Loading story…
NATO investigated claims by hacktivist group SiegedSec that it had breached an alliance platform used to share unclassified information. Reports said the group posted screenshots and alleged stolen files online, asserting it had accessed a NATO Community of Interest portal rather than classified military networks. NATO acknowledged it was examining the incident and said the affected environment handled unclassified data.
Coverage indicated the alliance was working to verify the scope and authenticity of the exposed material while emphasizing that there was no indication classified systems were compromised. Subsequent reporting said the inquiry remained active as officials assessed what information may have been accessed or leaked and whether the intrusion involved a limited web-facing collaboration service rather than NATO’s core operational infrastructure.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
SiegedSec claimed it had compromised six NATO web portals, stolen more than 3,000 files totaling about 9GB, and published links to the alleged data on Telegram. NATO said it was actively addressing multiple IT security incidents affecting some unclassified websites, added cybersecurity measures, and reported no impact on missions, operations, or deployments.
By early October, NATO said it had found no evidence that its systems were compromised in connection with the alleged SiegedSec attack. The alliance indicated the matter had been investigated and the earlier claims were not substantiated as a breach of NATO systems.
NATO said it was investigating the apparent intrusion claim involving an unclassified information-sharing platform after SiegedSec posted alleged stolen data online. The alliance stated there was no impact on classified missions, operations, or networks based on initial findings.
Hacktivist group SiegedSec publicly claimed it had compromised a NATO unclassified information-sharing portal and stolen data. Reports indicated the allegedly accessed system was used for sharing unclassified information rather than classified NATO networks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
scmagazine.com
Open sourcetheregister.com
Open sourcetheregister.com
Open sourcecyberscoop.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hackers breached the U.S. Department of Homeland Security’s **Homeland Security Information Network (HSIN)**, a platform used to share sensitive but unclassified information with federal, state, local, tribal, territorial, international, and private-sector partners. Internal incident details indicate suspicious activity was detected between mid-May and early June on HSIN and an associated SharePoint environment, including altered files on test and production servers, use of a legitimate web-server program to run malicious code, and deletion of logs. DHS said it isolated affected systems, mitigated the underlying vulnerability, opened a forensic investigation, and maintained that classified networks were not affected and HSIN remained operational. The attackers reportedly remained in the environment for weeks after DHS personnel twice dismissed the activity as false positives. On June 4, the intruders were said to have installed hidden backdoors and stolen credential files before the breach was confirmed. Investigators had not publicly attributed the intrusion, and it remained unclear whether data was exfiltrated, but potentially exposed information may have included event security plans, suspicious activity reports, alerts, persons-of-interest data, and shared operational dashboards. The compromise has raised national security concerns because access to HSIN could support broader intelligence collection, impersonation of trusted partners, targeted spear-phishing, and exposure of emergency and major-event security planning.
Jul 13, 2026
The U.S. Department of Homeland Security confirmed a cyber intrusion into the Homeland Security Information Network (HSIN), an unclassified but sensitive platform used to share information with federal, state, local, tribal, territorial, international, and private-sector partners. The breach reportedly occurred between late May and early June and targeted HSIN servers along with an associated SharePoint collaboration system. DHS said it isolated the affected systems, mitigated the vulnerability, and opened a forensic investigation, while the platform remains operational and there is no indication that classified networks were affected. Officials have not attributed the intrusion to a specific threat actor or foreign government, and it remains unclear whether documents or other sensitive data were stolen. DHS's Office of Intelligence and Analysis has completed a damage assessment as concerns persist over possible exposure of operational and security-planning information used for incident response, interagency coordination, and major event security, including preparations tied to the World Cup in the United States. The incident also renewed scrutiny of HSIN after a separate 2023 permissions error exposed restricted data to unauthorized internal users because of a contractor coding mistake.
Jul 3, 2026
The U.S. Department of Homeland Security said it is investigating a breach of the Homeland Security Information Network (**HSIN**), an information-sharing platform used by government agencies, international partners, and private-sector organizations to exchange sensitive but unclassified data. Reporting cited by DHS indicates the intrusion likely occurred in late May or early June 2026 and affected HSIN servers as well as a SharePoint system tied to the environment. DHS said it isolated the impacted systems, remediated the issue, and began a comprehensive investigation, adding that no classified networks were compromised and that HSIN remains operational. The incident has raised concern because HSIN supports coordination and information exchange across public- and private-sector entities, meaning exposed data could include operational planning or interagency communications even if the affected environment was described as legacy and unclassified. DHS has not confirmed that any specific information was stolen, and no threat actor has been publicly identified or linked to a known hacking group.
Jul 7, 2026