The Federal Election Commission (FEC) entered the midterm elections hollowed out: two commissioners remained on a six-seat body that requires four affirmative votes for major enforcement decisions. Then a cyberattack forced its electronic filing services offline for nearly 41 hours during early voting. [congress][reuters]
These are distinct failures requiring a public accounting: how the agency was left without a working quorum, and how officials handled an attack against its systems.
Only Shana Broussard and Dara Lindenbaum remained on the commission, both Democrats, leaving the FEC without any Republican representative. Party affiliation matters because the FEC’s structure is designed to prevent single-party control: no more than three commissioners may belong to one party, and major enforcement decisions require four affirmative votes. With only two commissioners from the same party, the agency lacked both a working quorum and the cross-party participation its decision-making structure is designed to require.[congress][fec]
President Donald Trump nominated Republicans Ashley Stow and Andrew Woodson on February 11, 2026. Confirming both would restore a working quorum. Their nominations remained stalled through the midterms, and on November 5, twelve former Republican commissioners urged Senate Majority Leader John Thune to act.[ashurstperkinscoie][washingtonsun]
The Senator is asked to answer for the stalled confirmations. Congress must also account for its oversight and funding decisions. Vacancies restrict enforcement authority, but they do not identify who directed the technical response to the cyberattack.
Last week at around 10 p.m. Eastern on October 26, the FEC took its electronic filing services offline. An electronic filing officer notified campaign-compliance firms by email: “We have a bad actor attempting to breach FEC systems.” Reuters quoted portions of the message rather than publishing the complete email. Services returned after nearly 41 hours during early voting.[reuters][unusualwhales]
Restoring service answered whether users could file again. It did not provide the public with a forensic account of the attack or the evidence supporting containment.
The shutdown’s duration and the attacker’s timeline are separate questions. When did the activity begin? When did responders detect it? What access did the attacker gain, and what happened before the affected services were secured?
The FEC must lead with verification documents. That public accounting should come before states move toward certifying their midterm election results. This is a demand for timely transparency, not a finding that the filing-system attack affected vote counts.
The agency had already received warnings about its technology. Its December 2025 inspector-general report described security controls that were working as intended but remained insufficient to reduce breach risks to an acceptable level. Legacy systems prevented prompt patching of known vulnerabilities, while budget and resource constraints limited remediation. Employees reported fears of critical-system outages during campaign-finance filing deadlines.[fec]
The FEC and congressional overseers must account for those warnings: which recommendations were completed, which remained open, who accepted the remaining risks, and what resources were requested or denied. The record should include completed modernization work as well as unresolved deficiencies.
The response requires equally specific scrutiny, beginning with the email.
CISA’s federal incident-response playbook recommends notifying users of compromised systems by phone rather than email and warns against “tipping off” an attacker about defensive activity.[cisa]
Who authorized email as the method of contact? Was the channel assessed as secure? Could the message have exposed detection or response activity? The FEC should release the complete notification, with necessary security redactions, and explain that decision.
The agency must also explain precisely what “shutdown” meant. Blocking public access, isolating a server, stopping an application, rebooting equipment, and cutting power are different actions. Saying services were taken offline does not identify which steps responders took.
Those distinctions matter for evidence preservation. CISA’s playbook addresses forensic collection, including disk and active-memory imaging. Its separate ransomware guidance warns that powering down equipment can eliminate potential evidence held in volatile memory.[cisa][cisa]
The FEC should produce a time-stamped response record identifying the systems isolated, any machines rebooted or powered off, the evidence captured beforehand, and the officials authorizing those actions. Any missing evidence must be identified, together with its effect on the investigation.
Who approved restoring service, and on what findings?
That decision should be supported by documented testing and an assessment of exposed accounts, credentials, connected services, and any persistent access. The public needs the basis for the conclusion—not operational details that would create another vulnerability.
Investigators must trace the attack’s actual reach. Questions about connections to state election infrastructure require system architecture, access records, and forensic evidence. The accounting must identify which connections existed, which were examined, what investigators found, and whether any findings required notification to state authorities. Neither an assumed connection nor a blanket assurance can substitute for that work.
Congress must examine the vacancies, funding decisions, and unresolved warnings. Agency leadership must identify who directed the response. Independent oversight must assess containment and evidence preservation.
The final accounting must distinguish verified findings from unresolved questions and explain investigative limits. Security redactions should protect systems, not conceal responsibility.
