The US Treasury Department told lawmakers in a letter that hackers had broken into its systems and taken “unclassified documents.” The department attributed the attack to a China state-sponsored Advanced Persistent Threat actor.
The way in was a contractor. The Treasury said its service provider, BeyondTrust, notified the department on Dec. 8 that a threat actor had obtained a key the vendor used to secure a cloud-based service for remote technical support. With the stolen key, the letter said, the attacker could override the service’s security, reach certain workstations used by Departmental Offices staff and open some unclassified files stored on them.
The department said it brought in help right away. “CISA was engaged immediately upon Treasury’s knowledge of the attack,” the letter said, and other governing bodies were contacted once the scope was clear. Federal agencies and forensic investigators were enlisted to work out what the hackers wanted and how much damage was done. The compromised systems were taken offline.
“At this time there is no evidence indicating the threat actor has continued access to Treasury information,” the department said. It called any attack by state-sponsored hackers “a major cybersecurity incident” and promised a supplemental report with more details.
Who was hit
Later reporting widened the picture. Bloomberg News, citing sources, reported in January 2025 that the attackers got into the computer of Treasury Secretary Janet Yellen, as well as those of Deputy Secretary Wally Adeyemo and Acting Under Secretary Brad Smith. One source said fewer than 50 files were accessed on Yellen’s machine.
A Treasury report reviewed by Bloomberg said the hackers seemed most interested in work on sanctions, intelligence and international affairs, while classified systems and email servers stayed secure. Treasury spokesperson Chris Hayden declined to comment.
China denied involvement. A Foreign Ministry spokesperson called the accusations “unwarranted and groundless,” and Chinese officials have repeatedly rejected claims of state-sponsored hacking.
The breach came in a year when the US government disclosed several intrusions blamed on Chinese hackers, among them an attack on American telecom operators by a group known as “Salt Typhoon.”
Sources
- Chinese Hackers Accused of Stealing ‘Unclassified Documents’ from US Treasury
- Chinese hackers breach US Treasury Secretary’s computer
