A cyber incident at the Federal Election Commission has disrupted campaign finance filings a week before the US midterm elections, exposing how an attack on one organization can interrupt time-sensitive work for others that depend on its systems.
According to an exclusive report by Reuters, the FEC’s electronic filing system went offline on October 26, preventing political organizations from submitting reports that disclose spending in individual races.
An FEC electronic filings officer told campaign compliance firms that a “bad actor” was attempting to breach the agency’s systems, according to an email reviewed by the news agency.
The available reporting does not establish that the FEC’s systems were successfully breached, that data was compromised, or that any organization has suffered an insured loss.
The outage began at about 10 p.m. Eastern time on October 26, according to the FEC’s status page. By the evening of October 27, the agency said it had identified the issue and was implementing a fix. Its latest status update did not say that service had been restored.
The FEC said its staff were working to restore the electronic filing system. Users could still search its website for past reports, Reuters reported.
The disruption affects the 24-hour and 48-hour reports that political organizations use to disclose spending on specific races. Those filings are particularly significant in the final days before an election, when substantial sums can be spent in a short period.
Steven Mele, president and CEO of political finance compliance firm MBA Consulting Group, told Reuters he had never seen an outage like it in 26 years.
The FEC does not administer US elections, and the outage should not affect voters’ ability to cast ballots, Reuters reported.
The FEC disruption follows the disclosure of two critical vulnerabilities in PHP, a programming language used to run websites and web applications, including some election-related services.
The FBI warned on October 23 that the vulnerabilities could allow attackers to run malicious code remotely on affected systems, potentially compromising sensitive data and networks. Security updates have been released, and the FBI urged organizations to apply them immediately.
Read more: Critical PHP flaws put cyber policy waiting periods and security conditions in focus
While there is no evidence linking the FEC incident to the PHP vulnerabilities, the timing of the PHP disclosure nevertheless prompted concern among election security specialists.
In an advisory on October 21, the Election Security Exchange, which provides guidance to election officials, said affected software could be used in voter registration and polling-place lookup tools, ballot-tracking pages and election-night results websites. It urged officials to confirm with their technology providers that critical updates had been applied.
The FEC incident is a working example of a coverage question the PHP vulnerability piece raised last week: when a client cannot meet a regulatory filing deadline because a third-party government system is unavailable, does their policy respond?
For most standard cyber policies, the answer depends on whether dependent systems cover extends to government-operated infrastructure - and many wordings do not explicitly address it. Political organisations, campaign finance compliance firms and election technology vendors are all clients that brokers may serve, and the FEC outage demonstrates that their filing obligations do not pause because a third party’s system has failed.
The issue for brokers is whether clients whose regulatory deadlines depend on external systems have reviewed their dependent systems coverage recently, and whether their policy distinguishes between a commercial vendor failure and a government system failure. The FEC’s system may be restored before any insured loss is established - but the dependency is real and worth mapping before the next deadline.
