State officials have largely taken securing today's midterm elections into their own hands after nearly two years of federal program and funding cuts during the second Trump administration.

Why it matters: The reduction in federal support has come as AI tools threaten to make it easier for hackers to uncover software vulnerabilities, launch cyberattacks, and spread disinformation that undermines trust in election results.

Reality check: Just because a security flaw exists doesn't mean hackers can exploit it to manipulate election results.

• Nearly all U.S. elections maintain paper records that can be used to verify electronic tallies.

Threat level: Election officials are preparing for everything from cyberattacks and AI-generated disinformation to physical threats, logistical disruptions and legal challenges.

The big picture: State election officials relied on homeland security agencies, fusion centers, police, National Guard units and private cybersecurity firms to prepare for the midterms, John Milhofer, a spokesperson for the National Association of Secretaries of State, told Axios.

• That group and the National Association of State Election Directors are helping states exchange threat intelligence and connect with federal agencies and private sector experts.

Catch up quick: State resources have become more important after the Trump administration scaled back federal election security assistance.

• CISA cut election security personnel and services in 2025, while federal funding for the Elections Infrastructure Information Sharing and Analysis Center, a key information-sharing network for election officials, ended that year.
• Election officials are receiving fewer election-specific threat briefings and less direct technical assistance, even after CISA outlined plans to restore some services in September.

Zoom in: Michael Moore, chief information security officer for the Arizona secretary of state's office, told Axios that the state has been without a dedicated CISA cybersecurity adviser since March 2025.

• The Arizona Department of Homeland Security has helped fill the gap, providing security tools and monitoring services to smaller counties.
• On Election Day, Arizona plans to bring together its state cybersecurity team, National Guard, the FBI and a representative from CISA's Region 9 office to coordinate responses to potential threats, Moore said.
• Moore's team has spent years conducting tabletop exercises covering cyberattacks, AI-generated impersonations of election officials, suspicious packages and other disruptions.

Between the lines: Arizona is also getting threat intelligence from former CISA personnel who work in the space, election security nonprofits and officials in other states.

• Moore said his relationship with New Jersey's election security officials is particularly useful because his East Coast counterparts can warn him about threats hours before they might emerge in Arizona.

What they're saying: A CISA spokesperson said in a statement that the agency will provide state and local government officials, including election officials and election vendors, "no-cost voluntary services" like vulnerability scanning and technical expertise, when they request it.

• "We are committed to supporting state and local elections officials to protect election infrastructure and safeguard our democracy," the spokesperson added.

Yes, but: Moore said he still wants CISA to return to its 2024 staffing levels — and then double them.

• "If we are literally experiencing a cyberattack from a nation-state, it shouldn't be Arizona versus that nation-state," Moore said. "We're the United States of America. It should be a unified response."
• David Becker, executive director and founder of the Center for Election Innovation and Research, told reporters during a briefing Thursday that states have hired vendors and built their own networks to compensate for the federal retreat.
• "They might not be able to replace everything," Becker said. "They're not going to get the same bird's-eye national-level view of potential disinformation or potential cyber events."

The bottom line: Election officials said they're prepared for disruptions, even if they can't prevent every attack.

• "The goal is prevent as much as we can, detect and recover," Moore said. "We're going to have some amount of disruption.... We're going to recover."

Cyberattacks are wreaking havoc on an unlikely target across Europe: supermarket refrigerators.

Why it matters: Hackers are turning everyday, internet-connected equipment into physical hazards, spoiling food and causing costly damage.

• U.S. supermarkets use similar technology, and the Pentagon is already investigating suspected cyberattacks involving refrigeration systems at six military commissaries.

Driving the news: Suspected cyberattacks sent refrigerator and freezer temperatures soaring at dozens of European supermarkets Sunday night, spoiling food and threatening costly losses.

• Grocery chains Ahold Delhaize and Colruyt reported incidents affecting stores in Belgium and Luxembourg, while Swedish chains ICA and Coop reported similar disruptions, per Reuters.
• A Belgian company that operates Delhaize's refrigeration systems said hackers switched the units into defrost mode.

Supermarkets in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden reported cyberattacks or IT disruptions, forcing some stores to discard spoiled food.

• Dozens of stores were affected, including an ICA supermarket in Sweden that said hackers set its refrigerator and freezer temperatures to 122°F, per ABC News.
• Authorities haven't shared who they suspect is behind the attacks, per NBC News.

Flashback: The incidents follow similar attacks in France last month, when hackers seized control of hundreds of refrigeration units, causing fires and spoiling food. It's unclear whether the attacks are connected.

➡️ Read the rest.

North Korean hackers are responsible for 89% of all cryptocurrency stolen during cyberattacks in 2026, according to data from Chainalysis.

