BREAKING EXCLUSIVE: FEC Gets Hacked, Goes Dark for 41 Hours During Early Voting with No Proof of Containment
On October 27, 2026, Reuters reported that the Federal Election Commission had taken its electronic campaign-finance filing system offline following an attempted cyber intrusion. The report quoted an email from an unnamed FEC electronic-filings officer—but did not publish the full email.[today.westlaw][hawaiitribune-herald]
The public needs the full email, not selected portions.
The shutdown began late October 26, during early voting. Reuters subsequently reported that service returned October 28 after nearly 41 hours, interrupting new disclosures of last-minute political spending before the November 3 election.[world.newsx][news18]
The email contained this warning:
“We have a bad actor attempting to breach FEC systems. As a result, we’ve had to temporarily shut down our web facing services.”[hawaiitribune-herald]
Who wrote it? Who authorized the shutdown? What evidence supported the warning?
Reuters did not identify who supplied the email. Its published coverage did not reproduce the complete message, headers, attachments, or recipient list. Whether it was leaked without authorization remains unknown.[today.westlaw][hawaiitribune-herald]
Reuters should publish the full email it reviewed. The FEC should release its authenticated original and the records explaining its response.
The agency’s listed acting chair, Shana Broussard, and its other listed serving commissioner, Dara Lindenbaum, are Democrats. The reporting reviewed does not establish when they were notified relative to outside campaign-compliance firms.[fec][fec][kentucky]
That notification timeline requires disclosure. Were agency leaders informed before outside firms? Were the FBI, the Cybersecurity and Infrastructure Security Agency, the Department of Homeland Security, or the White House notified? Was the President briefed? Which reporting requirements applied, and were they followed?
Reuters also quoted Steven Mele, president and CEO of MBA Consulting Group, about the outage’s consequences. He said he had never seen such a disruption in 26 years and warned of reduced election disclosure until service returned.[news18]
MBA provides campaign-finance compliance services. Reported clients have included Warnock for Georgia, Val Demings for U.S. Senate, Mandela Barnes for Wisconsin, Katie Porter for Congress, Catherine Cortez Masto for Senate, and Priorities USA Action. These examples come from a published client compilation, not a verified current roster.[influencewatch]
Why did Reuters select Mele, and did it sufficiently explain those relationships? Did it seek Republican compliance professionals and independent cybersecurity specialists?
His comments concerned financial disclosure—not a technical assessment of the intrusion. They cannot substitute for an official explanation of what happened. The reporting does not establish whether Mele supplied the email.[today.westlaw][news18]
The phrase “web facing services” also requires scrutiny. It describes services accessible through the internet, not every system connected behind them.
A building’s front door can be locked while an intruder remains inside. Taking a public website offline is not the same as clearing every room, checking every connecting hallway, and confirming that no other entrance remains open. The question is not which agency occupies which office. It is where an intruder could go, whether anyone got inside, and what evidence shows that access was stopped.
Federal incident-response guidance calls for isolating affected systems, revoking compromised access, and checking for ways an attacker could remain inside. If an attacker already had another foothold, unauthorized activity could continue during an outage unless containment was effective.[cisa]
CISA has also documented vulnerabilities in particular voting devices involving election-management systems or files modified before being loaded onto equipment. Reaching equipment through such a route requires specific access and vulnerabilities; it does not follow automatically from compromising a website.[cisa]
The affected FEC services handled campaign-finance filings, not ballot counting. That identifies their function—not every possible technical connection. Whether any route to election equipment existed requires evidence, not assumptions in either direction.[fec][govexec]
The public needs to know whether containment was effective—and exactly when it was achieved during the nearly 41-hour outage. What remained connected? Was unauthorized activity detected after the shutdown began? How much time elapsed between the first detected activity, the shutdown, and verified containment?
Accountability requires a public technical report documenting that timeline and the evidence supporting it. Where is that report?
Announcing that the system is back online answers a question about availability—not whether unauthorized access occurred, when it ended, or what investigators verified before restoring service.
A Freedom of Information Act request has been submit to the FEC seeking the full email, recipient list, notification records, shutdown authorizations, interagency communications, and existing technical assessments. It has not yet been filed.
