2026 Election Day Summary

On Election Day, Nov. 3, the Elections Infrastructure Information Sharing and Analysis Center® (EI-ISAC®) monitored cyber, physical, and disruptive threats and shared what it learned with election officials nationwide. Over 7,000 election officials were enrolled and able to participate in the Situation Room (SitRoom), a secure platform where election offices share information, report incidents, and stay informed during critical election periods.

Across the day, the EI-ISAC observed and received reports of limited threat activity at levels consistent with those expected during a general election. Most incidents were resolved quickly, and there were no major disruptions. State, county, and local officials were prepared: over the past year, they stayed aware of the threat environment and developed plans to address a number of likely threat scenarios.

Cyber Activity

Election offices reported three kinds of online activity. Counts below show how many states reported each type, and a single state may have seen the same activity more than once.

• Website probing. One office reported automated scanning of its public websites and failed attempts to break in. Picture someone walking a parking lot, trying every car door handle. The attempts did not succeed.
• Repeated password guessing. An agency associated with elections reported many login guesses from a single internet address. Other offices then checked their records and found harmful traffic from that same address going back to Oct. 19. All login attempts were unsuccessful.
• Website flooding. One office reported waves of automated visits aimed at its ballot drop box locations webpage. Another reported a similar surge on a different page. This tactic, called a Distributed Denial-of-Service (DDoS) attack, tries to jam a site so real visitors can’t get through, like a crowd blocking a store entrance. The office added a “prove you’re human” check (a CAPTCHA), and traffic dropped.

Separately, the Center for Internet Security® (CIS®) Security Operations Center (SOC) identified five incidents and escalated them to three election offices so their teams could investigate and respond.

Physical Threats

Reports of physical threats fell into five groups.

• Vandalism. Officials reported two incidents. Hateful graffiti appeared at a school used as a polling location, and campaign signs were cut up outside another polling place.
• Polling place disruptions. One person handed voters pre-filled “sample ballots.” Fire alarms pulled at another polling place paused voting for about 10 minutes.
• Suspicious packages. One suspicious package delivered to a candidate’s office prompted an evacuation.
• Bomb and shooting threats. Three bomb threats and two shooting threats targeted polling locations. Officials cleared two of the affected sites. At one school, courts allowed affected voters to cast provisional ballots (backup ballots that officials review before counting) until 9:15 p.m. local time. Separately, another bomb threat prompted street closures and a partial evacuation of one downtown area.
• Threats against candidates. Police in one state arrested a man accused of sending death threats to a judicial candidate.

Alerts to Law Enforcement and Public Safety Partners

CIS also shared emerging incident alerts with law enforcement and public safety partners. These included a suspected bomb threat at a polling place, a threatening fax sent to a state political party headquarters, and a potential social media threat to sabotage ballot boxes.

Those alerts gave partners timely awareness as voting unfolded and helped them assess and respond to possible risks to voters, election workers, and election infrastructure. The incidents reflect a broader threat environment, one where intimidation and online threats can disrupt election operations and undermine public confidence even when a threat isn’t credible or can’t be confirmed.

Foreign Information Operations

No foreign adversary information operations were reported, and analysts were not tracking any ongoing activity. An information operation is an effort by a foreign government or group to spread false or misleading messages to sway public opinion.

Everyday Election Challenges

The team also tracked non-threat issues that could affect how elections run. Officials handled them with backup plans and public updates.

• False information. Texts with wrong polling hours circulated in one state. In another, a social media video falsely suggested ballot boxes were being moved. Officials explained the equipment was backup batteries that keep voting machines powered, a routine precaution.
• Equipment problems. Electronic pollbooks (the digital lists workers use to check voters in) needed a software patch in several counties. Scanner and voting machine problems in several states led officials to offer paper ballots and count them under established procedures. One state extended voting hours at five precincts across four counties.
• Website and phone outages. Voter information pages and phone lines went down for a time in several states. Services were restored, and officials shared other ways to reach them.
• Weather. Flooding forced officials to relocate polling places in at least seven counties in one state. Officials in two states allowed voters in flooded counties to request and return emergency ballots electronically.

Election Security Is a Team Effort

That preparation was built over the course of the year, and the EI-ISAC played a direct role in it. Through a national threat forum, threat briefings, and local tabletop exercises (TTXs), the EI-ISAC helped election officials track emerging risks, plan for them, and practice their responses before Election Day, so they could act quickly when incidents occurred.

Election officials, law enforcement, and cyber analysts shared information throughout the day, and in some cases a report from one office helped others check their own systems and prepare. The EI-ISAC will continue to share information, while election officials are encouraged to keep sharing unusual activity at [email protected].