A Top Secret NSA analyst's report published by The Intercept suggests that, in August 2016, the Russian General Main Staff Intelligence Directorate (GRU) hacked into an election-related hardware and software vendor in the US. The GRU then used data from the company for at least two "spear phishing" campaigns against local government officials associated with elections—including one attack close to the election that appeared to target officials dealing with absentee ballots. The report was based on information that only became available in April of this year, and the NSA report does not reveal the name of the company. There are references, however, to a product from VR Systems, the manufacturer of voter registration roll software and polling place hardware for checking voter information.

Within an hour of the story's publication, the FBI announced the arrest of the alleged source of the leaked report. Reality Leigh Winner was arrested at home in Augusta, Georgia, after an NSA audit identified her as the person who printed and removed the report from a secure facility. The Intercept had turned over a copy of the report to the NSA to verify its provenance while asking for comment. After analysis of the document showed that it had been folded up, suggesting it had been printed, the NSA determined only six employees had access to the document, and only Winner had been in e-mail contact with The Intercept. Additionally, there appears to be a security watermark on the posted document that identifies when it was printed.

Seven e-mail accounts at the vendor company were targeted with a method similar to the one that obtained access to e-mail accounts used by members of the Clinton campaign earlier in 2016, according to the text of the report. At least one of those accounts appears to have been compromised, as information from the company was then used in two separate sets of e-mails with malicious attachments sent to election officials just days before the election.

The first was a wave of e-mails on October 31 and November 1 sent to 122 local election officials whose e-mail addresses may have been harvested from a compromised vendor e-mail account. The e-mails delivered otherwise legitimate Microsoft Word documents from the company that gave instructions on how to use software to check a voter's registration status. The files had been "Trojanized" with Visual Basic for Applications code that accessed a malicious website and may have installed espionage malware on the targets' computers.

The NSA report indicated that it was not clear if the attacks were successful or what the additional malware was. The author of the report noted that the attacks share characteristics with previous GRU-attributed operations. However, the report indicated that they were able to identify Internet traffic from victims related to the malware, which spoofed "user agent" information for the Internet Explorer 11 web browser to attempt to conceal itself from packet inspection tools.

The attackers also sent a number of earlier test messages, without malicious contents, to other accounts, including two non-existent e-mail accounts at the domain for the election office of the government of the territory of American Samoa. This may have been an effort to probe to see if the accounts existed, according to the leaked NSA report.

Whether or not the attacks actually compromised the computers of election officials and any other voting data has not been determined. The dates do not match up with previously reported attacks on state election officials.