U.S. authorities have confirmed that a Chinese state-sponsored hacking group infiltrated the Treasury Department, gaining access to government employees’ workstations and unclassified documents.
The breach was first detected on December 8 by BeyondTrust, a third-party software service provider, and was later confirmed by President Joe Biden’s administration.
Reports indicate the hackers obtained a security key that allowed remote access to specific Treasury workstations and the documents stored on them.
“Based on available indicators, the incident has been attributed to a China state-sponsored Advanced Persistent Threat (APT) actor,” the Treasury Department stated in a letter to lawmakers. The department classified the breach as a “major cybersecurity incident” under its policies.
In response, the Treasury Department is collaborating with the FBI, intelligence agencies, and other investigators to evaluate the extent of the intrusion.
The compromised service has been deactivated, and officials report no evidence suggesting that the attackers maintain access to Treasury systems.
