WASHINGTON D.C – In early December 2024, Chinese state-sponsored hackers infiltrated the U.S. Treasury Department’s computer systems by exploiting a vulnerability in a third-party software provider, BeyondTrust.
The breach was discovered on December 8 when BeyondTrust alerted the Treasury that attackers had stolen a key used to secure a cloud-based service for remote technical support. This allowed the hackers to override security measures and access several employee workstations containing unclassified documents.
The Treasury Department has since taken the compromised service offline and is collaborating with the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI to assess the impact. Officials have stated that there is no evidence indicating the threat actor has continued access to Treasury systems or information.
China has denied involvement in the cyberattack, with a foreign ministry spokeswoman stating that Beijing opposes all forms of hacker attacks and condemns the spread of false information for political purposes.
This incident is part of a broader pattern of cyber espionage attributed to Chinese-linked groups targeting U.S. government agencies and critical infrastructure. Earlier this year, similar breaches were reported in other departments, raising concerns about the security of sensitive information.
The Treasury Department has emphasized its commitment to bolstering cyber defenses and is working with both private and public sector partners to protect the financial system from such threats.
