Hackers Knocked the FEC’s Filing System Offline for 41 Hours Before the Midterms

For almost two days this week, nobody could tell American voters who was paying for the final push of the most expensive midterm campaign in U.S. history. The Federal Election Commission pulled its electronic filing system offline late Monday after what one of its own officers called a “bad actor” trying to break in, and it stayed dark for nearly 41 hours, Reuters reports.

The system came back Wednesday. The FEC still hasn’t said who was behind it, whether anyone got in, or whether any data was touched. With Election Day on Nov. 3, that silence is now its own story.

What happened

The filing system went down around 10 p.m. Eastern on Monday, Oct. 26. That night, an FEC electronic filings officer emailed several campaign compliance firms: “We have a bad actor attempting to breach FEC systems. As a result, we’ve had to temporarily shut down our web facing services,” according to the email reviewed by Reuters.

The agency’s only public statement was blander: “At this time, the FEC’s electronic filing system is currently offline and our IT staff are actively working to restore service.” Previously filed reports stayed searchable on FEC.gov. On Tuesday night the agency said it had identified the issue and was implementing a fix, CNBC reported, but filing was still down Wednesday morning.

Reuters says the system was restored Wednesday after nearly 41 hours offline and that the FEC told users most affected services were back. Campaign finance managers had to reset their passwords before logging in again, according to an email Reuters reviewed. The FEC’s alert service for new filings, FEC Notify, was also offline during the outage, a spokesperson confirmed, as summarized by Tech Times.

Politico first reported that hackers had attempted to access the national campaign finance systems. The FBI and the Cybersecurity and Infrastructure Security Agency both referred questions to the FEC, which has not announced a cause.

Why 41 hours matters this week

The FEC doesn’t run elections or count votes, and nothing here affects anyone’s ability to cast a ballot. What it does run is the disclosure system that tells the public who is spending money to win those votes, and the outage hit at the worst possible moment for that job.

In the last stretch before a general election, the reporting clock speeds up. Outside groups that make independent expenditures of $1,000 or more must report them within 24 hours, and candidate committees must report contributions or loans of $1,000 or more within 48 hours. Those rules exist so voters can see late money while it can still shape their decision. For this election, the 24-hour window runs from Oct. 15 through Nov. 1, according to compliance firm {A(‘MultiState’,MS)}.

The money moving through that window is enormous:

• Political ad spending and reservations for the 2026 cycle hit a record $11.21 billion as of Monday night, according to AdImpact, cited by CNBC.
• Super PACs and dark-money groups averaged more than $50 million a day in the week before the outage, OpenSecrets research director Brendan Glavin told Reuters. More than $250 million was reported on Oct. 20 alone.
• Outside groups reported nearly $610 million in independent expenditures for communications disseminated from Oct. 20 through Oct. 26, about $87 million a day, by CNBC‘s count.

“I’ve never seen this in 26 years,” Steven Mele, CEO of compliance firm MBA Consulting Group, told Reuters. Campaign finance tracker Molly White, who follows crypto and Big Tech political money, was blunter: “It’s pretty devastating this close to the election.”

OpenSecrets executive director Hilary Braseth put it in one line before service returned: “Disclosure delayed is disclosure denied.”

The penalty pass

Filers weren’t punished for the blackout. The FEC can’t move statutory deadlines, but an automated email obtained by Politico said the agency would not fine committees for reports missed during the outage, as long as they file within 24 hours after the system comes back, according to Tech Times and MultiState.

That’s fair to compliance staff who were locked out. It also means a pile of late-October reports landed in a burst once the gates reopened, giving reporters and watchdogs less time to examine them before polls close.

The weak agency problem

The outage hit an agency that was already barely functioning. The FEC is supposed to have six commissioners. CNBC reports it has had only two since October 2025 and has lacked the four votes needed to take official action since May 2025. Career staff keep the disclosure machinery running, but nobody at the top can open an enforcement case.

That matters for what happens next. MultiState notes that enforcement for anything hidden in the gap is unlikely, because the commission lacks a quorum and because spotting undisclosed spending after the fact is hard.

Skeptic’s corner: what we don’t know

This story is full of confident claims resting on very little. Here’s what is actually established, and what isn’t.

• Established: the filing system was offline for nearly 41 hours, an FEC officer blamed an attempted breach in an email to filers, and passwords had to be reset.
• Not established: that anyone got in. The FEC has not publicly confirmed an intrusion, and it has not said whether data was read, changed or stolen.
• Not established: who did it or why. Reuters says it could not determine a motive.
• Not established at all: the AI angle. One compliance firm’s blog ran the headline “AI Bots Allegedly Hack FEC Servers” and said speculation was growing that AI bots carried out the attack. We found no public evidence for that from the FEC, law enforcement or any security firm.

Conspiracy theories spread fast in the compliance world, Reuters reports. Molly White noted that an outage like this would be a good way for unscrupulous actors to hide unpopular last-minute spending, then added: “It’s hard to say with any real information that that’s what happened, but it’s certainly I think where people’s minds go very quickly.”

Some security people say pulling the plug was correct. “It tells me the FEC detected something they couldn’t immediately scope and chose a known outage over an unknown risk,” Kyle Sandy, cybersecurity director at IT security firm Logically, told Reuters.

Our read: shutting down a public-facing system you can’t vouch for is good incident response. Saying almost nothing about it for days, a week before a national election, is bad public communication. When the information vacuum is filled by guesses about donors gaming the outage or AI bots storming the servers, the agency’s silence does more damage to trust than a short, factual statement would have.

What it means

Campaign finance disclosure is one of the few parts of election infrastructure that runs on a single federal website, and this week showed how fragile that is. You don’t need to steal data or change a vote count to distort an election’s information environment. Knocking the disclosure pipe offline at the right moment, even briefly, buys anyone spending late money a quieter news cycle. TechRadar points out that this cycle includes heavy super PAC spending for and against candidates based on their stance on AI, so the tech industry has a direct stake in what voters can see.

The catch: there’s no evidence that anyone planned the outage for that effect, and the blocked reports were delayed, not erased: filers still have to submit them, and the penalty pass only covers those who file promptly after the restoration. The bigger risk is a repeat closer to Election Day, when a two-day delay would push disclosures past the vote.

What to watch next

• An FEC statement on cause. Whether the agency confirms an intrusion, names the attack type or says whether any data was altered.
• The late-filing flood. Watch for large independent expenditures dated Oct. 26 to 28 that surfaced only after the restoration.
• Another outage before Nov. 3. The 24-hour reporting window runs through Nov. 1.
• Congressional questions. A hacking attempt on a federal election agency with no quorum is an easy target for oversight letters after the vote.

The takeaway

Someone tried to break into the FEC a week before the midterms, and the agency’s answer was to switch off the public’s view of late campaign money for 41 hours. It’s back, nobody has shown that anything was stolen, and filers got a pass. What’s still missing is the most basic disclosure of all: the FEC telling the public what happened to its own systems.

Hype in. Signal out.

Image: The Federal Election Commission building in Washington, D.C. Photo by Ajay Suresh / Wikimedia Commons, CC BY 4.0; cropped to 16:9.