In a letter to lawmakers that Treasury officials gave to Reuters, the US Treasury Department stated Monday that a group of state-sponsored hackers from China had broken through the department’s computer security measures this month and taken documents. The Treasury referred to it as a “major incident.“
According to a Treasury spokeswoman cited by AFP. The intrusion occurred earlier this month when hackers gained remote access to Treasury workstations. Some unclassified data after breaching a third-party cybersecurity service provider called “BeyondTrust.”
On December 8, its provider BeyondTrust informed Treasury of the situation. That prompted the Treasury to reach out to the Cybersecurity and Infrastructure Security Agency. It disclosed that it was collaborating with the FBI and the US Cybersecurity and Infrastructure Security Agency. It also going to evaluate the impact of the incident.
The vendor’s key for securing a cloud-based service that remotely provides technical support for Treasury Departmental Offices (DO) end users was compromised by hackers, the letter claims. The threat actor used the stolen key to remotely access some Treasury DO user workstations, circumvent the security measures of the service, and get access to some of the users’ unclassified papers.
An email asking for additional information regarding the hack was not immediately answered by Treasury authorities. CISA forwarded inquiries back to the Treasury Department, and the FBI did not immediately reply to Reuters’ requests for comment.
According to the Treasury’s statement to the Senate Banking Committee’s leadership, “The incident has been ascribed to a China state-sponsored Advanced Persistent Threat (APT) actor.”
Read More News
