U.S. DHS HSIN cyber breach

In early July 2026, the U.S. Department of Homeland Security confirmed that its Homeland Security Information Network (HSIN) – an unclassified information‑sharing platform used by federal, state, local, industry and foreign partners – had been infiltrated. Initial reports noted that attackers breached the HSIN servers and a SharePoint environment, but classified networks remained untouched. DHS isolated the affected systems and opened an investigation, without identifying the perpetrators or confirming any data exfiltration.

A later briefing clarified that the intrusion began in mid‑May, when analysts mistakenly dismissed alerts as false positives. Hackers altered files, ran malicious code via a legitimate web‑server program, and deleted logs. A second wave of alerts in late May was also ignored. By June 4, the intruders had installed hidden backdoors and stolen credential files, prompting DHS to publicly acknowledge an active breach. Investigators still have not linked the actors to any nation‑state or determined what information, if any, was taken, and they affirmed that classified networks were unaffected.

Both disclosures underscore weaknesses in alert handling and the need for stronger cybersecurity safeguards across DHS’s information‑sharing infrastructure.