Loading story…
Hackers breached the U.S. Department of Homeland Security’s Homeland Security Information Network (HSIN), a platform used to share sensitive but unclassified information with federal, state, local, tribal, territorial, international, and private-sector partners. Internal incident details indicate suspicious activity was detected between mid-May and early June on HSIN and an associated SharePoint environment, including altered files on test and production servers, use of a legitimate web-server program to run malicious code, and deletion of logs. DHS said it isolated affected systems, mitigated the underlying vulnerability, opened a forensic investigation, and maintained that classified networks were not affected and HSIN remained operational.
The attackers reportedly remained in the environment for weeks after DHS personnel twice dismissed the activity as false positives. On June 4, the intruders were said to have installed hidden backdoors and stolen credential files before the breach was confirmed. Investigators had not publicly attributed the intrusion, and it remained unclear whether data was exfiltrated, but potentially exposed information may have included event security plans, suspicious activity reports, alerts, persons-of-interest data, and shared operational dashboards. The compromise has raised national security concerns because access to HSIN could support broader intelligence collection, impersonation of trusted partners, targeted spear-phishing, and exposure of emergency and major-event security planning.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
After additional suspicious activity was detected in the HSIN environment, analysts again dismissed the alerts as benign. This second misclassification extended attacker dwell time in the network for weeks.
FEMA analysts observed suspicious activity in the DHS Homeland Security Information Network environment, including altered files, malicious code execution via a legitimate web-server program, and deleted logs. Internal responders ruled these signs a false positive, allowing the intrusion to continue.
Following confirmation of the intrusion, DHS said it isolated affected HSIN servers and an associated SharePoint environment, mitigated the underlying vulnerability, and opened a forensic investigation. The department stated that classified networks were not impacted and HSIN remained operational.
On June 4, intruders installed hidden backdoors in the HSIN environment and stole credential files. DHS personnel then confirmed that the network had been actively breached.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcenextgov.com
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Homeland Security confirmed a cyber intrusion into the Homeland Security Information Network (HSIN), an unclassified but sensitive platform used to share information with federal, state, local, tribal, territorial, international, and private-sector partners. The breach reportedly occurred between late May and early June and targeted HSIN servers along with an associated SharePoint collaboration system. DHS said it isolated the affected systems, mitigated the vulnerability, and opened a forensic investigation, while the platform remains operational and there is no indication that classified networks were affected. Officials have not attributed the intrusion to a specific threat actor or foreign government, and it remains unclear whether documents or other sensitive data were stolen. DHS's Office of Intelligence and Analysis has completed a damage assessment as concerns persist over possible exposure of operational and security-planning information used for incident response, interagency coordination, and major event security, including preparations tied to the World Cup in the United States. The incident also renewed scrutiny of HSIN after a separate 2023 permissions error exposed restricted data to unauthorized internal users because of a contractor coding mistake.
Jul 3, 2026
The U.S. Department of Homeland Security said it is investigating a breach of the Homeland Security Information Network (**HSIN**), an information-sharing platform used by government agencies, international partners, and private-sector organizations to exchange sensitive but unclassified data. Reporting cited by DHS indicates the intrusion likely occurred in late May or early June 2026 and affected HSIN servers as well as a SharePoint system tied to the environment. DHS said it isolated the impacted systems, remediated the issue, and began a comprehensive investigation, adding that no classified networks were compromised and that HSIN remains operational. The incident has raised concern because HSIN supports coordination and information exchange across public- and private-sector entities, meaning exposed data could include operational planning or interagency communications even if the affected environment was described as legacy and unclassified. DHS has not confirmed that any specific information was stolen, and no threat actor has been publicly identified or linked to a known hacking group.
Jul 7, 2026
A self-described hacktivist group calling itself **“Department of Peace”** claimed it breached **U.S. Department of Homeland Security (DHS)** systems and exfiltrated internal records tied to **Immigration and Customs Enforcement (ICE)** contracting. The group published the material via the transparency collective **Distributed Denial of Secrets (DDoSecrets)**, and reporting indicates the dataset contains **6,600+ contractor-related records** listing thousands of companies associated with federal immigration enforcement contracts, including major vendors such as **Microsoft**, **Oracle**, **Palantir**, **Raytheon**, and **Anduril**. The alleged source of the leaked records was described as DHS’s **Office of Industry Partnership**, a unit involved in procuring technology from the private sector. As of the reporting cited, **DHS had not publicly confirmed** the intrusion or validated the authenticity and provenance of the released data, leaving the breach claim unverified while the documents circulate publicly via the DDoSecrets-hosted release.
Jun 29, 2026