On December 30, 2024, the United States Department of the Treasury disclosed that it had been hacked by a state-sponsored actor of the People's Republic of China who gained access to unclassified documents.
On December 30, 2024, the United States Department of the Treasury disclosed that it had been hacked by a state-sponsored actor of the People's Republic of China who gained access to unclassified documents.
The United States government has accused the People's Republic of China (PRC) and its state-sponsored advanced persistent threats of hacking into its services. [1] In July 2024, PRC hackers compromised at least nine telecommunications companies. As part of its breach, Salt Typhoon obtained a nearly complete list of phone numbers wiretapped by the United States Department of Justice. Chinese hackers had previously compromised email accounts used by officials in the United States Department of Commerce and State, including secretary of commerce Gina Raimondo. [2]
On December 2nd, 2024, BeyondTrust, a privileged management company used by the United States Department of the Treasury, suffered a cyberattack that affected a limited number of customers using the company's remote support software. [3] Upon investigation it was discovered that the attackers gained access to a remote support SaaS API key, allowing them to make password resets against local application accounts. [4] The company noted that two separate command injection vulnerabilities were also discovered during investigation, but were not being actively exploited. [5] [6] [7] BeyondTrust is a FedRAMP vendor; if the department's implementation of its software was FedRAMP-certified, the hack would be the first breach of its kind, according to former National Security Agency hacker Jake Williams. [8]
On December 2, suspicious activity on servers operated by the Department of the Treasury was detected by BeyondTrust. The company identified that the department had been hacked three days later. [9] On December 8, BeyondTrust informed the department that a hacker had obtained an API key [10] for a cloud-based service used for remote technical support. [11] After the breach was discovered BeyondTrust revoked the stolen API key and shut down all compromised instances of the tool. [12] The company stated that the hacker was able to access unclassified documents, remotely access workstations, and override server security. [13] Several workstations were accessed. [14] The department contacted the Cybersecurity and Infrastructure Security Agency [15] and the Federal Bureau of Investigation, among other intelligence agencies and third-party investigators. [2] The service was taken offline and the hacker's access to department information is believed to have been removed. [16]
On December 30, assistant secretary of the Treasury for management Aditi Hardikar [17] informed Senate Committee on Banking, Housing, and Urban Affairs chairman Sherrod Brown and ranking member Tim Scott of the breach. [18] Agence France-Presse first reported on the letter. [15] The intrusion was considered a "major cybersecurity incident" as it was attributed to an advanced persistent threat; [2] other agencies determined that the hack originated from China. [19] The New York Times reported that the hack was committed by a Chinese intelligence agency as part of an espionage operation, in juxtaposition to efforts to disrupt infrastructure. [2] The department is required to prepare a supplemental report within thirty days and provide it to lawmakers. [9] [14]
The Washington Post reported in January 2025 that the hack involved the Office of Foreign Assets Control, the Office of Financial Research, and the Office of the Treasury Secretary. [20]
Senate Committee on Banking, Housing, and Urban Affairs ranking member Tim Scott requested a briefing on the hack. According to a spokesman, he is "closely watching the situation". [18] The committee intends to hold a classified briefing about the hack in January 2025. [14]
The embassy of China, Washington, D.C. denied the allegations. [21] Spokesman Liu Pengyu stated that the embassy hoped "relevant parties will adopt a professional and responsible attitude when characterizing cyber incidents" rather than basing assessments on "unfounded speculation and accusations". [9]
