Loading story…
The US federal government faced a shutdown after Congress failed to pass funding for the fiscal year 2026, directly impacting federal agencies, including the Cybersecurity and Infrastructure Security Agency (CISA). As a result of the funding lapse, the Department of Homeland Security (DHS) estimated that approximately two-thirds of CISA’s workforce, or about 1,651 out of 2,540 employees, would be furloughed, leaving only 889 personnel to continue critical operations. This significant reduction in cybersecurity staff raised concerns among government officials and cybersecurity experts about the potential for increased cyber risk to federal systems and infrastructure. The shutdown’s impact on CISA was expected to slow, but not entirely halt, ongoing cybersecurity projects and incident response capabilities. The Biden administration’s previous shutdown guidance in 2023 had anticipated a similar scale of furloughs, but the current contingency plan under the Trump administration did not specify how many employees could be recalled if needed. The lack of clarity on recallable staff heightened uncertainty about the government’s ability to respond to cyber incidents during the shutdown. Government contractors and private sector partners were advised to harden their cybersecurity postures in anticipation of reduced federal support and oversight. The shutdown served as a stark reminder of the interconnectedness between government funding and national cybersecurity readiness. Experts warned that adversaries might exploit the temporary reduction in federal cyber defenses, increasing the risk of attacks on government networks. The situation also underscored the importance of continuity planning for essential cyber operations during periods of political and fiscal instability. CISA’s diminished capacity could delay vulnerability management, threat intelligence sharing, and incident response activities across federal agencies. The shutdown’s timing coincided with ongoing cyber threats targeting critical infrastructure, amplifying the potential consequences of reduced federal cyber oversight. The uncertainty surrounding the duration of the shutdown further complicated risk assessments and response planning for both government and private sector entities. The event highlighted the need for robust contingency measures to maintain cybersecurity resilience during government funding lapses. Federal agencies and contractors were urged to review and update their incident response and business continuity plans in light of the evolving situation. The shutdown’s impact on CISA and broader federal cybersecurity operations was closely monitored by industry stakeholders and policymakers alike.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
A funding lapse affecting most Department of Homeland Security agencies ended in late April or early May 2026, but industry representatives said contracts supporting cybersecurity, disaster response, and preparedness had been operating at reduced capacity. The Professional Services Council warned DHS could take until the end of 2026 to recover fully and urged the department to accelerate contractor reimbursements and related payments.
The State and Local Cybersecurity Grant Program was reauthorized during the DHS shutdown, but the funding lapse still prevented the program from operating normally. The development highlighted that even renewed statutory authority did not restore affected DHS-administered cyber support activities while the shutdown continued.
After nearly eight weeks of shutdown-related furloughs, the Department of Homeland Security ordered furloughed CISA employees to return to work despite the continuing funding lapse. DHS said it was using available funding to restore the full workforce and process back pay, marking a significant operational shift after weeks of reduced cyber capacity.
As the shutdown took effect, partners were warned to expect slower alerts, fewer updates, and reduced vulnerability scanning and mitigation support from federal agencies. The lapse also coincided with the expiration of the Cybersecurity Information Sharing Act of 2015 and the interruption of some state and local cyber support arrangements, creating added uncertainty for threat-information sharing.
A U.S. federal government shutdown began shortly after midnight on October 1, triggering widespread furloughs across civilian agencies. CISA reportedly lost about 65% of its workforce, while other cyber-related entities such as NIST also faced major staffing cuts.
Ahead of a funding lapse, reporting indicated that roughly two-thirds of Cybersecurity and Infrastructure Security Agency personnel could be sent home if the U.S. government shut down, signaling major reductions in federal cyber operations.
10 references tracked. Mallory keeps watching after this page renders.
