Loading story…
The Government Accountability Office is auditing three security incidents affecting the Department of Homeland Security’s Homeland Security Information Network between 2023 and 2026. The latest incident involved an outside malicious actor whose affiliation remains unknown. DHS analysts twice dismissed suspicious activity, allowing attackers to remain inside the network for weeks before personnel confirmed the breach on June 4. The attackers installed hidden access points and stole authentication credential data; the extent of any additional data theft remains unclear.
The other two incidents involved employee or contractor errors that exposed restricted information to unauthorized users. The audit may examine whether DHS promptly notified Congress, while some information-sharing partners remain uncertain whether attackers accessed their files. DHS previously said it isolated affected systems, addressed the vulnerability and began a forensic investigation. The incidents raise concerns about intrusion triage, credential security and timely notification to organizations sharing sensitive information through the network.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
A similar security incident exposed restricted HSIN information to unauthorized users. The source attributed the two earlier incidents to employee or contractor errors.
A contractor’s coding error allowed Homeland Security Information Network users to access restricted information they were not authorized to view, according to an internal memo.
The Government Accountability Office began reviewing three known HSIN security incidents spanning 2023–2026 in response to a directive in the fiscal 2025 defense policy package. The audit may examine whether DHS promptly notified Congress about the incidents.
DHS acknowledged a cyber incident affecting a specific unclassified legacy information-sharing environment. It said it isolated affected systems, addressed the vulnerability and began a forensic investigation.
By June 4, attackers had installed hidden access points and stolen authentication credential data; personnel declared an active breach after identifying those actions. The attacker’s affiliation and the extent of any additional information theft remained unknown.
An internal incident readout documented suspicious activity beginning in mid-May. DHS analysts twice dismissed activity as harmless, allowing an outside malicious actor to remain in HSIN for weeks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hackers breached the U.S. Department of Homeland Security’s **Homeland Security Information Network (HSIN)**, a platform used to share sensitive but unclassified information with federal, state, local, tribal, territorial, international, and private-sector partners. Internal incident details indicate suspicious activity was detected between mid-May and early June on HSIN and an associated SharePoint environment, including altered files on test and production servers, use of a legitimate web-server program to run malicious code, and deletion of logs. DHS said it isolated affected systems, mitigated the underlying vulnerability, opened a forensic investigation, and maintained that classified networks were not affected and HSIN remained operational. The attackers reportedly remained in the environment for weeks after DHS personnel twice dismissed the activity as false positives. On June 4, the intruders were said to have installed hidden backdoors and stolen credential files before the breach was confirmed. Investigators had not publicly attributed the intrusion, and it remained unclear whether data was exfiltrated, but potentially exposed information may have included event security plans, suspicious activity reports, alerts, persons-of-interest data, and shared operational dashboards. The compromise has raised national security concerns because access to HSIN could support broader intelligence collection, impersonation of trusted partners, targeted spear-phishing, and exposure of emergency and major-event security planning.
Jul 13, 2026
The U.S. Department of Homeland Security confirmed a cyber intrusion into the Homeland Security Information Network (HSIN), an unclassified but sensitive platform used to share information with federal, state, local, tribal, territorial, international, and private-sector partners. The breach reportedly occurred between late May and early June and targeted HSIN servers along with an associated SharePoint collaboration system. DHS said it isolated the affected systems, mitigated the vulnerability, and opened a forensic investigation, while the platform remains operational and there is no indication that classified networks were affected. Officials have not attributed the intrusion to a specific threat actor or foreign government, and it remains unclear whether documents or other sensitive data were stolen. DHS's Office of Intelligence and Analysis has completed a damage assessment as concerns persist over possible exposure of operational and security-planning information used for incident response, interagency coordination, and major event security, including preparations tied to the World Cup in the United States. The incident also renewed scrutiny of HSIN after a separate 2023 permissions error exposed restricted data to unauthorized internal users because of a contractor coding mistake.
Jul 3, 2026
The U.S. Department of Homeland Security said it is investigating a breach of the Homeland Security Information Network (**HSIN**), an information-sharing platform used by government agencies, international partners, and private-sector organizations to exchange sensitive but unclassified data. Reporting cited by DHS indicates the intrusion likely occurred in late May or early June 2026 and affected HSIN servers as well as a SharePoint system tied to the environment. DHS said it isolated the impacted systems, remediated the issue, and began a comprehensive investigation, adding that no classified networks were compromised and that HSIN remains operational. The incident has raised concern because HSIN supports coordination and information exchange across public- and private-sector entities, meaning exposed data could include operational planning or interagency communications even if the affected environment was described as legacy and unclassified. DHS has not confirmed that any specific information was stolen, and no threat actor has been publicly identified or linked to a known hacking group.
Jul 7, 2026