The breach occurred in early December when hackers compromised a third-party cybersecurity service provider to manage access to the unclassified documents, said US officials.
A China “state-sponsored” actor infiltrated the US Treasury Department workstations and got remote access of some of the workstations along with some unclassified documents earlier this month, according to multiple US media outlets.
The hackers compromised third-party cybersecurity service provider BeyondTrust and managed access to the unclassified documents. The US officials added that the breach occurred in early December and was made public in a letter penned by the Treasury Department to lawmakers notifying them of the incident.
The US agency has described the breach as a “major incident” and said it had been working with the FBI and other investigating agencies to probe the case.
“The compromised BeyondTrust service has been taken offline and there is no evidence indicating the threat actor has continued access to Treasury systems or information,” the department’s spokesperson said.
“Based on available indicators, the incident has been attributed to a China state-sponsored Advanced Persistent Threat (APT) actor,” the Treasury added in its letter to the leadership of the Senate Banking Committee.
Based on Treasury policy, intrusions attributed to advanced persistent threat actors are considered a “major cybersecurity incident,” Aditi Hardikar, assistant secretary for management at the US Treasury, wrote in the letter.
An APT, or Advanced Persistent Threat, is a type of cyberattack in which an intruder gains and maintains unauthorised access to a target system, often remaining undetected for an extended period.
The department did not provide further details on what was affected by the breach but said more information would be released in a supplemental report at a later date. “Treasury takes very seriously all threats against our systems, and the data it holds,” the Treasury spokesperson added.
The official said that the department would continue working to protect the US financial system from threats.
Alarm Over Hacks
In recent years, many countries, including the United States, have raised alarm over Chinese-government-backed hacking activities targeting their governments, militaries and businesses.
Beijing has countered the allegations and has previously said that it opposes and cracks down on all forms of cyberattacks threatening systems worldwide.
