The FEC cyberattack that knocked America's campaign-finance disclosure system offline for nearly 41 hours has ended with the system back up — but not before it hid a critical stretch of big-donor spending just four days before the November 3, 2026 midterm elections. The Federal Election Commission restored its electronic filing system on Wednesday night, October 28, after taking it offline to contain the attack, leaving watchdogs, journalists and voters blind to the last-minute money flooding into the final days of the campaign.
The outage struck at the worst possible moment in the two-year election cycle. Outside groups were spending at their fastest pace of the entire cycle, and the reports that went missing are the very ones designed to expose last-minute spending: the mandatory 24- and 48-hour reports that super PACs and other groups must file when they spend money close to an election. For nearly two days, that window into the money race went dark.
The trouble began on Monday evening. Just after 10 p.m. ET on October 26, the FEC posted a notice saying it was investigating a problem that caused "major" outages across the systems that process electronic campaign filings. Behind the scenes, an FEC officer told campaign compliance firms late Monday that the agency had taken those services offline after a "bad actor" tried to breach its systems, according to an email reviewed by Reuters.
The outage then dragged into its third evening. Campaign finance managers, when they could get back in at all, had to reset their passwords before logging in to the system, according to an email reviewed by Reuters — a standard precaution after a suspected breach, and a sign of how seriously the agency treated the intrusion. The FEC later told users that most of the services affected by the outage had been restored, and the system was back on Wednesday night.
What the FEC has not done is explain itself. The agency did not return requests for comment on Wednesday and did not announce any details on the cause of the outage. The Cybersecurity and Infrastructure Security Agency and the FBI both referred questions to the FEC, leaving the public record thin: a 41-hour blackout, a suspected breach attempt, and no official account of what the attacker did or whether any data was touched.
To understand why a filing-system outage matters, it helps to understand what the FEC's electronic filing system actually does. It is the public's window into who is paying for American elections. Candidates, parties, super PACs and other political committees file reports of their fundraising and spending through it, and those reports are published for anyone — journalists, watchdogs, rival campaigns and ordinary voters — to inspect.
The 24- and 48-hour reports are the system's early-warning mechanism. In the final weeks before an election, when spending accelerates sharply, groups that spend money to support or oppose a candidate must report that spending within one or two days, rather than waiting for the next monthly or quarterly filing. The rule exists precisely because last-minute spending is the hardest to scrutinise: television ads, digital ads and mailers bought in the final days can shape a race before voters ever learn who paid for them.
That is why the timing of this outage alarmed campaign finance experts. Daily spending by super PACs — which can accept and give unlimited amounts of money — and dark money groups, which do not disclose their donors, had accelerated to its fastest pace of the two-year cycle. OpenSecrets research director Brendan Glavin said those groups spent an average of over $50 million per day in the week before the outage, and more than $250 million in spending was reported on October 20 alone.
The scale of the money at stake is enormous. Hundreds of millions of dollars in outside money flood the political airwaves in the final days before an election, and the FEC's disclosure system is the main tool the public has for tracing where it comes from and where it goes. When that tool goes down, the spending does not stop — only the visibility does.
Campaign finance watchdogs sounded the alarm as the outage dragged on. Molly White, a campaign finance watchdog who tracks crypto and Big Tech political spending, described the blackout in stark terms. "We didn't have access to the last-minute spending, which is really ramped up as the election draws nearer," she said. "We have no visibility into that when the filing systems are down." She added: "It's pretty devastating this close to the election."
Hilary Braseth, executive director of the nonpartisan campaign finance watchdog OpenSecrets, issued a statement before the system was restored that framed the outage as a threat to the integrity of the election information environment. "Disclosure delayed is disclosure denied," Braseth said. "When hundreds of millions of dollars in outside money flood political airwaves in the final days before an election, transparency is not an optional luxury, it is a fundamental public safeguard."
White also acknowledged the darker reading of the timing. She noted that the outage would be a good way for unscrupulous actors to hide unpopular last-minute spending, while cautioning that there is no evidence for that conclusion. "It's hard to say with any real information that that's what happened, but it's certainly I think where people's minds go very quickly," she said. Several people in the industry told Reuters that the timing of the hacking attempt this close to the November 3 elections, combined with the lack of information from the FEC, had stirred up conspiracy theories.
