DHS network intrusion was twice ruled a false positive before breach confirmed

The DHS Homeland Security Information Network (HSIN) was infiltrated in May–June; attackers altered files, used a legitimate web server to run malicious code, deleted logs, installed hidden backdoors, and stole credential files while initial alerts were misclassified as benign, allowing weeks of undetected access. DHS has isolated affected systems and initiated a forensic investigation, reporting no indication of classified network compromise but acknowledging potential exposure of sensitive unclassified information shared with partner organizations.