Midterm Early Voting Cyberattack: Questions Remain About Response and Investigation

The Federal Election Commission’s electronic filing system was shut down for nearly 41 hours following a reported cyberattack during early voting. The central question is not merely which campaign spending disclosures were delayed, but what the attacker reached or attempted to reach inside a federal agency’s systems. The FEC’s own warning was direct: ‘We have a bad actor attempting to breach FEC systems. As a result, we’ve had to temporarily shut down our web facing services.’ This warning came from an FEC electronic filings officer in an email reviewed by Reuters. The filing system was the service taken offline, but was the attempted intrusion confined to that service, or did it extend into servers, credentials, records, or connected systems? What have investigators established, and what remains unknown? This is about access, and the American people deserve answers. CISA, which operates under the Department of Homeland Security (DHS) and is led by U.S. Secretary of Homeland Security Markwayne Mullin, is central to the investigation. Yet the reporting reviewed here provides no substantive public briefing from Mullin explaining CISA’s involvement, the scope of the incident, or the evidence supporting containment. The Cybersecurity and Infrastructure Security Agency and the FBI both referred questions to the FEC. Americans got the political drama of ‘Russiagate’ and Stormy Daniels, both with documented campaign finance connections, while the proposed restructuring of the FEC never happened. The history makes it essential that Secretary Mullin come before the press and explain exactly where the investigation stands. Kyle Sandy, cybersecurity director at IT security firm Logically, offered this assessment to Reuters: ‘It tells me the FEC detected something they couldn’t immediately scope and chose a known outage over an unknown risk.’ That was an outside expert’s assessment, not an investigative finding. But it puts the central question squarely before Mullin: what did investigators establish about that unknown risk? The reported 41 hours measures the shutdown. It does not establish how long an attacker may have been present or whether unauthorized access occurred. Officials must explain whether the attempt succeeded and the evidence supporting their answer. Restoring service is not the same as demonstrating containment. Tell Americans when the suspicious activity began. State when CISA was notified. Explain whether the attacker accessed servers, accounts, credentials, or internal networks. Identify what information, if any, was viewed, copied, altered, or deleted. Explain whether connected systems were examined. Show the basis for restoring service. State which reports and congressional notifications were required. Confirm when they were submitted. Tell the public whether President Trump has been briefed and what risks remain unresolved. Where is the public incident account? If the investigation remains open, where is the status briefing? Neither party gets a pass. Congress should demand the incident timeline, relevant security assessments, and an explanation of unresolved vulnerabilities. A restored filing system is not a substitute for oversight. U.S. Secretary of Homeland Security Markwayne Mullin should stand before the press and explain his department’s response. President Trump should demand a direct briefing and an assessment of any national security implications before certification. If Mullin failed to escalate the incident, obtain answers, or fulfill his responsibilities, Trump should fire him.