Chinese Hackers Compromise US Treasury Workstations in Major Cybersecurity Incident

Chinese hackers infiltrated several workstations at the US Treasury Department, accessing unclassified documents through a third-party software provider, according to the agency. The department did not specify the number of workstations affected or the types of documents accessed. However, it assured lawmakers in a letter that "at this time there is no evidence indicating the threat actor has continued access to Treasury information." The incident is being treated as a "major cybersecurity incident."

"Treasury takes very seriously all threats against our systems, and the data it holds," stated a department spokesperson. "Over the last four years, Treasury has significantly bolstered its cyber defense, and we will continue to work with both private and public sector partners to protect our financial system from threat actors."

Cybersecurity Breach Investigation

The breach was discovered on December 8 when BeyondTrust, a third-party software provider, alerted the Treasury Department. Hackers had stolen a key from BeyondTrust, allowing them to bypass security measures and remotely access several employee workstations. The compromised service has since been deactivated, and there is no evidence that hackers still have access to department information, according to Aditi Hardikar, an assistant Treasury secretary.

The department is collaborating with the FBI and the Cybersecurity and Infrastructure Security Agency to investigate the breach's extent. The attack has been attributed to Chinese state-sponsored hackers, although further details were not provided.

Ongoing Cybersecurity Concerns

This revelation comes amid ongoing concerns about a large-scale Chinese cyberespionage campaign known as Salt Typhoon. This campaign has allowed Beijing officials access to private texts and phone conversations of numerous Americans. A senior White House official recently disclosed that nine telecommunications companies have been affected by this hack.

The US Treasury Department remains vigilant in its efforts to safeguard its systems against cyber threats. It continues to enhance its cybersecurity measures while working closely with both private and public sector partners. These efforts aim to protect the financial system from potential threats posed by malicious actors.

The breach underscores the importance of robust cybersecurity measures in protecting sensitive government information. As investigations continue, authorities are focused on understanding the full scope of the incident and preventing future breaches.