Hackers Breach DHS Homeland Security Information Network (HSIN)

The Department of Homeland Security (DHS) has confirmed a cyberattack that breached the Homeland Security Information Network (HSIN), a critical platform used for sharing sensitive, unclassified information among federal, state, local, and private sector partners. The intrusion, which occurred sometime between late May and early June, is currently under investigation by DHS, with no specific threat actor or foreign government yet identified.

Sources familiar with the matter indicated that threat actors targeted both HSIN servers and a related SharePoint system used for collaboration. The DHS Office of Intelligence and Analysis has initiated a damage assessment to determine the full scope of the breach and what, if any, data was exfiltrated. The exact nature and extent of the compromised data remain unclear, and DHS has not yet attributed the attack to any particular group.

HSIN serves as a vital tool for approved users to access data, coordinate operations, manage security for planned events, and respond to incidents. It facilitates real-time communication, alerts, and the exchange of critical information necessary for protecting communities. Given the ongoing World Cup games hosted across the United States, concerns have been raised about the potential exposure of security planning, interagency coordination, or response procedures related to these high-profile events.

In a statement, a DHS spokesperson acknowledged the incident, emphasizing that classified networks were not affected. "The Department of Homeland Security is aware of a recent cyber incident involving a specific, unclassified legacy information sharing environment," the spokesperson said. "We immediately took action to isolate the affected systems, mitigate the vulnerability, and launch a comprehensive forensic investigation. There is no indication that classified networks were impacted, and the system remains operational for our partners."

This is not the first security incident to affect HSIN. In 2023, a misconfiguration stemming from a contractor's coding error inadvertently exposed restricted data within HSIN-Intel, the platform's intelligence section. This prior incident, detailed in an internal DHS memo, involved setting access permissions to "everyone" instead of a limited group, leading to the exposure of sensitive U.S. person data and other personally identifiable information to all HSIN users.

The current breach underscores the persistent challenges in securing government information-sharing platforms, even those designed to facilitate collaboration and enhance national security. The investigation aims to identify the vulnerabilities exploited and implement necessary measures to prevent future intrusions, ensuring the integrity and confidentiality of sensitive data shared across various government and private entities.

As the investigation progresses, DHS is expected to provide further updates on the findings and any remediation steps taken. The incident serves as a stark reminder of the ongoing threats posed by cyber adversaries and the importance of robust security protocols for critical infrastructure and information-sharing systems.

The breach occurred between late May and early June 2026, impacting both HSIN servers and an inter-agency SharePoint system. While DHS confirmed the incident and stated that classified networks were not affected, an investigation is ongoing to attribute the attack to a specific threat actor. This incident follows a previous 2025 misconfiguration in HSIN-Intel that inadvertently exposed sensitive data.

Federal investigators are now probing the intrusion, with a senator warning of potential national security implications. The specific attack vector and the full extent of compromised data remain under active investigation, adding urgency to the ongoing inquiry.