Deadline Passes on Notifying Congress After Crippling FEC Cyberattack. What Really Occurred?

The Federal Election Commission handles more than campaign-finance disclosures. It also obtains official, certified vote totals from state election offices and publishes federal election-result compilations. Its information responsibilities encompass both political-finance records and the public record of election outcomes.[fec][fec]

That is why the attempted intrusion during early voting demands an urgent, documented accounting.

The FEC’s electronic filing system remained offline for nearly 41 hours following the detected threat. The public reporting did not establish the incident’s full reach or demonstrate whether systems supporting election-result publications were isolated from the affected systems.[reuters][politico]

The agency holds election-related information. The unanswered question is what the attacker could reach.

This is not merely an internal cybersecurity matter. It concerns public accountability at a federal election agency during early voting in a midterm election.

By October 26, an FEC official was warning campaign-compliance firms that a “bad actor” was attempting to breach agency systems. That warning subsequently became public. The public deserves a complete account of what followed.[unionleader]

Congress should demand the incident records, the notification timeline, and an explanation of how the agency fulfilled its reporting obligations. CISA should explain what role it played.

Federal guidance requires an agency to notify the appropriate congressional committees within seven days after it has a reasonable basis to conclude that a major incident occurred. The public deserves records showing how the FEC applied that requirement—not an unexplained gap in the timeline.[cisa]

Was Congress notified? When was the notice sent? Who received it?

The reporting review does not establish whether the required notification occurred. That uncertainty should end with dated records, not competing assurances.

An FEC electronic-filings official described a “bad actor” attempting to breach agency systems. POLITICO reported an ongoing internal investigation and quoted an unnamed source describing the attempted intrusion as “narrow and compartmentalized.” Its reporting did not identify the investigation’s leader or establish who independently verified that assessment.[politico][reuters]

Who investigated? Who supervised? Who reviewed the evidence?

An anonymous description is not a public accounting. Restoring a filing service does not establish the boundaries of an attempted intrusion.

The inspector general had already documented security concerns. Its fiscal year 2026 management-challenges report described controls insufficient to reduce potential breach risks to an acceptable level. Legacy systems impeded prompt patching of known vulnerabilities. Funding and staffing constraints compounded the problem.[fec]

Those findings documented weaknesses in the agency’s security controls before the attempted intrusion during midterm early voting. They make it essential to establish whether those weaknesses provided a pathway into FEC systems, what the attacker could reach, and whether election-related records were exposed.

Make the communications accessible. Release the notification timeline and documented findings. Explain who acted, when they acted, and what investigators established so the public can understand exactly what happened.

Restore the FEC’s bipartisan decision-making capacity now.

Congress designed a six-member commission with no more than three commissioners from the same political party. Four affirmative votes for consequential actions prevent one party’s commissioners from acting alone. The FEC expressly identifies nonpartisan decision-making as the purpose of this structure.[fec]

That safeguard reaches beyond enforcement. It applies to consequential decisions involving regulations, advisory opinions, audit matters, and other commission business. Losing bipartisan representation also restricts certain administrative actions.[fec][fec]

During a contested election, this protection is not a technicality. It is central to public confidence.

For the people, the combination demands constitutional accountability: an attempted intrusion during early voting, unanswered questions about oversight, and an agency without its intended bipartisan decision-making capacity.

The president should advance qualified nominees immediately. The Senate should promptly consider their confirmation. Commissioners are appointed by the president and confirmed by the Senate. The House should press publicly for restoration and exercise its oversight responsibilities.[fec]

Each institution has a role. None should pass responsibility to another.

The relevant House and Senate committees should confirm whether they received notice and when. The president and Senate should state what they are doing to restore the commission and provide a public timetable.

The public deserves neither unsupported reassurance nor unsupported claims that votes were altered. It deserves evidence, functioning oversight, and lawful action.

Make the communications accessible.

Show the notice. Show the dates.