govexec.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcegovtech.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcetechrepublic.com
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The recent U.S. federal government shutdown has significantly impacted the nation's cybersecurity posture, particularly by reducing the operational capacity of the Cybersecurity and Infrastructure Security Agency (CISA) to just 35% of its workforce. This drastic reduction has strained state, local, tribal, and territorial cyber offices, which rely heavily on federal support for threat intelligence, incident response, and ongoing cybersecurity projects. Numerous projects have been stalled, and essential grant programs have been frozen, impeding the progress of critical cyber initiatives at multiple government levels. The lapse of the 2015 Cybersecurity Information Sharing Act during the shutdown has further hindered the timely exchange of threat intelligence, leaving many organizations less prepared to respond to emerging threats. In the healthcare sector, the shutdown has increased cybersecurity risks by depriving smaller providers of access to CISA's free tools and alerts, which are vital for defending against ransomware and other cyberattacks. The slowdown in HIPAA investigations and breach reporting has created additional vulnerabilities, as regulatory oversight and enforcement are delayed. Critical rulemaking on privacy and security has also been stalled, potentially leaving gaps in compliance and best practices. Operational technology (OT) environments, which are already challenged by outdated systems and unpatched vulnerabilities, face mounting threats as attackers exploit exposed internet-connected controls. The lack of federal support has made it more difficult for organizations to maintain visibility and proper network segmentation in these environments, increasing the risk of successful cyberattacks. The shutdown's ripple effects extend to the freezing of cybersecurity grants, which are essential for funding state and local cyber defense initiatives. The overall reduction in federal cybersecurity capacity has left many public and private sector entities more vulnerable to both opportunistic and targeted attacks. The situation underscores the critical importance of sustained federal investment and coordination in cybersecurity, especially as threat actors continue to exploit periods of government disruption. The panel of ISMG editors highlighted the urgent need for contingency planning to ensure continuity of cyber defense operations during future shutdowns. The healthcare sector, in particular, is at heightened risk due to its reliance on federal resources for both compliance and incident response. The editors also noted that the shutdown has exposed systemic weaknesses in the nation's approach to protecting aging OT infrastructure. The combination of stalled projects, reduced workforce, and frozen funding has created a perfect storm for cyber adversaries seeking to exploit gaps in U.S. cyber defenses. The long-term impact of the shutdown may include delayed recovery from incidents, increased costs for breach remediation, and a loss of public trust in the government's ability to safeguard critical infrastructure. The situation serves as a stark reminder of the interconnectedness of federal operations and national cybersecurity resilience.
Jun 29, 2026
The ongoing US federal government shutdown has significantly disrupted cybersecurity operations and support across multiple sectors, raising concerns among experts and officials about increased vulnerability to cyber threats. State and local cybersecurity teams are already experiencing the effects of the shutdown, with the expiration of a statute that previously shielded companies from liability when sharing cyberthreat indicators, and the abrupt halt of state cybersecurity grant programs. The Cybersecurity and Infrastructure Security Agency (CISA) has been affected by furloughs, reducing its capacity to support state and local governments. A March executive order had already shifted much of the federal government’s cybersecurity risk management responsibilities onto state and local agencies, but critics argue that this transition was not accompanied by sufficient resources, leaving many jurisdictions underprepared. Larger states with established cyber agencies may be able to temporarily absorb the impact, but smaller states and rural governments that depend heavily on federal support and grants are facing significant challenges in maintaining their cyber defenses. In the healthcare sector, the shutdown has disrupted regulatory work and left health entities more vulnerable, as many providers rely on federal agencies for cybersecurity-related support and resources. Experts warn that adversaries could exploit the situation by launching high-impact cyber incidents, potentially causing prolonged disruptions in the health sector and impacting patient safety and the ability to provide life-saving services. The Health Information Sharing and Analysis Center (Health-ISAC) has been tracking ransomware incidents since 2020, and forecasts a record-breaking number of attacks in 2025, with the shutdown exacerbating the risk. The Department of Health and Human Services (HHS) has stated that 'mission critical' work is continuing, but more than 41% of its employees have been furloughed, reducing its operational capacity. The combination of reduced federal staffing, halted grant programs, and the expiration of key legal protections has created a perfect storm for cyber adversaries to exploit. The uneven impact across states means that the national cybersecurity posture is now fragmented, with some regions far more exposed than others. The shutdown’s effects are expected to outlast its duration, as the disruption to information sharing and resource allocation will take time to recover. Experts emphasize that the current environment is highly risky, with both public and private sector entities needing to be on heightened alert for cyberattacks. The situation underscores the critical importance of sustained federal support and coordination in defending against increasingly sophisticated cyber threats.
Jul 12, 2026
Cyberattacks against US government agencies and employees surged by 85% following the federal government shutdown that began on October 1. With agencies paused and employees furloughed, threat actors exploited the weakened state of federal cybersecurity, resulting in a projected 555 million attacks by the end of the month. Experts warn that the most severe consequences may not be immediate breaches, but rather long-term risks as attackers establish footholds for future exploitation. The shutdown has also exacerbated existing challenges, such as recruiting difficulties and eroding trust in government institutions, potentially leaving agencies and the nation more vulnerable in the long run. Compounding the situation, recent layoffs at the Cybersecurity and Infrastructure Security Agency (CISA) have further diminished the federal government's capacity to coordinate cyber defense. CISA, which has served as the central hub for sharing threat intelligence and orchestrating joint defense efforts between public and private sectors, now faces reduced resources at a time when global cybercrime is accelerating and adversaries are leveraging advanced technologies like AI. The reduction in federal cyber infrastructure means slower alerts, thinner intelligence pipelines, and increased uncertainty for enterprises that rely on timely information to manage risk, creating a vacuum that adversaries are poised to exploit.
Jul 12, 2026