DHS Dismissed Warning Signs Before Hackers Spent Weeks Inside Secret-Sharing Network, GAO Finds

DHS analysts twice dismissed suspicious activity on the Homeland Security Information Network, the unclassified platform agencies and law-enforcement partners use to share sensitive data, letting intruders remain inside for weeks before the department declared an active breach on June 4, 2026, according to October reporting on a forthcoming GAO audit. Suspicious activity began in mid-May; the hackers installed hidden access points and stole credential data, and DHS has said it is unclear what, if any, data was taken.

The audit, mandated by a 2025 defense policy law, will cover three HSIN-related security incidents from 2023 to 2026, including two caused by employee or contractor coding errors that exposed restricted information to unauthorized users. GAO is expected to find that DHS delayed notifying Congress about the incidents.

Sen. Mark Warner said the exposure "risks national security." No release date has been set for the final report, and DHS has not confirmed whether any data was stolen.