FBI-CISA Election Phishing Alert: Portfolio Checks
An FBI and CISA PSA warns of phishing and smishing aimed at election officials. What PE portfolio CFOs and security leaders should verify next.
The FBI and CISA have issued a public service announcement warning that malicious actors may use phishing and smishing against election and campaign officials ahead of the 2026 U.S. midterms. Our analysis: the alert matters most to portfolio companies that sell to election offices, campaigns or political organizations, or that handle voter-related data. For those companies, it should prompt a funding and evidence check on phishing-resistant MFA and on secondary-channel verification before the election period.
What did the FBI and CISA election phishing PSA say?
The FBI and CISA issued a Public Service Announcement on cyber threats facing election and campaign officials during the upcoming 2026 U.S. midterm elections. The agencies say malicious actors may use phishing and smishing to steal user data, including login credentials and sensitive information. Election officials, candidates, and political organizations are described as attractive targets because of their access to voter registration data, government officials, or sensitive campaign information.
The PSA says super intelligence (SI) tools let attackers write convincing messages in native languages and common vernacular, removing the spelling and grammar errors that once exposed phishing. The PSA also warns that adversaries have used SI to produce convincing deepfake video and audio to steal identities and bolster phishing schemes. According to the PSA, election officials saw a surge of phishing attempts during the last two election cycles, and the FBI saw more smishing attempts through encrypted chat applications within the last year.
In our view, the PSA describes threat patterns and prior-cycle activity rather than a single new incident, so it should be read as an advisory, not as breaking news of a specific compromise.
Which portfolio companies does the election phishing warning affect?
Our analysis: the condition that makes this relevant is a direct business relationship with the election community. That includes companies that provide software, communications, data or services to election jurisdictions, candidates or political organizations, and companies whose staff regularly exchange sensitive information with those parties. For operating partners triaging across holdings, the PE portfolio view is a useful frame for sorting which companies fit that condition.
In our view, companies outside the election community should still note the broader point: SI-generated messages and deepfake audio weaken the assumption that employees can spot fraud by tone or grammar. That affects finance teams that approve payments or vendor changes based on email, text or voice requests.
Which decision does the election phishing PSA change?
The FBI and CISA PSA recommends phishing-resistant multi-factor authentication, particularly for email, virtual private networks, and accounts that access critical systems. The PSA's organizational guidance also covers external-email banners, strong spam filters, and filtering of emails that contain executable files. The PSA also recommends Sender Policy Framework and DomainKeys Identified Mail to limit domain spoofing, plus role-based, least-privileged access that is reviewed regularly. The PSA asks employees to confirm requests for sensitive information through secondary channels where possible, and organizations to create a process for sending suspicious emails to IT.
Our analysis: for election-adjacent companies, the decision this changes is whether to accelerate funding for phishing-resistant MFA on email, VPN and privileged accounts, rather than leaving it in a later budget cycle. CFOs weighing that spend against other priorities can use CFO funding framing and, where a loss estimate is needed, a structured cyber risk quantification approach whose assumptions are documented in the methodology. A second decision is whether to formalize out-of-band verification for payment, credential and data requests, given the deepfake warning.
Decision and evidence table for election phishing exposure (our analysis)
| Decision | Company condition | Evidence to request | Accountable owner | Verification action |
|---|---|---|---|---|
| Accelerate phishing-resistant MFA | Serves election offices, campaigns or political organizations | Current MFA method by system (email, VPN, admin, critical systems) and exceptions list | Portfolio-company CISO or IT lead | Sample privileged and remote accounts and confirm the enforced method, not the policy statement |
| Require out-of-band verification | Finance or support teams act on email, text or voice requests | Written procedure for confirming payment, credential and data requests through a second channel | Portfolio-company CFO | Review recent approvals for evidence the second-channel step occurred |
| Tighten email authentication and filtering | Any company whose domain could be spoofed to election contacts | SPF and DKIM configuration, external-email banner setting, executable-file filtering rules | IT or security lead | Independently check published DNS records and test filtering in a controlled way |
| Confirm suspicious-message reporting | Staff receive unsolicited requests via email or encrypted chat apps | Reporting channel, triage ownership and recent volume | Security lead | Send a benign test report and confirm it is received and logged |
| Review least-privilege access | Systems hold voter-related or campaign data | Most recent access review for those systems | System owner with security lead | Confirm review date, reviewer and removals made |
Who owns verification, and how should it be checked?
The PSA also advises documenting all security incidents and remediation activities clearly, consistently, and transparently. Our analysis: the operating partner should own the portfolio-level question of which companies meet the election-adjacent condition, while each company's CISO or IT lead owns MFA and email-control evidence, mapped to identity and zero trust assurance. The suspicious-message reporting path belongs with whoever runs detection and response. Where a company supplies technology to election customers, its own vendors also matter, which fits a third-party risk review. The PSA points to CISA's Known Exploited Vulnerabilities catalog for information on newly exploited vulnerabilities. The PSA also advises keeping all operating systems and software up to date. In our view, that patching and known-exploited vulnerability tracking belongs in exposure management.
In our view, verification should rely on configuration exports and samples, not attestations. If a company has a cyber insurance renewal approaching, the same MFA and email-authentication evidence can support insurance renewal evidence requests. For a summary to directors, a short note through board and risk reporting should state which companies are in scope and what evidence was confirmed. The FBI asks victims to report suspicious activity to a local field office or to IC3. To see how such a write-up can be structured, inspect a sample decision memo.
Valty connects cyber-loss modeling, funding choices, governed actions, and evidence for supported workflows. Request a platform demo.
Unknowns
- The PSA does not identify which organizations were targeted or whether any attempts succeeded.
- It does not provide loss figures, so any financial estimate for a portfolio company is our analysis, not sourced fact.
- Whether a given portfolio company is in scope depends on its customer base, which public sources cannot confirm.
- The PSA gives no compliance deadline; timing pressure in this memo reflects the election calendar, not a stated requirement.
Sources
- FBI Internet Crime Complaint Center (IC3), Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials (page publication date October 16, 2026, an announcement date): https://www.ic3.gov/PSA/2026/PSA261016
Limitations
This memo relies on a single public advisory. Public sources are not company evidence, and nothing here confirms the control state or exposure of any specific portfolio company. The table and recommendations are our analysis.
