The Department of Homeland Security has confirmed that hackers breached the Homeland Security Information Network (HSIN), a sensitive but unclassified platform relied upon by federal, state, local, tribal, territorial, international, and private-sector partners to coordinate emergency response and share threat intelligence.
An unknown threat actor gained unauthorized access to HSIN sometime between late May and early June 2026, according to two people familiar with the matter who spoke to Nextgov on condition of anonymity.
The intrusion, first reported by Nextgov and later confirmed by BleepingComputer, targeted both HSIN servers and a SharePoint system used for inter-agency collaboration.
DHS’s Office of Intelligence and Analysis has since conducted a damage assessment of the breach, though the department has not yet attributed the attack to any specific threat actor or foreign government.
HSIN serves as DHS’s central hub for exchanging sensitive but unclassified information among government, international, and private-sector partners.
Approved users leverage the network to access operational data, exchange requests with partner agencies, coordinate security for major planned events, respond to incidents, and share mission-critical intelligence to protect their communities.
The platform also supports real-time communication, document sharing, alerts, web conferencing, and incident management, and is used to exchange information about persons of interest and potential threats to help agencies maintain situational awareness during emergencies.
In a statement provided to BleepingComputer, a DHS spokesperson confirmed the incident while emphasizing that classified systems remain unaffected:
“The Department of Homeland Security is aware of a recent cyber incident involving a specific, unclassified legacy information sharing environment. We immediately took action to isolate the affected systems, mitigate the vulnerability, and launch a comprehensive forensic investigation.There is no indication that classified networks were impacted, and the system remains operational for our partners. As this is an ongoing investigation, we cannot provide further operational details at this time”.
This is not the first security lapse tied to HSIN’s intelligence-sharing arm. A separate 2025 misconfiguration in the HSIN-Intel component briefly exposed restricted intelligence and investigative leads to tens of thousands of unauthorized platform users after access controls were mistakenly set to “everyone” instead of a restricted group.
The current breach has also drawn attention given HSIN’s role in coordinating security for major upcoming events, including World Cup 2026 preparations, raising concerns among lawmakers about potential national security exposure.
