Chinese Hackers Breach US Treasury Through Third-Party Software

The U.S. Treasury Department has disclosed a cyberattack attributed to a Chinese state-sponsored group that accessed employee workstations and unclassified documents. The breach, described as a “major incident” by the department, occurred through a compromised third-party software provider, BeyondTrust. This revelation highlights the persistent challenges in cybersecurity faced by government agencies.

In a letter to lawmakers dated December 30, Aditi Hardikar, the assistant secretary for management at the Treasury Department, detailed how the breach unfolded. BeyondTrust, a vendor offering remote technical support, informed the Treasury on December 8 about unauthorized access to a security key used in its cloud-based services. This key allowed attackers to bypass security protocols and infiltrate Treasury systems.

The attackers gained access to several employee workstations and unclassified files, although the department has stated that there is no evidence of continued access to its systems. The breach prompted immediate action, including collaboration with the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and other intelligence agencies to assess the full scope of the incident.

China has denied involvement in the attack, with Mao Ning, a spokesperson for the Chinese Ministry of Foreign Affairs, rejecting the accusations as baseless. In a briefing, Mao reiterated that China opposes all forms of hacking and accused the U.S. of spreading misinformation for political purposes. Similarly, a representative from the Chinese Embassy in Washington dismissed the claims, stating that there is no factual basis for the allegations.

BeyondTrust, the software provider at the center of the breach, confirmed it had identified and addressed the security incident earlier in December. The company notified affected customers and is cooperating with law enforcement to support the investigation. A statement from BeyondTrust revealed that a digital key used for its remote support services had been compromised, facilitating the breach.

The Treasury Department’s spokesperson emphasized the seriousness of the incident, highlighting the department’s ongoing efforts to strengthen its cybersecurity defenses. Over the past four years, the department has invested heavily in protecting its systems and the data it safeguards. Officials noted that the compromised service has been taken offline, and measures have been implemented to prevent future incidents of this nature.

This breach comes against the backdrop of an ongoing cyberespionage campaign linked to China. Known as Salt Typhoon, this campaign has targeted critical infrastructure and telecommunications systems across the U.S., affecting multiple organizations. In response, the FBI and CISA have urged companies to bolster their cybersecurity measures to mitigate risks from state-sponsored actors.

The Treasury Department has informed lawmakers that it will provide a supplemental report in 30 days, outlining the findings of its investigation and the broader implications of the breach. As of now, the exact nature of the accessed documents and the level of exposure remain unclear. However, officials believe the attackers were primarily focused on gathering intelligence rather than causing direct harm or stealing financial assets.

This incident highlights the vulnerabilities within interconnected systems and the increasing reliance on third-party service providers, which can become weak links in cybersecurity defenses. The breach serves as a reminder of the importance of robust security measures, especially for entities managing sensitive national and economic data.

While investigations continue, the U.S. Treasury Department is committed to learning from the incident and enhancing its resilience against future threats. The attack exemplifies the need for greater vigilance and collaboration between public and private sectors to safeguard critical infrastructure and protect sensitive information from malicious actors.

Image is licensed under the Creative Commons Attribution 2.0 Generic license and was created by the Department of Treasury and was uploaded by LongLiveRock.