filings, a disclosure database no one can trust. A known outage is recoverable; poisoned data may not be. The password resets required at restoration point the same way.
The failure, then, is not the shutdown but the communication around it. Incident response explains silence in the first hours; it does not explain a near-total absence of public accounting across two days, in an election’s final week, from an agency whose entire mission is timely public information. Taking the system down was defensible, arguably necessary — and the vacuum that followed was a self-inflicted wound that better communication could have narrowed without revealing a single operational detail.
A watchdog already weakened
The cyberattack did not strike a robust institution at full strength. It struck the FEC as it exists in 2026: an agency that has lacked a quorum since May 1, 2025, and therefore cannot conduct most of its enforcement business; that reported its lowest staffing since 1990 in January, on a stagnant budget, even as the spending it polices exploded to record levels, as Washington Sun reporting has documented; and whose future composition sits in the Senate, where two Trump nominees await confirmation. An institution with no quorum, thin staffing and flat funding is not merely an enforcement laggard — it is a softer target, with fewer people to watch the systems, fewer resources to harden them, and less institutional slack when something goes wrong six days before an election.
The commission’s design explains both its mission and its fragility. Created in 1974 under amendments to the Federal Election Campaign Act, headquartered at 1050 First Street NE in Washington, the FEC is led by six commissioners, no more than three from any one party — a structure built for bipartisanship that doubles, in a polarised era, as a recipe for deadlock. Its job is the one this outage interrupted: disclose campaign finance and enforce the limits on contributions. The Nov. 3 midterms will decide whether Republicans retain their congressional majorities, and the closing argument is being made, in part, through a late surge of outside spending tracked by a hobbled agency — even as both parties stage their final pitches, from the president’s closing midterm rallies on down.
What happens next
The immediate future is a flood. Filers were told there would be no fines for missed filings if they file within 24 hours of restoration — which means the reports that would have trickled in across Monday, Tuesday and Wednesday are now due in a compressed catch-up window. When that dump lands, researchers will finally be able to reconstruct what was spent in the dark: which groups bought what, in which races, and whether any of it looks, in hindsight, like spending its sponsors would have preferred voters not to see before November 3. Some of it will arrive with days to spare. Some of it, inevitably, will become public only after the outcome it was meant to influence is already decided — disclosure as history, exactly as Braseth warned.
Beyond the filings, the unanswered questions queue up, and they are the questions Congress exists to ask. Who was the “bad actor” in the filing officer’s email — a criminal group, a foreign service, a lone intruder? Through what door did they reach FEC systems? Can the commission certify that no filing data was accessed, copied or altered — and on what forensic basis? Why was the public told so little, for so long, and will that change before the next incident rather than after it? Oversight interest is a near-certainty: a cyberattack that blinds federal election disclosure in the final week of a midterm is precisely the kind of event that produces hearings, letters and demands for briefings, whichever party holds the gavels in January.
For now, the verified record is narrow and should be kept narrow. A federal filing system went down on Monday night; an FEC officer attributed the shutdown, in an email, to a bad actor attempting a breach; the commission restored most services Wednesday night after nearly 41 hours; no theft or alteration of data has been reported by any source; the ballots, the voter files and the election itself were never the target anyone has identified. Everything beyond that — motive, authorship, intent — is unknown. What is known is sufficient: in the most expensive midterm in American history, the lights of the disclosure system went out at the moment they mattered most, and stayed out for 41 hours. Voters will cast the deciding ballots on November 3 with an incomplete picture of who spent what to sway them. The filings, when they come, will complete the record. They cannot restore the timing — and in disclosure, timing is not a detail. Timing is the point.
Sources: Reuters (October 28, 2026), “Cyberattack concealed political spending by big donors before US midterm elections” — the restoration after nearly 41 hours offline, the filing officer’s email, the password resets and filing grace period, the OpenSecrets spending figures and the White, Braseth, Mele and Sandy interviews; Reuters (October 27, 2026), exclusive reporting on the breach attempt and the outage timeline; Daily Caller (October 27, 2026), FEC spokesperson confirmation that the system was offline with past reports still searchable; Washington Examiner reporting on the outage’s impact on 24- and 48-hour reports; Federal Election Commission status notices and @FEC posts, October 26–28, 2026 (fec.gov). The characterisation of the incident as a cyberattack rests on the FEC filing officer’s email as reviewed by Reuters; the FEC has not publicly announced cause details, and no source reports that data was stolen or altered.