DHS confirms breach of unclassified Homeland Security information-sharing network

The US Department of Homeland Security has confirmed a breach of the Homeland Security Information Network, an unclassified but sensitive platform that federal, state, local, and private-sector partners use to share threat information and coordinate operations. The intrusion is believed to have happened between late May and early June, and according to reporting, the attackers targeted HSIN servers and an associated SharePoint collaboration system. DHS says it isolated the affected systems, that classified networks were not touched, and that the platform remains operational, but it has not attributed the attack or confirmed whether documents were stolen. Even without confirmed theft, compromising this coordination hub is operationally significant.

Check

Organizations that connect to or share data through HSIN should watch for follow-on phishing or misuse of any exposed coordination data, and confirm the security of their own SharePoint collaboration systems.

Affected

Federal, state, local, and private-sector partners who use HSIN to share sensitive information; the breach hit HSIN servers and a linked SharePoint system, though data theft is not confirmed.

Fix

Patch and harden SharePoint and other collaboration platforms, segment sensitive information-sharing systems, enforce phishing-resistant MFA, and monitor for unusual access, given attackers are actively targeting SharePoint and coordination hubs.