# Attempted Breach of U.S. Federal Election Commission Forces Shutdown of Electronic Filing System Days Before Midterms

> A 'bad actor attempting to breach FEC systems' caused the U.S. Federal Election Commission to take its web-facing services offline, including the electronic filing system and FECfile+, blocking 24-hour and 48-hour campaign spending reports days before the November 3, 2026 midterms. Attacker, entry method and any software flaw have not been publicly identified.

- **Published:** 2026-10-28T07:22:15Z
- **Last reviewed:** 2026-10-28T07:22:15Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4618
- **ID:** TL-2026-4618
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Starting at roughly 10 p.m. ET on October 26, 2026 (0200 GMT October 27), the FEC's electronic filing system became unavailable. The FEC status page logged an investigation at 10:15 p.m. ET. An FEC electronic filings officer told campaign compliance firms in an email: "We have a bad actor attempting to breach FEC systems. As a result, we've had to temporarily shut down our web-facing services." The outage prevented committees, super PACs and other filers from submitting mandatory 24-hour and 48-hour independent-expenditure/spending reports during the final week before the November 3 midterm elections, a period in which spending is at record levels (AdImpact: about $11.21 billion for the cycle; more than $250 million reported on October 20 alone).

Reporting characterizes the shutdown as a defensive containment measure by the FEC rather than a confirmed successful intrusion. No source reports data theft, ransomware, malware, persistent access, or defacement. Previously filed reports remained searchable by the public throughout the outage. The FEC later stated that its IT staff were working to restore service, and on October 27 at about 8:17 p.m. ET officials announced the issue had been identified and fixes were being implemented; as of source publication, restoration was not confirmed complete.

The attacker's identity, location, motivation, entry method, and whether the activity was an intrusion attempt, denial-of-service, or other abuse are NOT stated in any source. CISA and the FBI referred questions to the FEC and made no attribution. No CVE has been associated. Compliance consultant Steven Mele (MBA Consulting Group) said he had never seen anything like it in 26 years. Because no technical details are public, the MITRE mapping in this record is a low-confidence, analyst-inferred hypothesis for an attempted breach of web-facing services and should not be treated as sourced TTP evidence. Severity is analyst-assigned (not source-provided) and no CVSS score applies.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1110 Brute Force

## Sources

- [Hackers Target U.S. Election Commission, Forcing Online System Shutdown Days Before Midterms](https://cybersecuritynews.com/hackers-target-u-s-election-commission-forcing-online-system-shutdown/)
- [Exclusive-Hackers Target US FEC System, Disrupting Campaign Finance Disclosures Days Before Midterms (Reuters via U.S. News)](https://www.usnews.com/news/top-news/articles/2026-10-27/hacker-trying-to-breach-us-federal-election-commission-system-email-shows)
- [Exclusive-Hackers target US FEC system, disrupting campaign finance disclosures days before midterms (Yahoo News)](https://www.yahoo.com/news/articles/hacker-trying-breach-us-federal-184450728.html)
- [Hackers target US FEC system, disrupting campaign finance disclosures days before midterms (Rappler)](https://www.rappler.com/technology/federal-election-commission-hack-disrupt-campaign-finance-disclosures/)
- [FEC hit by cyberattack ahead of US midterms, electronic filing system down (DotDotNews)](https://english.dotdotnews.com/a/202610/28/AP6ae161d6e4b02fd1c5f5c61d.html)
- [Hackers Knocked U.S. Federal Election Commission Filing System Offline Before November 3 Elections: how 10 outlets framed it (Newscord)](https://newscord.org/article/hackers-knocked-us-federal-election-commission-filing-system-offline-before-nove--Story_20261027_HackersKnockedFederae140eab9)
- [FEC Latest Updates (official agency updates page)](https://www.fec.gov/updates/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4618