US Treasury says it was hacked by China in ‘major incident’

A Chinese state-sponsored hacker breached the systems of the U.S. Treasury Department, gaining access to employee workstations and some unclassified documents, officials said Monday.

The breach occurred in early December and was made public in a letter written by the Ministry of Finance to lawmakers reporting the incident.

The Treasury Department letter said the Chinese actor was able to override security using a key used by a third-party service provider that offers remote technical support to its employees.

The US agency described the breach as a “major incident” and said it was working with the FBI and other agencies to investigate the fallout.

The compromised third-party service, called BeyondTrust, has since been shut down, officials said. They added that there was no evidence that the hacker continued to access Treasury information.

Along with the FBI, the Department worked with the Cybersecurity and Infrastructure Security Agency and third-party forensic investigators to determine the overall impact of the breach.

Based on the evidence gathered so far, officials said the hack was carried out by an “Advanced Persistent Threat (APT) actor from China.”

“In accordance with Treasury Department policy, intrusions involving APTs are considered a serious cybersecurity incident,” Treasury officials wrote in a letter to lawmakers.

This is hot news. Check for updates.