U.S. Treasury says Chinese hackers remotely accessed workstations, documents in ’major’ cyber incident

Chinese hackers accessed U.S. Treasury workstations through a third-party software provider, prompting a major cybersecurity investigation.

Chinese hackers remotely accessed several U.S. Treasury Department workstations and unclassified documents after compromising a third-party software service provider, the agency said Monday.

Also Read | Chinese hackers breached U.S. court wiretap systems: Report

The department did not provide details on how many workstations had been accessed or what sort of documents the hackers may have obtained, but it said in a letter to lawmakers revealing the breach that “at this time there is no evidence indicating the threat actor has continued access to Treasury information.” It said the hack was being investigated as a “major cybersecurity incident.”

“Treasury takes very seriously all threats against our systems, and the data it holds,” a department spokesperson said in a separate statement. “Over the last four years, Treasury has significantly bolstered its cyber defense, and we will continue to work with both private and public sector partners to protect our financial system from threat actors.”

The revelation comes as U.S. officials continue to grapple with the fallout of a massive Chinese cyberespionage campaign known as Salt Typhoon, which gave officials in Beijing access to the private texts and phone conversations of an unknown number of Americans. A top White House official said on Friday (December 27) that the number of telecommunications companies confirmed to have been affected by the hack has now risen to nine.

The Treasury Department said it learned of the problem on December 8, when a third-party software service provider, BeyondTrust, flagged that hackers had stolen a key “used by the vendor to secure a cloud-based service used to remotely provide technical support” to workers. That key helped the hackers override the service's security and gain remote access to several employee workstations.

The compromised service has since been taken offline, and there's no evidence that the hackers still have access to department information, Aditi Hardikar, an assistant Treasury secretary, said in the letter Monday to leaders of the Senate Banking Committee.