The Department of Homeland Security has been rocked by a major cybersecurity scandal, one that exposed both FEMA’s operational weaknesses and the political storm surrounding DHS Secretary Kristi Noem.
According to internal notifications reviewed by Nextgov/FCW, the breach began June 22, when a hacker slipped into FEMA Region 6 systems — which cover Arkansas, Louisiana, New Mexico, Oklahoma, and Texas — using stolen credentials to exploit Citrix Systems’ remote desktop software. The attacker reportedly spent weeks inside, moving through servers undetected even after DHS was alerted on July 7.
By late August, the fallout was undeniable. Noem announced she had fired at least two dozen FEMA employees, including senior IT executives, blaming what she called “entrenched bureaucrats” for downplaying the severity of the intrusion.
“These deep-state individuals were more interested in covering up their failures than in protecting the Homeland and American citizens’ personal data, so I terminated them immediately,” she said.
Her firings followed a DHS review that painted a damning picture: FEMA lacked multi-factor authentication, relied on prohibited legacy protocols, failed to patch critical vulnerabilities, and suffered from a basic lack of operational visibility. In short, the systems meant to protect both agency operations and sensitive data were left wide open.
Citrix itself hasn’t escaped scrutiny. Internal notes suggest the company failed to convey the full scope of the threat to FEMA, leaving agency IT staff struggling to piece together the breach as it unfolded. That detail adds another layer of blame, though it doesn’t erase FEMA’s own internal failures.
The political ramifications have been swift. Region 6 covers a swath of the southern border — already a flashpoint in national politics — making the breach both a security and symbolic liability. And Noem’s record at FEMA is under renewed fire.
Earlier this year, she was criticized for creating a bottleneck by personally approving all payments over $100,000, delaying deployment of search-and-rescue teams during deadly Texas floods. At the same time, she reportedly used her authority to fast-track millions in disaster relief for a Florida tourist pier after a campaign donor intervened.
Now, Democrats are citing a Government Accountability Office report that accuses FEMA of six violations of federal law under Noem’s leadership and are openly calling for her resignation.