Restore the bipartisan FEC.

Formal Letter to Congress

November 8, 2026

Members of the United States Congress
United States Capitol
Washington, DC 20515

Subject: FEC Cyberattack—Congressional Notification and Public Accountability

Dear Members of Congress:

My name is Joe Hoft. I am an author, journalist, and contributor to The Gateway Pundit, with a professional background as an international corporate executive in audit and finance. My work has included overseeing financial reporting and participating in board, audit, and risk committee meetings around the world.[joehoft][thegatewaypundit]

That experience informs my insistence on documented findings, clear timelines, and identifiable responsibility. Public confidence requires evidence that can be examined—not assurances that cannot.

I write to request immediate congressional oversight of the reported attempted intrusion into Federal Election Commission systems during early voting in a midterm election and a public accounting of the federal government’s response.

The FEC’s responsibilities include campaign-finance disclosures and the publication of official federal election-result compilations. An attempted intrusion affecting this agency warrants clear answers about the systems involved, the information potentially exposed, and the measures investigators used to verify the integrity of agency records.

This is not merely an internal cybersecurity matter. It concerns public accountability at a federal election agency during early voting in a midterm election.

The distinction between information held by the agency and information an attacker actually reached is essential. The public should not be asked to accept unsupported reassurance or unsupported allegations. It needs documented findings.

By October 26, an FEC official was warning campaign-compliance firms that a “bad actor” was attempting to breach agency systems. That warning subsequently became public. Congress should obtain a complete, documented account of what followed.[unionleader]

Federal guidance requires notification to the appropriate congressional committees within seven days after an agency has a reasonable basis to conclude that a major incident occurred. Congress should establish how the FEC applied that requirement and release the notification records and timeline.[cisa]

I respectfully request that Congress obtain and make public:

The date the attempted intrusion was detected and a chronology of the agency’s response.
The agency’s assessment of the incident’s severity, the reporting requirements it applied, and the records supporting those conclusions.
Copies of any congressional and inspector-general notifications, their transmission dates, and confirmation of receipt.
Identification of the systems, accounts, and categories of records investigators determined were affected or potentially accessible.
Findings establishing whether systems supporting election-result publications were involved, accessible from affected systems, or isolated from them.
The identities and official responsibilities of those who directed, supervised, and independently reviewed the investigation.
The methods used to verify record integrity, the findings reached, and any material questions that remain unresolved.
An explanation of CISA’s role, including when it was notified and what assistance or oversight it provided.
Corrective actions completed or planned, the officials responsible for those actions, and a timetable for completion.

Restoration of a public-facing service, by itself, does not answer questions about the scope of an attempted intrusion. Congress should obtain evidence supporting the agency’s conclusions and distinguish preliminary assessments from independently verified findings.

Congress should also examine whether staffing, funding, legacy systems, or unresolved security deficiencies affected the agency’s ability to prevent, detect, investigate, or respond to this incident. Specifically, Congress should establish whether previously documented weaknesses provided a pathway into FEC systems, what the attacker could reach, and whether election-related records were exposed.

Any findings should identify specific corrective responsibilities rather than leave the public with general assurances.

Separately, I urge the president and Senate to take the actions necessary to ensure that the FEC has its intended bipartisan decision-making capacity. The House should exercise its oversight responsibilities and press for a public accounting of any vacancies or other limitations affecting commission operations.

Congress must act now. Obtain the incident records, establish what the attacker could access, verify the integrity of election-related information, and hold responsible officials accountable for the response. The public requires action, documented findings, and a clear timeline—not further assurances.

The public deserves accountability supported by records.

Please provide a written response addressing these requests, identify the committees responsible for oversight, and publish a timetable for releasing the findings.

Show the notice. Show the dates. Account for the response.

Sincerely,

Joe Hoft

The post Deadline Passes on Notifying Congress After Crippling FEC Cyberattack. What Really Occurred? appeared first on The Gateway Pundit.