Senate neglect left the FEC too weak to stop a hacker's blackout

By Nikhil Raghavan · Reporting from San Francisco · October 28, 2026

Hackers disabled the FEC filing system a week before the midterms, blinding the public to record spending and exposing a hollowed-out agency that can no longer function.

The Senate is responsible for the current blindness of the American electorate. By stalling the confirmation of two Republican nominees, lawmakers have left the Federal Election Commission (FEC) as a ghost ship. This is not a story about a clever hack. It is a story about an agency that is sellable as a regulator on paper but is not shippable in reality. When a "bad actor" decided to breach the system on Monday night, the FEC had no leadership and a depleted workforce to lean on. The result is a total blackout of campaign finance disclosures at the exact moment they matter most.

The mechanism of a blind spot

To understand why this outage is catastrophic, you have to look at the spec for campaign disclosure. Before an election, House and Senate candidates must report contributions or loans within 48 hours. Political committees must report spending of $1,000 or more within 24 hours. These are the only tools the public has to see who is buying influence in real time.

NBC News reports that hackers targeted the electronic filing system around 10 p.m. ET Monday. The FEC’s electronic filings officer confirmed the agency had to shut down web-facing services to stop the breach. While the public search site remained active, the intake valve was closed.

The timing is a precision strike. According to AdImpact, these midterms are the most expensive in U.S. history. Roughly $11.21 billion has been spent on advertising and future reservations. Brendan Glavin of OpenSecrets notes that average spending this last week exceeded $50 million per day. More than $250 million in spending was reported.

When the filing system goes dark, that money becomes invisible. The mechanism of transparency is not a website; it is the mandatory, timely ingestion of data. By killing the filing system, the hackers didn't just crash a site. They paused the law.

A ghost ship in the storm

The technical failure is a symptom of a deeper administrative rot. The FEC is currently incapable of official action. The commission has lacked the four members required for a quorum. Only two commissioners, both Democrats, have been in place. President Donald Trump nominated Republicans in February, but the Senate has not confirmed them.

Without a quorum, the FEC cannot vote on audits, regulations, or enforcement matters. It cannot issue the very advisory opinions that compliance officers need when a system failure makes statutory deadlines impossible to meet.

The human cost is just as stark. An inspector general report found the full-time workforce fell to 293 employees. That is a decline of approximately 19 percent. This is the crew that gets paged at three in the morning when the system fails. They are tasked with managing a record-shattering cycle with a skeleton staff.

The strongest case for the agency is that shutting down the system was the only responsible way to contain the breach. A security professional would agree that you kill the connection to stop the bleed. But the failure is that the FEC has no redundancy. It has no capacity to maintain a "read-only" or "limited-intake" mode during a national crisis. This is the same systemic failure seen in the SolarWinds data breach of 2020, where a lack of infrastructure resilience turned a breach into a catastrophe.

The pattern of fragile systems

This outage shares a mechanism with the SolarWinds supply chain attack. In both cases, a critical system was disabled by a bad actor to disrupt a specific operational window. Both events exposed the fragility of under-resourced IT infrastructure during high-stakes periods.

We have seen this pattern before. The 2021 Colonial Pipeline ransomware attack showed how disabling a single reporting and billing system could paralyze an entire operation during peak demand. The FEC is now the Colonial Pipeline of democracy. The "billing system" here is the disclosure of super PAC money.

The Washington Post reports that the FEC's IT staff is "actively working to restore service." But "working to restore" is not a strategy. It is a reaction. In a functioning agency, there would be a documented disaster recovery plan for this exact scenario. There would be a clear path for manual filings that does not rely on a shrunken career workforce trying to play catch-up.

The Senate's refusal to fill the commission's seats is not a political stalemate; it is a dereliction of duty. They have left the agency without a head while the body is under attack.

The FEC is now a regulator that cannot regulate and a disclosure office that cannot disclose. The agency will likely fail to publish a verified accounting of final super PAC expenditures before the year ends. Manual backlogs will overwhelm the 293 remaining employees. Because the Senate chose political purity over a functioning quorum, the public will go to the polls without knowing who paid for the ads on their screens.

Senate neglect left the FEC too weak to stop a hacker's blackout

The mechanism of a blind spot

A ghost ship in the storm

The pattern of fragile systems

Sources