Cyber Incident Victim: Department of Homeland Security

The Department of Homeland Security is investigating a breach of its Homeland Security Information Network (HSIN) that occurred during late May and early June, when hackers reportedly broke into HSIN servers and potentially exposed information shared through the platform. A DHS spokesperson confirmed that the department is aware of a recent cyber incident involving a specific, unclassified legacy information sharing environment and said the investigation is ongoing. Officials have not disclosed what data, if any, was taken or the volume of any potential loss. The breach has prompted renewed scrutiny of the federal government’s ability to defend its own systems, particularly after a series of budget cuts across agencies. Senator Mark Warner noted that HSIN supports the World Cup games and was used the previous year to manage the response to a mid‑air collision, underscoring the platform’s role in critical coordination efforts. The identity of the attackers remains unknown, and no group has been publicly linked to the HSIN intrusion.

Separately, a critical vulnerability in Check Point Software’s remote access tools, firewalls, and VPN systems began to be exploited on May 7, with activity increasing sharply the following week. The flaw, which affects digital gateways that protect networks from unauthorized access, is being actively used by the ransomware group Qilin to compromise organizations that rely on these security technologies. Check Point has confirmed that Qilin has hacked into a few dozen targeted organizations worldwide using the exploited vulnerability. In response to the heightened risk to federal government networks, the Cybersecurity and Infrastructure Security Agency issued an urgent directive on June 10 ordering all civilian agencies to remediate the flaw by the end of day June 11. The directive applies to major civilian agencies including the Department of Homeland Security, the Department of State, and the Treasury, and is grounded in Operational Directive BOD 22‑01, which authorizes CISA to mandate security actions when active threats threaten government systems.

HSIN is described as a platform used by federal, state, and local governments and law enforcement agencies to share intelligence, plan and coordinate responses to major events, and exchange information during emergencies. It is characterized as a legacy, unclassified information sharing environment that supports a range of intergovernmental operations. Officials have highlighted its use in high‑profile scenarios such as the World Cup games and the prior year’s response to a mid‑air collision, illustrating its importance for situational awareness and crisis management. The ongoing investigation into the HSIN breach seeks to determine the scope of any exposure and to assess the implications for future risks to the network’s integrity.

The VPN vulnerability identified by Check Point affects remote access tools, firewalls, and VPN systems that serve as protective barriers for corporate and government networks. The exploitation by Qilin involves leveraging this flaw to gain unauthorized access to systems that depend on the affected security products. The widespread nature of the attacks, impacting dozens of organizations globally, prompted CISA to act swiftly to mitigate the threat across the federal enterprise. By mandating that agencies address the vulnerability by the June 11 deadline, CISA aims to reduce the likelihood of further compromise and to preserve the security posture of agencies such as the Department of Homeland Security that rely on these technologies for network defense. The situation reflects the coordinated response required when active cyber threats are identified within government infrastructure.