IIRC, in 2004 it was the Bush National Guard Officer Evaluation Reports/Dan Rather.
And in 2000, I think it was the Bush DUI arrest record.
Outright libel doesn’t work either.
Thing is: by October, voters are pretty much set on their choice. An “October Surprise” need be devastating enough to convince some 10% of would-be supporters to stay home election day. Not-uncommon screwups from decades past inspiring “meh” responses don’t rise to “October Surprise” status.