Hackers affiliated with the Chinese government infiltrated the United States Treasury Department earlier this month, gaining access to sensitive systems and stealing unclassified documents from agency workstations, according to a report.
The incident, described as a “major incident” by officials, highlights ongoing vulnerabilities in the cybersecurity defenses of critical government agencies.
The breach was detailed in a letter sent to lawmakers and later obtained by Reuters. According to the letter, the attackers exploited a key used by a vendor to secure a cloud-based service that provides remote technical support for the Treasury Departmental Offices (DO).
With access to the stolen key, the hackers bypassed the service’s security measures, remotely accessed certain user workstations, and retrieved unclassified documents maintained on those systems.
The New York Times reported that the breach was first detected on December 8, when software service provider BeyondTrust alerted the Treasury Department about the unauthorized activity.
The compromised service was promptly taken offline to prevent further access, and initial assessments indicate that the attackers did not gain access to additional departmental systems.
While the stolen documents were unclassified, the hack has raised significant concerns about the potential for future exploits and the broader implications