DHS investigates breach in sensitive Homeland Security network

The Department of Homeland Security said it was investigating a breach in its unclassified legacy information-sharing environment, a network that sits inside the government’s homeland-security coordination chain. The intrusion puts pressure on a system built to carry sensitive but unclassified threat information among federal, state, local and private partners.

DHS made the disclosure on July 2 and gave no further detail about the compromise. Reuters said the department did not answer follow-up questions, leaving open who got in, how long they remained inside the network and whether any operational data was touched. The incident was believed to have happened between late May and early June, a gap that suggests it may have gone unnoticed for weeks.

GovExec identified the network as the Homeland Security Information Network, or HSIN, DHS’s official system for trusted sharing of Sensitive But Unclassified information. The platform is used by federal, state, local, territorial, tribal, international and private-sector partners, making it a rare place where emergency planners, law enforcement and infrastructure operators can all share the same threat picture. DHS says law enforcement uses HSIN to coordinate on weapons smuggling, narcotics trafficking and gang mitigation.

The critical-infrastructure side of the network, known as HSIN-CI, is designed for private-sector owners and operators, DHS and other agencies to collaborate on protecting the nation’s essential systems. It supports document sharing, alerts, instant messaging and virtual meeting space, which means a breach could disrupt more than a mailbox or a file server. If attackers saw the wrong set of contacts, warnings or operational notes, they could map who talks to whom and when, then use that knowledge to interfere with response plans or exploit weak points in partner coordination.

Sen. Mark Warner, the vice chair of the Senate Select Committee on Intelligence, said he was “deeply concerned” by the compromise and called the information on the network “highly sensitive” even though it is not classified. Warner urged DHS and the Justice Department to investigate who breached the network and what was compromised. His office issued a statement on July 1, a day before DHS publicly acknowledged the investigation, underscoring how quickly the matter has moved from a technical incident to a congressional security concern.

The breach adds to a familiar weakness in federal cyber defense: older systems that still carry the connective tissue of government operations. Even without classified material, a network like HSIN can expose the operational habits, partner relationships and response structures that make homeland-security coordination work.