The U.S. Federal Election Commission (FEC) took multiple electronic filing systems offline after detecting an attempted cyberattack, disrupting campaign finance disclosures, according to a Reuters report.

The outage began around 10 p.m. ET on October 26, one week before the November 3 midterm elections. Several systems remained offline on October 28, including filing-search functions, campaign finance report validation tools and other data feeds.

The FEC said a “bad actor” was attempting to breach its systems, prompting it to shut down web-facing services. By Tuesday evening, the agency said it had identified the issue and was implementing a fix, according to Reuters.

The FEC does not administer elections or operate voting systems, so the incident does not affect people’s ability to cast ballots. But it prevents political organizations from submitting mandatory 24-hour and 48-hour reports detailing campaign spending, limiting timely public disclosure during the final days of the election.

A cybersecurity expert told Nextgov/FCW that restoring service must be balanced against preserving the integrity of the data.

System Availability Is Part of Data Governance

The incident highlights a concern for chief data officers (CDOs): protecting data is only part of the job. Organizations also need to ensure that important information remains available, accurate and recoverable when systems go down.

For the FEC, the affected information serves a public-disclosure function. A prolonged outage can create a gap between when campaign spending occurs, when organizations report it and when the public can access the records.

This makes business continuity, backup processes and recovery procedures important parts of data governance. Data leaders need to know which systems hold authoritative records, how those records are protected during an outage and how they can be restored without compromising their integrity.

The incident also shows why governance plans should account for the operational dependencies around critical data systems, rather than treating cybersecurity and data availability as separate concerns.