(28.9.2017) DHS spokesman Scott McConnell said notifications to 21 states were “based on a variety of sources, including scanning detected from malicious IP addresses and intelligence information that cannot be publicly disclosed.”