Why it matters: North Korea has turned cryptocurrency theft into a multibillion-dollar operation that it uses to fund its regime.

By the numbers: North Korea's share of stolen crypto has climbed from just 15% in 2021 to nearly 89% this year, according to data shared with Axios.

• Hackers linked to the North Korean government have stolen $7.6 billion of the total $8.6 billion worth of cryptocurrencies stolen this year.
• That $7.6 billion was stolen across 41 hacks this year, including the $6.3 billion stolen during the record-setting Binance hack.
• North Korean hackers have accounted for just 14% of the 290 recorded crypto hacks this year, yet they've stolen nearly 89% of the money.

What they're saying: "The North Koreans, in my experience, know the blockchain better than any tech bro in San Francisco," Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, told Axios.

Driving the news: The FBI attributed the recent hack of Binance to TraderTraitor, a North Korean hacking group, on Saturday.

• Binance said today that the hackers prepared for the hack over several months through tampered software and job interviews.

The big picture: North Korea has spent years using financial cyberattacks to generate revenue for its government, increasingly targeting cryptocurrency exchanges.

• The TraderTraitor group was also responsible for the previous record-breaking crypto heist: the $1.5 billion theft from Bybit in 2025.

Between the lines: North Korean hackers are only getting better and faster at their attacks, experts told Axios.

• "They're essentially crowding out other threat actors by stealing the bulk of the value that's taken in any given year," Eric Jardine, head of research at Chainalysis, told Axios.
• Chainalysis said in a research report Friday that hackers made off with the billions of funds in as little as 20 minutes. Researchers at TRM Labs found that the hackers started preparing for the attack just 36 hours before it began.

The people at the frontlines of the ongoing barrage of AI-enabled cyberattacks are being pummeled with attacks, vulnerabilities and false alarms.

Why it matters: Humans are still at the frontlines of a fight enabled largely by AI — and they're struggling to wade through mountains of threat data to determine who's been hit and which attacks pose a real danger to companies.

What they're saying: "The last month has been the longest year of my life," Justin Timothy, threat intelligence consultant at GuidePoint Security, told Axios.

• Even before "Black October," Timothy was already swamped and dealing with hacker gangs that had returned from a seasonal summer lull.
• These groups specialize in ransomware, essentially attacking the networks of an institution and holding it hostage. While AI is playing a role in many new cyberattacks, the ransomware scourge has been shutting down pipeline systems, hospitals, education software and other essential services for years.
• It's only expected to get worse this year as powerful new AI systems are amplifying the capabilities of attackers faster than defenders can insulate vast corners of the unprotected internet.

The big picture: The people companies call when they're hacked are being swamped, piling onto the persistent burnout that has plagued the industry.

• Troy Bettencourt, who leads Palo Alto Networks' global digital forensics and incident response practice, told Axios that demand for his team's services has climbed by double digits over the last six weeks.
• Unlike past surges tied to historically harmful attacks like SolarWinds, this year's workload has been relentless. "It's just a continuous grind that increases," Bettencourt said.
• The same heavy workload is happening across the industry, and even Palo Alto Networks' incident response subcontractors are at max capacity, he said.
• Investigations that could once be handled by a single consultant now require teams of five to 20 people, he said. The company is also pulling employees off other projects and shifting staff into incident response as it braces for more attacks exploiting the PHP vulnerabilities disclosed last week.

➡️ Read the rest.

@ D.C.

🗳️ Both OpenAI and Anthropic are standing up "war rooms" on Election Day to monitor their platforms for misuse and to respond to any incidents. (Semafor)

🏥 The Trump administration launched a pilot program aimed at securing healthcare infrastructure amid rising AI-enabled threats. (Cybersecurity Dive)

🤖 An Accenture employee's personal AI agent ran on a Defense Department network for two months before it was identified. (Wired)

@ Industry

🧠 Google unveiled its most cyber-capable model yet, Gemini 4 Carbon. (VentureBeat)

💰 CrowdStrike plans to acquire two AI security startups — Dreadnode and Fiddler AI — for around $495 million. (Wall Street Journal)

👨🏻‍⚖️ A federal grand jury indicted the former OpenAI employee accused of installing a listening device in one of the company's meeting rooms. (San Francisco Chronicle)

@ Hackers and hacks

🪪 Hackers stole the personal data of more than 40,000 people who work at the Department of Homeland Security, including details about their names, job titles and work contact information. (TechCrunch)

👀 Hackers targeted the Federal Election Commission's website, disrupting the agency's electronic filings system a week before today's elections. (Reuters)

💸 Binance users withdrew $3.6 billion of assets from the crypto exchange after news of last week's hack. (BBC)

🥹 My current obsession: Jim Reilly, co-founder of Charleston AI, and his Instagram account about teaching people in his community how to use ChatGPT and other AI models.