"The Department of Homeland Security is aware of a recent cyber incident involving a specific, unclassified legacy information sharing environment," DHS told BleepingComputer.
The Homeland Security Information Network and what it holds
The Homeland Security Information Network (HSIN) is a Department of Homeland Security platform designed for sharing sensitive but unclassified information among federal, state, local, international and private-sector partners. Approved users rely on HSIN to access data, exchange requests with partner agencies, manage operations, coordinate safety and security for planned events, respond to incidents, and share critical information needed to protect communities. The platform supports real-time communication, alerts and incident management, and is used to exchange information about persons of interest and potential threats.
Scope and timeline of the intrusion
According to reporting in Nextgov and two people familiar with the matter who spoke on the condition of anonymity, the intrusion was carried out by an unknown threat actor in recent weeks and is believed to have occurred sometime between late May and early June. Those sources told Nextgov the actors targeted HSIN servers as well as a SharePoint system used for collaboration efforts. Whether any documents were stolen remains unclear.
DHS actions, investigation, and impact on classified systems
In a statement to BleepingComputer, DHS said it "immediately took action to isolate the affected systems, mitigate the vulnerability, and launch a comprehensive forensic investigation." The department added, "There is no indication that classified networks were impacted, and the system remains operational for our partners. As this is an ongoing investigation, we cannot provide further operational details at this time." DHS has not publicly attributed the incident to any specific threat actor or foreign government.
The department's Office of Intelligence and Analysis has conducted a damage assessment of the breach, according to reporting. Beyond that assessment and the steps DHS describes taking, officials have not released additional operational details while the forensic investigation continues.
Context from HSIN's prior security problem in 2023
HSIN is not new to security scrutiny. In 2023, the platform experienced a security incident when an access misconfiguration tied to a contractor's coding error exposed restricted data within HSIN-Intel, the platform's intelligence section. An internal DHS memo seen by Wired said the error set access permissions to "everyone" rather than a limited group of authorized users, exposing information including sensitive U.S. person data and other personally identifiable information to all of HSIN's users. That earlier episode is a concrete precedent for concerns about accidental or improper access to sensitive but unclassified data on the platform.
What this means for World Cup organizers, federal and local partners, and private-sector users
- World Cup organizers and event-security planners: Nextgov flagged that, with the United States overseeing security for World Cup games hosted across the country, the breach could have exposed security planning, interagency coordination or response procedures. Those teams will be watching DHS's forensic findings and any inventory of data accessed or exfiltrated.
- Federal and state/local coordination partners: Agencies that depend on HSIN for real-time alerts, incident management and exchange of information about persons of interest will weigh the department's containment steps and the results of the Office of Intelligence and Analysis damage assessment as they decide whether to alter operational practices or shift coordination to alternate channels.
- Private-sector users and collaborating entities: Businesses and non-governmental partners that use HSIN for coordinated operations will want confirmation of what data, if any, were exposed and may reassess reliance on the affected legacy environment until the forensic investigation concludes and mitigation steps are validated.
The breach leaves two simple but consequential facts: DHS has confirmed an intrusion into an unclassified HSIN environment and is investigating, and the department reports no indication that classified networks were impacted. What remains to be seen—and will determine the operational fallout—is whether the forensic investigation uncovers data exfiltration, the identity or origin of the threat actor, and whether any procedural or configuration changes are required to prevent a repeat of the 2023 misconfiguration that previously exposed sensitive information.
Read the original BleepingComputer report: https://www.bleepingcomputer.com/news/security/dhs-confirms-hackers-breached-hsin-info-sharing-platform/
