US intelligence agencies have deemed a cybersecurity breach at the Treasury Department a “major incident,” following an assessment of its impact.
A letter sent to lawmakers on Monday revealed that suspected Chinese state-sponsored hackers infiltrated the US Treasury Department, accessing unclassified documents and employee workstations.
The Treasury Department was notified of the breach on December 8th by BeyondTrust, a third-party software provider. Hackers obtained a security key used by the vendor to access a cloud-based service providing remote technical support. This key allowed them to bypass security protocols, remotely access specific workstations, and view unclassified documents stored on those systems.
“Based on available indicators, the incident has been attributed to a Chinese state-sponsored Advanced Persistent Threat (APT) actor,” the Treasury Department declared in a December 30th statement.
The department has designated this breach a significant cybersecurity incident and is collaborating with the FBI, the intelligence community, and other investigative bodies to determine the extent of the damage. The compromised service has been disabled, and there is no indication of ongoing unauthorized access to Treasury data.
A Treasury Department spokesperson, as reported by the New York Times, underscored the department’s serious approach to such threats and its commitment to collaborating with both public and private sector partners to safeguard the financial system. A more detailed report on the breach will be submitted to Congress within 30 days.
This incident follows recent reports of another breach allegedly perpetrated by a different Chinese hacking group, known as Salt Typhoon, which reportedly compromised US telecommunications systems. The hackers gained access to phone conversations and text messages of US officials, including those of President-elect Donald J. Trump and Vice President-elect JD Vance, in what has been described as “the largest telecommunications hack in our nation’s history.”
The Salt Typhoon breach targeted major telecommunications companies like AT&T, Verizon, and Lumen. This access provided the hackers with valuable intelligence on US surveillance operations, including a near-complete list of phone numbers under Justice Department wiretaps for criminal or espionage investigations.
Beijing has consistently rejected hacking accusations from Washington. Earlier this month, the Chinese Foreign Ministry stated that the US uses these accusations to unfairly criticize China and justify unilateral sanctions.
“We urge the US to stop using cybersecurity issues to smear and vilify China and to cease imposing illicit unilateral sanctions,” said Chinese Foreign Ministry spokesperson Mao Ning.