DHS confirms hackers breached HSIN info-sharing platform

The Department of Homeland Security is investigating a cyberattack on the Homeland Security Information Network, an unclassified platform relied upon by federal, state, local, and private-sector partners to exchange sensitive information.

DHS is investigating an intrusion that occurred between late May and early June 2026. The breach, initially disclosed by Nextgov, was executed by an unidentified actor, according to two sources who requested anonymity. Officials have not linked the incident to any particular group or nation-state, and it is still unknown if files were taken.

The department's Office of Intelligence and Analysis performed a damage assessment after the attackers hit both HSIN servers and an associated SharePoint collaboration environment, Nextgov reported. DHS has not issued any attribution.

HSIN enables real-time sharing of sensitive but unclassified information. Authorized participants use the network to retrieve records, submit interagency requests, oversee operations, arrange event security measures, handle emergencies, and distribute vital data for community protection. The system further facilitates live alerts, incident tracking, and details on individuals of interest or emerging risks.

With the United States managing security for the World Cup hosted domestically, the timing has prompted worries that planning documents, coordination protocols, or response strategies may have been exposed, Nextgov reported.

DHS isolated affected systems and states that classified networks were not impacted. A department spokesperson told BleepingComputer that officials "are aware of a recent cyber incident involving a specific, unclassified legacy information sharing environment." The spokesperson added, "We immediately took action to isolate the affected systems, mitigate the vulnerability, and launch a comprehensive forensic investigation. There is no indication that classified networks were impacted, and the system remains operational for our partners. As this is an ongoing investigation, we cannot provide further operational details at this time."

This is the second known security incident involving HSIN in three years. During 2023 a contractor's coding mistake created an access misconfiguration that made restricted material inside HSIN-Intel visible to the entire user base instead of only approved individuals. An internal DHS memo reviewed by Wired described how permissions were inadvertently changed to "everyone," thereby exposing records that included sensitive U.S. person data and other personally identifiable information.