On Monday, December 30, the Biden administration revealed that a Chinese state-sponsored hacking group had breached the U.S. Treasury Department, gaining access to government employees’ workstations and unclassified documents. This attack is part of a series of advanced surveillance operations targeting prominent U.S. institutions.
The Treasury Department informed lawmakers in a letter that the breach was discovered on December 8 by BeyondTrust, a third-party software service provider. The hackers reportedly obtained a security key that enabled remote access to specific Treasury workstations.
The Treasury attributed the incident to a Chinese state-sponsored Advanced Persistent Threat (APT) actor, describing it as a “major cybersecurity incident.”
While the exact goals of the hackers remain unclear, senior officials believe the attack was aimed at espionage rather than disrupting critical infrastructure. The Treasury handles sensitive data related to global financial systems, sanctions, and insights into China’s economic challenges, all of which are highly valuable to Beijing.
This breach follows previous incidents in which Chinese intelligence accessed the email accounts of U.S. officials, including Commerce Secretary Gina Raimondo, who was involved in decisions on export controls for advanced technologies. The hacking group, known as Salt Typhoon, has also infiltrated U.S. telecommunications companies, compromising phone conversations, text messages, and a near-complete list of phone numbers under Justice Department surveillance.
The breach included unencrypted lines used by top U.S. officials, raising concerns about Beijing’s ability to identify which Chinese spies are under investigation.
The Treasury Department has worked with the FBI, intelligence agencies, and other investigators to assess the breach. The compromised service has been taken offline, and officials believe the hackers no longer have access to Treasury systems.
A Treasury spokesperson emphasized the department’s commitment to safeguarding its systems and data, noting ongoing efforts to improve cybersecurity in collaboration with both the public and private sectors.
The timing of the breach’s disclosure is particularly sensitive, coming after the Salt Typhoon attack on U.S. telecommunications infrastructure. This prompted the Commerce Department to announce a ban on the remaining operations of China Telecom in the U.S.
Chinese officials have consistently denied involvement in cyberattacks and have engaged in discussions with the U.S. on cybersecurity cooperation. Earlier this month, Treasury representatives visited China to discuss economic and cybersecurity issues, underscoring the complexities of U.S.-China relations in the digital age.
The Treasury Department has pledged to provide additional details about the breach in an upcoming report to Congress.
