Loading story…
The U.S. Department of Homeland Security confirmed a cyber intrusion into the Homeland Security Information Network (HSIN), an unclassified but sensitive platform used to share information with federal, state, local, tribal, territorial, international, and private-sector partners. The breach reportedly occurred between late May and early June and targeted HSIN servers along with an associated SharePoint collaboration system. DHS said it isolated the affected systems, mitigated the vulnerability, and opened a forensic investigation, while the platform remains operational and there is no indication that classified networks were affected.
Officials have not attributed the intrusion to a specific threat actor or foreign government, and it remains unclear whether documents or other sensitive data were stolen. DHS's Office of Intelligence and Analysis has completed a damage assessment as concerns persist over possible exposure of operational and security-planning information used for incident response, interagency coordination, and major event security, including preparations tied to the World Cup in the United States. The incident also renewed scrutiny of HSIN after a separate 2023 permissions error exposed restricted data to unauthorized internal users because of a contractor coding mistake.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-45659, a Microsoft SharePoint Server remote code execution vulnerability, to its Known Exploited Vulnerabilities catalog. Reporting cited in the reference noted the flaw as a possible but unconfirmed avenue related to the HSIN intrusion.
After discovering the intrusion, DHS isolated the affected systems, mitigated the vulnerability, and launched a forensic investigation. The department also said HSIN remained operational and there was no indication that classified networks were impacted.
DHS's Office of Intelligence and Analysis conducted a damage assessment of the HSIN incident to evaluate potential exposure and impact. Reporting said the compromise raised concerns about possible exposure of operational and security-planning information.
DHS said attackers compromised the Homeland Security Information Network and targeted HSIN servers and an associated SharePoint collaboration system. The intrusion was reported to have occurred between late May and early June, but no threat actor had been identified and it remained unclear whether documents were stolen.
7 references tracked. Mallory keeps watching after this page renders.
thecybersecguru.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcetechcrunch.com
Open sourceteiss.co.uk
Open sourcebleepingcomputer.com
Open sourcenextgov.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Homeland Security said it is investigating a breach of the Homeland Security Information Network (**HSIN**), an information-sharing platform used by government agencies, international partners, and private-sector organizations to exchange sensitive but unclassified data. Reporting cited by DHS indicates the intrusion likely occurred in late May or early June 2026 and affected HSIN servers as well as a SharePoint system tied to the environment. DHS said it isolated the impacted systems, remediated the issue, and began a comprehensive investigation, adding that no classified networks were compromised and that HSIN remains operational. The incident has raised concern because HSIN supports coordination and information exchange across public- and private-sector entities, meaning exposed data could include operational planning or interagency communications even if the affected environment was described as legacy and unclassified. DHS has not confirmed that any specific information was stolen, and no threat actor has been publicly identified or linked to a known hacking group.
Jul 7, 2026
Hackers breached the U.S. Department of Homeland Security’s **Homeland Security Information Network (HSIN)**, a platform used to share sensitive but unclassified information with federal, state, local, tribal, territorial, international, and private-sector partners. Internal incident details indicate suspicious activity was detected between mid-May and early June on HSIN and an associated SharePoint environment, including altered files on test and production servers, use of a legitimate web-server program to run malicious code, and deletion of logs. DHS said it isolated affected systems, mitigated the underlying vulnerability, opened a forensic investigation, and maintained that classified networks were not affected and HSIN remained operational. The attackers reportedly remained in the environment for weeks after DHS personnel twice dismissed the activity as false positives. On June 4, the intruders were said to have installed hidden backdoors and stolen credential files before the breach was confirmed. Investigators had not publicly attributed the intrusion, and it remained unclear whether data was exfiltrated, but potentially exposed information may have included event security plans, suspicious activity reports, alerts, persons-of-interest data, and shared operational dashboards. The compromise has raised national security concerns because access to HSIN could support broader intelligence collection, impersonation of trusted partners, targeted spear-phishing, and exposure of emergency and major-event security planning.
Jul 13, 2026
A self-described hacktivist group calling itself **“Department of Peace”** claimed it breached **U.S. Department of Homeland Security (DHS)** systems and exfiltrated internal records tied to **Immigration and Customs Enforcement (ICE)** contracting. The group published the material via the transparency collective **Distributed Denial of Secrets (DDoSecrets)**, and reporting indicates the dataset contains **6,600+ contractor-related records** listing thousands of companies associated with federal immigration enforcement contracts, including major vendors such as **Microsoft**, **Oracle**, **Palantir**, **Raytheon**, and **Anduril**. The alleged source of the leaked records was described as DHS’s **Office of Industry Partnership**, a unit involved in procuring technology from the private sector. As of the reporting cited, **DHS had not publicly confirmed** the intrusion or validated the authenticity and provenance of the released data, leaving the breach claim unverified while the documents circulate publicly via the DDoSecrets-hosted release.
Jun 29, 2026