US Treasury: "Hackers Supported by China Conducted Hacking... Major Cybersecurity Incident"

Hackers backed by the Chinese government have been identified as having hacked the U.S. Department of the Treasury's system and stolen some information.

Local media, including Bloomberg News, reported on the 30th (local time) that the Treasury sent a letter containing this information to the U.S. Congress. It was confirmed that the hackers hacked BeyondTrust, a cybersecurity service company providing services to the Treasury, and obtained security keys that allow access to Treasury workstations and non-confidential documents.

After receiving this report from BeyondTrust on the 8th of this month, the Treasury notified the Cybersecurity and Infrastructure Security Agency (CISA) under the Department of Homeland Security. It is also cooperating with the Federal Bureau of Investigation (FBI) and others to assess the damage. The Treasury emphasized in the letter that "this incident is presumed to be the act of an APT (Advanced Persistent Threat) actor supported by the Chinese government" and that "it is considered a significant cybersecurity incident."

The exact timing of the hacking has not been clearly disclosed. However, a Treasury spokesperson explained that more detailed information will be released in a report to be submitted to Congress soon. In a statement, he said, "The compromised (BeyondTrust) service is currently offline," and "there is no evidence that hackers backed by the Chinese side are still continuously accessing Treasury systems and information." Bloomberg News added that it requested comments from the Chinese Embassy in Washington, D.C., and BeyondTrust regarding this matter but did not receive any response.

Notably, this incident has drawn attention as it was confirmed amid the recent investigation by the Biden administration into large-scale cyber espionage activities conducted by hackers backed by the Chinese government targeting U.S. telecommunications companies. Earlier, the White House announced that the Chinese side hacked at least eight U.S. telecommunications companies and accessed communication records of senior U.S. officials and politicians.

The New York Times (NYT) reported, "Chinese officials have long denied being behind the hacking," and "concerns about the vulnerability of U.S. systems have increased as reports emerged that U.S. communication systems were compromised by Chinese hacking groups such as Salt Typhoon."