An election depends on more than ballots. Voter lists, the systems that count and certify results, the staff who run them and the public’s trust in the outcome all have to hold. Attackers can go after any one of these. This page sets out the main cyber threats to electoral processes and what public guidance says about reducing them. It is based on published work by CISA and ENISA and on one Brandefense incident profile.
What Counts as Election Infrastructure?
The US Cybersecurity and Infrastructure Security Agency (CISA) lists what it treats as election infrastructure. It covers voter registration databases and related IT systems, the IT used to manage elections (counting, auditing, displaying and certifying results), voting systems, storage facilities for election equipment, and polling places, including early voting locations. CISA works on both the cyber and the physical security of these assets.
For election officials and vendors, CISA offers no-cost, voluntary services. They include an election cybersecurity toolkit built with the Joint Cyber Defense Collaborative, customizable tabletop exercise packages, and guidance on best practices for securing election systems.
Which Threats Does ENISA Name?
On 6 March 2024, ahead of the EU elections, the NIS Cooperation Group published a second version of the EU compendium on elections cybersecurity and resilience, with support from ENISA, the European Commission and the European External Action Service. The first edition came out in 2018. The update covers the whole electoral cycle and gives practical recommendations to EU bodies and national authorities.
The threats it highlights are:
- fast progress in AI, including deepfakes
- hacktivists-for-hire
- more sophisticated threat actors
- hybrid threats, including foreign information manipulation and interference
- disinformation on social media
ENISA also ran the EU ELEx 23 exercise to test national and EU crisis plans against election-related cyber incidents. It produced a checklist that makes the people involved in elections aware of the risks, and it shares biweekly threat briefs with stakeholders.
What Happened in Romania in 2024?
Romania shows how cyber activity and platform manipulation can shake a whole election. The Constitutional Court annulled the 2024 presidential election process on 6 December 2024. On 28 November the Supreme Council of National Defence had said that cyber attacks aimed to influence the first round, held on 24 November. On 17 December the European Commission opened formal proceedings against TikTok under the Digital Services Act. Our profile of the Romania election cyber attacks lists who said what and where the sources differ.
What Can Defenders Do?
The guidance above points to a few steps that apply to most election bodies:
- Rehearse crisis plans with tabletop exercises, as CISA and ENISA both support.
- Protect staff accounts, since stolen logins give attackers a way into election systems. Our glossary explains credential harvesting and leaked credentials.
- Watch for exposed or leaked voter and staff data outside your own network, and for fake sites that copy official election pages.
- Prepare to answer false claims quickly, because disinformation is part of the threat.