Hackers breached DHS after alarms were twice ruled 'false positives'

Department of Homeland Security logo on a flag.

• An internal DHS readout shows analysts twice dismissed intrusion alerts on the HSIN information-sharing network as false positives
• This effectively gave hackers roughly three weeks of undetected access before a breach was declared on June 4 2026
• The as-yet anonymous attackers altered server files, ran malicious code through a legitimate web-server program, deleted logs, installed backdoors, and stole credential files

Hackers managed to find their way into the US Department of Homeland Security's primary information sharing platform, gaining unfettered access to the HSIN network that hosts unclassified information that multiple US agencies and international rely on.