Homeland Security Secretary Kristi Noem announced Friday that she had terminated two dozen Federal Emergency Management Agency employees following what she described as “massive” cybersecurity failures that compromised government networks and put operations at risk.
The firings included FEMA Chief Information Officer Charles Armstrong, Chief Information Security Officer Gregory Edwards, and 22 other IT staffers.
“FEMA’s career IT leadership failed on every level. Their incompetence put the American people at risk,” Noem said in a statement. “When DHS stepped in to fix the problem, entrenched bureaucrats worked to prevent us from solving the problem and downplayed just how bad this breach was.”
The cybersecurity breach was uncovered after Noem ordered a review of FEMA’s systems, per the New York Post.
Officials stated that a “threat actor” accessed the agency’s network, though it remains unclear whether the intrusion originated from a foreign source. A FEMA spokesperson said, “Are we lucky no actual American citizens were impacted? Yes, but it’s a huge flaw.”
Department of Homeland Security personnel identified and removed the threat actor, but discovered that FEMA IT staff had re-enabled compromised credentials. DHS sources accused the ousted employees of lying about the extent of vulnerabilities and avoiding scheduled inspections.
The breach comes amid growing concern over Chinese state-linked cyberattacks on U.S. government systems.
Microsoft reported that two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon, had exploited SharePoint vulnerabilities last month, targeting agencies including the National Nuclear Security Administration.
FEMA, which spent nearly half a billion dollars on IT and cybersecurity in fiscal year 2025, was also using Microsoft software.
Noem emphasized the seriousness of the failures. “These deep-state individuals were more interested in covering up their failures than in protecting the Homeland and American citizens’ personal data, so I terminated them immediately,” she said. “The American people deserve results from their government.”
The DHS secretary also criticized FEMA for failing to implement basic cybersecurity safeguards, including multi-factor authentication and other critical protections. The ousted staff were accused of downplaying the breach to DHS officials, preventing timely resolution, and putting sensitive systems at risk.
FEMA has faced increasing scrutiny in recent years for lapses in its IT security and preparedness for national emergencies. Noem’s move marks one of the most aggressive actions taken against the agency’s leadership in recent memory. By removing the top IT officials and several other personnel, Noem signaled a shift toward stricter oversight and accountability.
Officials say DHS will continue monitoring FEMA systems and implementing additional cybersecurity protocols to prevent future breaches. The department is also conducting an internal review of operational practices to ensure that employees follow security guidelines and do not conceal vulnerabilities in critical federal networks.
“This is about protecting the American people, their data, and our national security,” Noem concluded. “Failures like this cannot be tolerated. Results matter, and we will hold people accountable when they fail the public.”
The firings are expected to reverberate across FEMA and DHS, as the agencies work to stabilize IT operations and rebuild trust in their cybersecurity posture.
