ALWAGHT- According to a letter sent to lawmakers on Monday, state-sponsored Chinese hackers are alleged to have infiltrated the US Treasury Department, accessing unclassified documents and some workstations used by government employees.
The Treasury Department was alerted to a cybersecurity breach on December 8 by BeyondTrust, a third-party software service provider. Hackers reportedly obtained a security key used to safeguard a cloud-based service providing technical support to Treasury Departmental Offices. Using this key, the attackers bypassed security measures, remotely accessed specific workstations, and retrieved unclassified documents stored on those systems. The breach has been attributed to a Chinese state-sponsored Advanced Persistent Threat (APT) actor, as confirmed in a formal letter dated December 30.
Classified as a major cybersecurity incident, the breach prompted the Treasury Department to collaborate with the FBI, intelligence agencies, and other investigators to assess the damage. The compromised service was swiftly taken offline, and officials have found no evidence of ongoing access by the hackers. A supplemental report detailing the incident’s scope is expected to be provided to Congress within 30 days, underscoring the department's efforts to address and mitigate the breach.
This attack comes on the heels of another significant breach reportedly orchestrated by a separate Chinese hacking group, Salt Typhoon. This group allegedly infiltrated US telecommunications networks, gaining access to phone conversations and text messages of high-profile officials, including President-elect Donald Trump and Vice President-elect JD Vance. Described as one of the largest telecommunications hacks in US history, the breach targeted major providers like AT&T, Verizon, and Lumen, exposing sensitive surveillance information and wiretapped phone numbers.
Beijing has consistently denied hacking allegations from Washington, calling them baseless and politically motivated. The Chinese Foreign Ministry has accused the US of using cybersecurity claims to malign China and justify unilateral sanctions. Spokesperson Mao Ning reiterated China’s stance, urging the US to cease its accusations and halt actions perceived as unjustified sanctions.