Eric Tucker of the Associated Press reports that Chinese hackers accessed U.S. Treasury Department workstations and documents by compromising a third-party provider, BeyondTrust. The breach was discovered on December 8, but there’s no evidence of ongoing access. The Treasury is investigating the incident with the FBI and other agencies. This follows concerns over a larger Chinese cyberespionage campaign affecting U.S. telecommunications. They write:
Chinese hackers remotely accessed several U.S. Treasury Department workstations and unclassified documents after compromising a third-party software service provider, the agency said Monday.
The department did not provide details on how many workstations had been accessed or what sort of documents the hackers may have obtained, but it said in a letter to lawmakers revealing the breach that “at this time there is no evidence indicating the threat actor has continued access to Treasury information.” The hack was being investigated as a “major cybersecurity incident,” it added.
“Treasury takes very seriously all threats against our systems, and the data it holds,” a department spokesperson said in a separate statement. “Over the last four years, Treasury has significantly bolstered its cyber defense, and we will continue to work with both private and public sector partners to protect our financial system from threat actors.” […]
The incident comes as U.S. officials are continuing to grapple with the fallout of a massive Chinese cyberespionage campaign known as Salt Typhoon that gave officials in Beijing access to private texts and phone conversations of an unknown number of Americans. A senior White House official said Friday that the number of telecommunications companies confirmed to have been affected by the hack has now risen to nine.
The Treasury Department said it learned of the latest problem on Dec. 8, when a third-party software service provider, BeyondTrust, flagged that hackers had stolen a key “used by the vendor to secure a cloud-based service used to remotely provide technical support” to workers. […]
The department said it was working with the FBI and the Cybersecurity and Infrastructure Security Agency and others to investigate the impact of the hack, and that the hack had been attributed to Chinese state-sponsored culprits. It did not elaborate.
Read more here.
