Loading story…
U.S. election officials say renewed Cybersecurity and Infrastructure Security Agency (CISA) support comes too late to address some gaps created by 2025 staffing and service reductions. Arizona's secretary of state office, which lost its dedicated CISA cybersecurity adviser in March 2025, cannot use certain newly available services in time for midterm preparations, though it intends to seek CISA assistance for Election Day cyber incidents. Officials said the reductions disrupted established relationships between federal, state, and local election-security teams and that restoring trust will take time.
CISA's new election-security plan assigns election-adviser responsibilities to its 10 regional directors and offers voluntary, no-cost threat-information sharing, technical expertise, vulnerability scanning, and risk-mitigation services, without committing to restore dedicated adviser roles or identifying staffing levels. Larger jurisdictions have strengthened internal defenses, exercised incident response, and built continuity plans, while smaller offices may remain more reliant on federal notifications and assistance. Officials cited attacks and outages affecting election websites and electronic poll books, disinformation, and remotely delivered bomb threats that can trigger evacuations as key election-disruption risks.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
Arizona's secretary of state office had no CISA cybersecurity adviser after March 2025, limiting its access to federal election-security support.
CISA staffing and service reductions in 2025 disrupted federal cybersecurity support and relationships with state and local election offices. The reductions were linked to broader federal spending cuts and disputes over CISA's election-disinformation work.
Arizona's secretary of state office described its partnership with CISA during the 2024 election as highly effective.
Arizona officials said some newly offered CISA services could not be incorporated into their midterm preparations because they became available too late, though Arizona plans to seek CISA assistance for Election Day cyber disruptions.
CISA released an election-security plan assigning election-adviser responsibilities to its 10 regional directors and offering voluntary, no-cost threat sharing, technical expertise, vulnerability scanning, and risk-mitigation services. The plan did not commit to restoring dedicated election-adviser roles or specify staffing levels.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcenextgov.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA released its 2026 Election Infrastructure Security Plan, committing to expand coordination, threat-intelligence sharing, and technical assistance for state and local election officials ahead of the midterms. The agency will designate its 10 regional directors as election-security advisers, use fusion centers to distribute intelligence, and provide a free near-real-time information-sharing platform to election officials and state intelligence hubs. The commitments follow staffing and program reductions that state officials say weakened established relationships with CISA, while the proposed fiscal 2027 budget would eliminate the agency's dedicated election-security program. The plan does not specify staffing, funding, whether prior election-adviser positions will be restored, or how the proposed platform will operate. Classified assessments reportedly identify Russian covert online influence activity aimed at eroding confidence in the elections, but found no evidence that voting machinery has been compromised in a way that would affect votes.
Sep 25, 2026
Bipartisan lawmakers and private-sector cybersecurity leaders warned that the U.S. Cybersecurity and Infrastructure Security Agency (**CISA**) has been significantly weakened after roughly a year of personnel cuts and layoffs under the second Trump administration, with reporting indicating the agency has lost about **one-third of its workforce** and shuttered or reduced entire divisions. Sources described diminished ability to execute core missions such as coordinating with industry and protecting federal civilian networks, with some organizations reportedly seeking alternatives (industry alliances, outside consultants, or direct government-to-government partnerships) rather than relying on CISA support. Reporting also tied the degradation to a prolonged **leadership vacuum**—with the administration’s nominee **Sean Plankey** not confirmed and Acting Director **Madhu Gottumukkala** criticized by some sources as struggling to lead—alongside political and operational pressures that deprioritized the agency. Specific capability impacts cited include reduced **counter-ransomware** efforts, work to promote **secure software development**, and losses affecting **election security** functions; additional strain was attributed to reassignment of staff to other DHS priorities and to a partial federal government shutdown that further reduced available staffing levels, raising concerns about CISA’s readiness to respond to a major cyber crisis.
Jun 29, 2026
National Cyber Director **Sean Cairncross** called on industry to help the Trump administration **reduce cybersecurity regulatory burden** and improve “friction” points in cyber information sharing, while also urging companies to lobby Congress to renew the expired **Cybersecurity Information Sharing Act of 2015** with a proposed **10-year extension**. Cairncross framed the administration’s approach as partnering with industry rather than expanding private-sector mandates, and said a forthcoming administration cybersecurity strategy would be released “sooner rather than later.” Separately, state election officials are increasingly planning to **self-fund and self-organize election security** as **CISA scales back election security support**, including work related to disinformation, and as election security specialists are reportedly fired or sidelined. With reduced federal staffing and no dedicated congressional election security grant funding, states described feeling they are “going it alone”; Arizona, for example, advanced a **$650,000** state package to patch vulnerabilities and recover from a prior cyberattack on its political candidate portal. A third report described U.S. manufacturers expanding collaboration through **MFG-ISAC**—including tabletop exercises, OT training, and incident response playbooks—but this activity is sector-focused and not directly tied to the federal policy and election-security pullback described elsewhere.
Jun 29, 2026