Not everyone saw the outage itself as a failure. Kyle Sandy, the cybersecurity director at IT security firm Logically, said taking the system offline is the right call when dealing with an attack. "It tells me the FEC detected something they couldn't immediately scope and chose a known outage over an unknown risk," Sandy said, giving the agency time to ensure none of its data was altered by the hackers before bringing it back online. In other words, a deliberate blackout may be far better than a compromised system quietly publishing altered filings.
The FEC cyberattack matters for three reasons, and none of them is about whether any individual vote was affected. The FEC does not play a role in administering US elections, and the outage should have no effect on voters' ability to cast ballots. The damage is to something else: the public's ability to know who is trying to influence those ballots.
First, disclosure delayed really can function as disclosure denied. A 24-hour report filed days late, after the ads it describes have already run and the votes they targeted have already been cast in early voting, is a historical record, not a warning. More than 40 million Americans had already voted early before this outage, according to the University of Florida Election Lab, so late-disclosed spending may already have done its work by the time it surfaces.
Second, the outage exposes how fragile the transparency infrastructure is. A single agency's filing system, taken offline by a single suspected breach attempt, was enough to blind the entire campaign finance watchdog community for nearly two days. Government networks are regularly targeted by hackers of all stripes for espionage, financial gain or political motives, as Reuters noted — and the FEC's system is a high-value target precisely because it holds the receipts for the country's political money.
Third, the information vacuum invites distrust. When an agency goes silent about a cyberattack days before an election, speculation fills the gap. The FEC's decision not to comment on Wednesday, and the referrals from CISA and the FBI back to the FEC, left the public with fragments — a "bad actor", a password reset, a 41-hour outage — and no authoritative account of what happened. In a campaign already saturated with claims about election integrity, that silence has a cost of its own.
The immediate question is what the delayed filings will show once they are fully processed and published. Campaign finance managers are now working through a backlog of 24- and 48-hour reports that could not be filed during the outage, and watchdogs will be combing those reports for large, late expenditures that landed while the system was dark. Any unusually large or unusually timed spending in that window will draw intense scrutiny.
The second question is what the FEC will disclose about the attack itself. The agency has so far said only that most affected services have been restored. Whether it will say what the attacker accessed, whether any filing data was altered, and what security changes it is making will determine whether confidence in the system is restored along with the system itself. Congressional oversight is a real possibility: the FEC answers to Congress, and lawmakers from both parties have an interest in knowing whether the disclosure system can be trusted in the final days of a campaign.
The third question is longer-term. If a suspected breach can take the disclosure system offline for 41 hours four days before a midterm election, the system needs redundancy and a public communication plan for the next incident. Watchdogs are likely to press for both: backup filing channels so that a single outage cannot blind the public again, and a commitment to prompt, detailed disclosure when the disclosure system itself is attacked. Voters head to the polls on Tuesday, November 3, with control of all 435 House seats and 35 Senate seats at stake — and with the money race behind those contests now partly visible only in hindsight.
The Federal Election Commission took its electronic filing system offline for nearly 41 hours to contain a cyberattack, restoring it on Wednesday night, October 28, 2026. An FEC officer told campaign compliance firms the services were taken offline after a "bad actor" tried to breach the agency's systems.
Yes, temporarily. Super PACs and other groups could not file mandatory 24- and 48-hour reports during the outage, so the most recent political spending was hidden from public view. Outside groups had been spending an average of more than $50 million per day in the week before the outage.
No. The FEC does not administer US elections, and the outage should have no effect on voters' ability to cast ballots. The impact is on transparency: the public's ability to see who is spending money to influence the election.
Campaign finance watchdog Molly White called it "pretty devastating this close to the election", OpenSecrets executive director Hilary Braseth said "disclosure delayed is disclosure denied", and cybersecurity expert Kyle Sandy said taking the system offline was the right call to ensure no data was altered.
Not yet. The FEC did not return requests for comment on Wednesday and did not announce details on the cause. The Cybersecurity and Infrastructure Security Agency and the FBI both referred questions to the FEC, and Reuters could not establish the motive for the hacking effort.
Related coverage: Early voting passes 40 million as midterm ballots surge before Nov. 3, Supreme Court midterms 2026: why the high court is on the ballot on Nov. 3 and Claude Georgia vote-data scandal: AI bypassed paywall to reach election counts.
Leave a Comment
| Today's Date:
