Nov. 2 · Elections
FEC Hacked Days Before the Midterms. Who Did It, and What Did They Take?
The FEC told filers “some passwords were compromised” before it went down, and told the public nothing
Last 24 hours: upgrade to annual today and get a free hoodie, any one in the store. You pay only shipping and handling. Click this sentence to upgrade. - Chris
The question I started with is who had the Federal Election Commission’s passwords before the agency shut itself down on the night of Oct. 26, and who in the United States government is in a position to find out. I read the FEC’s notices to filers against the clock of the wire stories, the warnings that came in the two weeks before, the sworn record of what this administration’s people did the last two times they held federal data, and then I counted the offices that existed two years ago to investigate exactly this. As of tonight no government has named the attacker, ours or an ally’s, and the reason is the second half of this piece.
At 1:54 p.m. Eastern on Tuesday, Oct. 27, the FEC’s Electronic Filing Office wrote that the system was offline, that “you cannot submit electronic reports to the FEC,” and that the upload tools, the password assignment system, the FECNotify alert service and the webforms for the 24-hour and 48-hour notices that disclose last-minute money were all down. At 4:28 p.m. Wednesday it wrote that the system was back and that every filer must first create a new password: “This action is required because some passwords were compromised prior to the service disruption.”
Two hours later, at 6:38 p.m., Reuters, which had broken the story Tuesday with an FEC officer’s email about “a bad actor attempting to breach FEC systems,” reported that managers had to reset their passwords and that the FEC did not return requests for comment on the cause. The FBI and the Cybersecurity and Infrastructure Security Agency referred reporters’ questions to the FEC. CNBC wrote that the commission had not said whether anyone got in or whether any data was compromised. Nothing published since has printed the sentence above.
The Don’t Make Me Call Your Donors hoodie, free with a new annual membership, last 24 hours, any hoodie in the store, you pay shipping and handling. Click this caption to get your year and your hoodie. Already a paid member? Your half-off hoodie code is in Monday morning’s members-only email.
So two hours after the commission told every committee treasurer in the country, in writing, that passwords had been compromised, it told the reporters covering the story nothing, and the two agencies that exist to investigate attacks on federal systems sent those reporters back to it.
A filing password authenticates every report a committee submits. Only a committee’s treasurer or assistant treasurer can create one, and whoever holds it can file a 24-hour report in the committee’s name, amend one, or amend the Form 1 that lists the committee’s official email, which is the address the FEC’s own reset instructions route through. The FEC has not said how many passwords, whose, for how long, or whether a single filing was made with them.
Outside groups were reporting more than $50 million a day going into the outage, with more than $250 million reported on Oct. 20 alone, and Elon Musk’s America PAC by itself reported nearly $6.8 million for that one day. Steven Mele, who has run the compliance firm MBA Consulting Group for 26 years, told Reuters he had never seen the system go down like this. Ross Filipek, chief information security officer at Corsica Technologies, said what the order of operations should have been: “Before restoring filing services, responders need to establish whether anyone gained unauthorized access.” The FEC restored filing 22 minutes after telling filers their passwords were compromised, and has not said whether anyone did.
The warnings came in the two weeks before, from every direction. On Oct. 21 the FBI’s Cyber Division told every organization whose websites use PHP, the language behind roughly 70 percent of websites, that two flaws allowed remote code execution in PHP core and that any system that could not be patched at once should be taken offline. The same day the Election Security Exchange, which advises election officials, warned that the affected software ran voter registration lookup, polling-place lookup, ballot-tracking and election-night results sites. The same day the top Democrats on the House and Senate intelligence committees said a classified briefing showed Russia running a disinformation campaign against Democrats in these midterms. In April the head of U.S. Cyber Command and the National Security Agency told Congress to expect foreign adversaries to target these elections. In May, Senator Mark Warner, vice chairman of the Senate Intelligence Committee, wrote to Homeland Security Secretary Markwayne Mullin that he was “gravely concerned about the lack of critical federal support” to states before the midterms. In July 2025 the FEC’s own inspector general told the commission to fix its highest-rated vulnerabilities faster. And the intelligence community’s 2026 Annual Threat Assessment, the document that warned about Russian election operations every prior year, left election interference out entirely.
Then I counted what the administration dismantled that would have had agents, analysts, advisers or board members on this by now. Two years ago all of these existed:
CISA’s election security program: 17 election security staff put on leave in February 2025, all election security work paused for a review CISA has never released, and the 10 regional election security advisers pulled from the field
the Elections Infrastructure Information Sharing and Analysis Center, the threat-sharing network for every state and county election office, defunded in March 2025 because it “no longer supports Department priorities”
the FBI’s Foreign Influence Task Force, built after 2016 to investigate foreign operations against elections, dissolved by Attorney General Pam Bondi on Feb. 5, 2025, her first day in office
the Foreign Malign Influence Center at the Office of the Director of National Intelligence, which housed the Election Threats Executive, gutted by Tulsi Gabbard
the State Department’s counter-foreign-interference office, successor to the Global Engagement Center, shut down by Secretary of State Marco Rubio in April 2025
the Cyber Safety Review Board, the body that investigates major cyberattacks on the country, every member dismissed on Jan. 20, 2025, its investigation of China’s Salt Typhoon intrusions left open
the leadership of the NSA and Cyber Command, with Gen. Timothy Haugh fired in April 2025
CISA itself, about a third of its workforce gone by the end of 2025
Arizona Secretary of State Adrian Fontes, whose office ran that state’s 2024 election, said election officials were “effectively flying blind.” On Nov. 1 CNN reported that the channels for federal officials to warn election officials about foreign threats are at their weakest since 2016. So when a reporter asked the FBI and CISA about the FEC, the answer was to ask the FEC, which has two commissioners out of six, no quorum since May 2025, two nominees the Senate has not held a hearing on, and a backlog that doubled to 307 matters it cannot touch.
In two whistleblower reports, one to the Senate Intelligence Committee and one to the Office of Special Counsel, two federal officials described what the administration’s people did the last two times they held federal data. Daniel Berulis, a security architect at the National Labor Relations Board, told the Senate Intelligence Committee in April 2025 that DOGE engineers got accounts that could read, copy, alter or delete anything in the agency’s databases, and that within 15 minutes of one account’s creation someone at an IP address in Primorskiy Krai, Russia, began trying to log in with its correct username and password, more than 20 times. Charles Borges, the Social Security Administration’s chief data officer, disclosed in August 2025 that DOGE staff had a live copy of NUMIDENT, the master file of every Social Security number, in a cloud environment they administered themselves. The agency’s acting commissioner had sworn that DOGE never had access to its systems of record. On Jan. 16, 2026 the Justice Department filed a correction: DOGE staff had used a Cloudflare server unknown to SSA leadership, the agency could not determine which data left or whether it still exists outside federal control, and DOGE employees had signed a voter data agreement on March 24, 2025 with a group seeking to overturn election results in certain states.
An agency with only two commissioners lost its filing system for 41 hours in a week when outside groups report $50 million a day, told the committees it regulates that their passwords had been taken before the lights went out, restored filing 22 minutes later, and told the public nothing. Eight offices that would have had people on this by now were dismantled in 2025, and the two agencies left standing sent the reporters back to the victim. Whoever took the passwords picked a week when the referee for campaign money could not hold a meeting, in a year when the government that would investigate them had already fired the investigators. The question in the title stays open because the people who could close it are the people who made the opening.
The free hoodie for new annual members runs through Nov. 3, and the button is right under this sentence. - Chris
Buy the ER some coffee by clicking this sentence
CALL TO ACTION
Vote. If you vote in person, Tuesday, Nov. 3 is the day, and vote.gov has your state’s polling hours, locations, ID rules and what to bring. If you have a mail ballot, take it to a drop box or your county election office; a ballot mailed now may arrive after your state’s deadline.
Make sure your friends vote. Text the people you know who have not voted yet and ask whether they need a ride or the address of their polling place.
Make sure your vote was counted. Most states have a ballot tracker on their election website, and vote.gov links to yours. If your ballot shows as rejected or missing, your county election office can tell you how to fix it before the deadline.
If something goes wrong at the polls, the Election Protection hotline is 866-687-8683 (866-OUR-VOTE), run by the Lawyers’ Committee for Civil Rights Under Law, with lawyers on the line on Election Day.
The Existentialist Republic Library
Get the FREE PDF of the book ($0.00) in the BMAC shop by clicking this sentence.
Our websites
The Existentialist Republic - the news site: every article, all 34 calls to action and all 11 model bills written for state legislators
The ER - the campaign hub: we publish the reporting, then the campaigns that come out of it, seven running now
The Activist Cipher - a free guided path to being an effective activist: which official to ask, what to ask for, and what to do with the answer; no email address required
Gavel Grab - the legal news publication I own and edit
ChristopherArmitage.com - my work in one place
The ER Store - books, journals, stickers, shirts, hats, mugs and posters
Books
Conservatism: America’s Personality Disorder - physical copy / free download
The American Reformation: How States Can Use the Constitution to Break Authoritarian Capture - physical copy / free download
Intro to Soft Secession - physical copy / free download
Oppositional Federalism and You - physical copy / free download
Toppling Tyrants: A Field Guide to Dismantling American Fascism - physical copy / free download
Grab Them By The E.A.R.R.: How to Get Politicians to Do What You Want - physical copy / free download
Being Dangerous: Go From Activist to Operative - free download
WE REBEL: An Activist Journal - physical copy
More free downloads
Soft Secession: 100 Policies That Pass
Four Completed Model Legislation Bills (all 11 are on the site)
The Opposition Guide to Tax Warfare
Six-Panel Soft Secession Brochure