The FBI has been told about a cyberattack on the campaign of David Min, a Democratic congressional candidate who lost in his California primary, two sources tell CNN.
Reuters first reported the story and provided a detailed account of the timeline of events.
The sources – one person familiar with the campaign and another familiar with the Democratic Congressional Campaign Committee – said the alleged attack took place earlier this year.
The person familiar with Min’s campaign said the campaign became aware of the hack in March. The Democratic Congressional Campaign Committee told the campaign it was one of the most sophisticated hacks it had seen this election cycle at that point, based on how the hackers had masked the attack and the malware it had implanted, the source said.
In fact, the campaign didn’t detect the hack on its own. The campaign was using shared office space in Irvine, California, and the organization running that office space sent a building-wide email saying someone on the network had been infected.
The source said it was a spear phishing attack and that the source had been told the hackers could monitor the keystrokes of some campaign staffers.
Due to a lack of resources, the campaign didn’t undertake a forensic audit, this person said.
Senior campaign staff met with the FBI, the source said, but didn’t go public with information because the campaign didn’t want the incident to be a distraction.
Min’s former campaign manager, Paige Hutchinson, declined to comment.
An FBI spokeswoman told CNN the agency doesn’t confirm or deny investigations.
CNN’s David Shortell, Clare Foran and Jason Kravarik contributed to this report.