An investigation revealed security failures in the agency’s operations and IT systems.
Homeland Security Secretary Kristi Noem has fired 24 workers at the Federal Emergency Management Agency (FEMA) after a cyber breach threatened national security, she announced on Aug. 29.
A cyber hacker breached FEMA systems, but no sensitive data was taken from any Department of Homeland Security (DHS) networks, the department reported. FEMA is an agency within the DHS.
FEMA’s chief information officer, chief information security officer, and 22 other IT employees allegedly responsible for the security failure were immediately terminated.
Noem accused longtime employees of working to prevent DHS personnel from solving the problem and downplaying how bad the breach was when DHS stepped in to fix the issue.
While conducting a routine cybersecurity review, the DHS’s chief information officer discovered “significant security vulnerabilities” that gave a hacker access to FEMA’s network.
“The investigation uncovered several severe lapses in security that allowed the threat actor to breach FEMA’s network and threaten the entire Department and the nation as a whole,” the DHS reported.
Noem had ordered the review of all of FEMA’s operations and IT systems, according to DHS.
The alleged failures included an agency-wide lack of multi-factor authentication, use of prohibited legacy protocols, failing to fix known vulnerabilities, and inadequate operational visibility.
FEMA spent nearly half a billion dollars on IT and cybersecurity measures in fiscal year 2025.
News of the FEMA security breach and the firings came days after nearly 200 current and former FEMA employees signed a declaration protesting the Trump administration’s disaster response changes.
The employees published a petition to Congress, arguing FEMA is under the leadership of people “lacking legal qualifications, Senate approval, and the demonstrated background required of a FEMA Administrator.”
The employees alleged that FEMA’s senior officials and Noem hinder the agency’s mission. The declaration also told Congress that the alleged inexperience of Trump’s appointees could lead to another catastrophe similar to Hurricane Katrina in 2005, which claimed nearly 1,400 lives in New Orleans and along the Gulf Coast of Louisiana and Mississippi.
