However, this outage will disrupt organizations’ abilities to file 24-hour and 48-hour spending reports, which show how much is spent by political groups and others on particular races. This past week, Super PACs and dark money groups spent an average of more than $50 million each day, meaning the disruption in reporting could leave voters without significant spending information until systems are back on. 

Why This Doesn’t End with Restoring the Website

Ross Filipek, CISO at Corsica Technologies, comments, “Getting the website back up won’t settle every question. Before restoring filing services, responders need to establish whether anyone gained unauthorized access. Any affected records need to be checked for changes. Campaigns need clear guidance on handling time-sensitive disclosures during the outage. Reopening without those answers could turn a service interruption into a much harder recovery problem.

“There’s a national confidence issue here, too. The FEC handles campaign finance disclosure rather than voting or ballot counting. Officials should make that distinction explicit in every update. An information vacuum is a lousy incident spokesperson. People need a plain explanation of what’s affected and when they’ll hear more, even while the investigation continues.

“The standard for recovery has to go beyond a working webpage. It should include evidence that restored services are trustworthy enough to support public scrutiny during the final days before an election.”

The Importance of Threat-Informed Perspective on Critical Assets

Jon Baker, VP of Threat-Informed Defense at AttackIQ, explains, “An attacker doesn’t need to steal a single file to do damage. Disrupting campaign finance filings a week before an election denies the public timely visibility into the money shaping those races, and the disclosure window those 24-hour and 48-hour reports cover doesn't come back once it passes.

“We don’t yet know how far these attempts reached, how the attacker got in, or whether the shutdown was precautionary. Assigning a motive would be premature. What the incident does show is that a public-facing system’s importance can rise sharply as a deadline approaches.

“This is why a threat-informed perspective on critical assets matters. Identify the systems that carry the most weight in a given window, then ask how a malicious actor would operate against them: what they would target, how they would get in, and what they would disrupt. That picture changes with time and events. A filing system that is routine in July becomes a high-value target the week before an election, and the actors interested in it change too. Agencies that revisit those questions as the calendar and the threat landscape shift have a response ready for the week the service matters most.”

Election Security Shouldn’t Start and End with Voting Machines 

Gabrielle Hempel, Security Operations Strategist at Exabeam, states, “When we talk about election security, the conversation tends to start and end with voting machines. But the systems that support transparency matter as well. This is a good reminder that we need to be precise when we talk about election-related cyber incidents. This is not an attack on voting systems, and there’s no indication in the reporting that it affects anyone’s ability to vote. However, the disruption to campaign finance reporting can limit timely public visibility into election spending.

“The question we should all keep asking is what happens when a critical public-facing system becomes unavailable at the worst possible time? What is the backup process, how are filings received and disclosed while the system is down? How quickly can the agency restore service without sacrificing the integrity of the data? Disruptions like these can have a massive impact on public trust without ever actually touching a ballot.”