U.S. Treasury Department reports breach, stolen documents by hackers
Learn More
U.S. Treasury Department reports a cybersecurity breach, where Chinese state-sponsored threat actors gained unauthorized access through a third-party cloud service provider BeyondTrust.
The incident, discovered on December 8, 2024, has been classified as a "major incident" by the Treasury and involved the compromise of BeyondTrust, a third-party software provider responsible for cloud-based technical support services.
The incident resulted in unauthorized access to Treasury workstations and the exposure of unclassified documents, though the exact scope of the compromise remains undisclosed.
The Treasury Department initiated an investigation in collaboration with the Cybersecurity and Infrastructure Security Agency (CISA), FBI, and forensic investigators. Assistant Secretary for Management Aditi Hardikar has confirmed that while the compromised service has been taken offline, investigations are ongoing to determine the full impact of the breach.
Exposed data and number of affected individuals is not disclosed.
The department credited its Cybersecurity Enhancement Account investments for providing robust incident processes and detailed logging capabilities that proved crucial in the incident response efforts.
According to the Treasury's statement, there is currently no evidence suggesting continued unauthorized access to their systems.
Update - as of 17th of January 2025 the U.S. Treasury Department reports that the incident has compromised the computers of senior officials and hundreds of employees. The incident has been classified as a "major incident" by Treasury officials.
The unauthorized access affected multiple high-level officials' systems, including:
- Secretary Janet Yellen's computer (fewer than 50 files accessed)
- Deputy Secretary Wally Adeyemo's system
- Acting Under Secretary Brad Smith's system
- Over 400 employee laptops and desktops
Exposed Data Types:
- Unclassified files (over 3,000)
- Employee usernames
- Employee passwords
- Documents related to sanctions enforcement
- Intelligence-related materials
- International affairs documentation
- Files connected to CFIUS (Committee on Foreign Investment in the US)
- Law enforcement investigation materials
