A Chinese state-sponsored hacker has penetrated the US Treasury Department’s systems, gaining access to employee workstations and some declassified documents, officials said Monday.
The breach occurred in early December and was made public in a letter the Treasury Department wrote to inform lawmakers of the incident.
In the letter, the Treasury Department said the China-based actor was able to override security through a key used by a third-party service provider that provides remote technical support to its employees.
The US agency called the breach a “major incident” and said it was working with the FBI and other agencies to investigate the impact.
The compromised third-party service — known as BeyondTrust — has been taken offline, officials said. He added that there is no evidence that the hacker has continued to access Treasury information since then.
Along with the FBI, the Department is working with the Cybersecurity and Infrastructure Security Agency and third-party forensic investigators to determine the overall impact of the breach.
Based on the evidence gathered so far, officials said the hack appears to have been carried out by a “China-based Advanced Persistent Threat (APT) actor.”
“In accordance with Treasury policy, an intrusion attributed to APT is considered a major cybersecurity incident,” Treasury Department officials wrote in their letter to lawmakers.
A spokesman told the BBC that the department was alerted to the hack by Beyond Trust on December 8. The agency immediately notified law enforcement.
The spokesperson added that the hacker was able to gain access to several Treasury user workstations and some declassified documents held by those users.
The department did not say what the nature of the files were, or when or how long the hack took place.
The spokesman said the Treasury Department “takes very seriously all threats to our systems and the data it holds” and that it would continue to work to protect its data from external threats.
US officials have accused China of espionage in the past. He has consistently denied such allegations.