DHS Orders Federal Civilian Agencies to Remove Acronis Software

The U.S. Department of Homeland Security ordered federal civilian agencies to remove Acronis backup and security software, citing the products’ privileged or root access and the associated risk to government networks. Homeland Security Secretary Markwayne Mullin signed the order on July 31, 2026, giving agencies 180 days to comply; it was filed for public inspection on October 28. The restriction covers Acronis AG and its affiliates, including Acronis Inc. and Acronis SCS.

The directive extends restrictions already imposed on intelligence and defense systems, requiring affected civilian agencies to identify covered deployments and plan their removal within the compliance window. The extent of Acronis deployment across civilian agencies remains unclear. The reporting identifies neither a specific vulnerability nor a confirmed compromise involving Acronis, and the earlier intelligence community order provided no public justification.