Threat reportThreat IntelligenceTL-2026-4618
Attempted Breach of U.S. Federal Election Commission Forces Shutdown of Electronic Filing System Days Before Midterms
Attempted Breach of U.S. Federal Election Commission Forces (TL-2026-4618), also tracked as FEC e-filing outage, is a high-severity tracked intrusion set, first published 2026-10-28. It has no confirmed attribution, affects U.S. Federal Election Commission FEC electronic filing system /, maps to 3 MITRE ATT&CK techniques (T1110, T1190, T1595), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-4618
- Threat ID
- TL-2026-4618
- Also known as
- FEC e-filing outage, FECfile+ shutdown
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, election-infrastructure, political-campaigns
- Target regions
- North America, united states of america
- Detection rules
- 9
- Indicators of compromise
- 9
How Attempted Breach of U.S. Federal Election Commission Forces works
A 'bad actor attempting to breach FEC systems' caused the U.S. Federal Election Commission to take its web-facing services offline, including the electronic filing system and FECfile+, blocking 24-hour and 48-hour campaign spending reports days before the November 3, 2026 midterms. Attacker, entry method and any software flaw have not been publicly identified.
Starting at roughly 10 p.m. ET on October 26, 2026 (0200 GMT October 27), the FEC's electronic filing system became unavailable. The FEC status page logged an investigation at 10:15 p.m. ET. An FEC electronic filings officer told campaign compliance firms in an email: "We have a bad actor attempting to breach FEC systems. As a result, we've had to temporarily shut down our web-facing services." The outage prevented committees, super PACs and other filers from submitting mandatory 24-hour and 48-hour independent-expenditure/spending reports during the final week before the November 3 midterm elections, a period in which spending is at record levels (AdImpact: about $11.21 billion for the cycle; more than $250 million reported on October 20 alone).
Reporting characterizes the shutdown as a defensive containment measure by the FEC rather than a confirmed successful intrusion. No source reports data theft, ransomware, malware, persistent access, or defacement. Previously filed reports remained searchable by the public throughout the outage. The FEC later stated that its IT staff were working to restore service, and on October 27 at about 8:17 p.m. ET officials announced the issue had been identified and fixes were being implemented; as of source publication, restoration was not confirmed complete.
The attacker's identity, location, motivation, entry method, and whether the activity was an intrusion attempt, denial-of-service, or other abuse are NOT stated in any source. CISA and the FBI referred questions to the FEC and made no attribution. No CVE has been associated. Compliance consultant Steven Mele (MBA Consulting Group) said he had never seen anything like it in 26 years. Because no technical details are public, the MITRE mapping in this record is a low-confidence, analyst-inferred hypothesis for an attempted breach of web-facing services and should not be treated as sourced TTP evidence. Severity is analyst-assigned (not source-provided) and no CVSS score applies.
MITRE ATT&CK techniques used in TL-2026-4618
Credential Access
Initial Access
T1190 Exploit Public-Facing Application
Reconnaissance
Affected products and versions in Attempted Breach of U.S. Federal Election Commission Forces
- U.S. Federal Election Commission — FEC electronic filing system / FECfile+ web-facing services
Remediation for Attempted Breach of U.S. Federal Election Commission Forces
Immediate actions
- Filers: monitor the FEC status page and FEC announcements for restoration of electronic filing and any deadline guidance for 24-hour and 48-hour reports
- Filers: retain proof of attempted timely submission and preserve filing-ready files until the system returns
- Filers: treat unsolicited emails claiming to be FEC outage or re-filing instructions as suspect phishing and verify via fec.gov
- Operators of election-related web services: review WAF, rate-limiting and authentication logs for anomalous activity against externally facing portals
Workarounds
- No technical workaround; filers must wait for FEC restoration and follow FEC guidance
Longer-term hardening
- Maintain tested runbooks for defensive shutdown and staged restoration of election-related public-facing services
- Provide alternative filing channels or documented contingency procedures for time-critical disclosures
- Coordinate with CISA election-infrastructure security resources and share indicators once available
Timeline of Attempted Breach of U.S. Federal Election Commission Forces
- More than $250 million in campaign spending was reported in a single day, illustrating the volume of disclosures flowing through FEC systems in the final stretch of the record-spending 2026 midterm cycle.
- An FEC electronic filings officer emailed campaign compliance firms: 'We have a bad actor attempting to breach FEC systems. As a result, we've had to temporarily shut down our web-facing services.'
- At roughly 10 p.m. ET (0200 GMT October 27) the FEC electronic filing system became unavailable; the FEC status page logged an investigation at 10:15 p.m. ET.
- At about 8:17 p.m. ET FEC officials announced the issue had been identified and fixes were being implemented; no confirmed restoration time or entry method was published.
- Reuters and other outlets reported the outage; 24-hour and 48-hour spending reports could not be filed, while previously filed reports stayed searchable. CISA deferred to the FEC and the FBI did not comment.
- Cyber Security News and other outlets published follow-ups noting that attacker identity, location and entry method remain unidentified and that no data theft has been reported.
- Scheduled U.S. midterm election day; the outage affected the final-week campaign finance disclosure window leading up to it.
Sources cited for Attempted Breach of U.S. Federal Election Commission Forces
- Hackers Target U.S. Election Commission, Forcing Online System Shutdown Days Before Midterms
- Exclusive-Hackers Target US FEC System, Disrupting Campaign Finance Disclosures Days Before Midterms (Reuters via U.S. News)
- Exclusive-Hackers target US FEC system, disrupting campaign finance disclosures days before midterms (Yahoo News)
- Hackers target US FEC system, disrupting campaign finance disclosures days before midterms (Rappler)
- FEC hit by cyberattack ahead of US midterms, electronic filing system down (DotDotNews)
- Hackers Knocked U.S. Federal Election Commission Filing System Offline Before November 3 Elections: how 10 outlets framed it (Newscord)
- FEC Latest Updates (official agency updates page)
Detection coverage for TL-2026-4618
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4618 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.