BeyondTrust called the US Treasury on 8 December with bad news. Someone had stolen a key the company used to protect a cloud service that lets its staff give remote technical support to Treasury employees.
That key was the way in. According to the Treasury’s letter to lawmakers, the intruders used it to override the service’s security. They reached several user workstations and some unclassified documents stored on them. Treasury called it a “major incident.”
BeyondTrust told the department it first saw suspicious activity on 2 December, though it took the company three days to work out it had been hacked. In that window, the BBC reported, the intruders may have been able to create accounts or change passwords.
What Treasury says it knows
Initial findings point to “a China-based Advanced Persistent Threat (APT) actor,” officials said. Treasury policy treats any intrusion traced to such a group as a major cybersecurity incident.
The department took the BeyondTrust service offline. It said there was no evidence the hacker had kept access to its information. It has been working with the Cybersecurity and Infrastructure Security Agency, the FBI and outside forensic investigators to measure the damage. A supplemental report is due to lawmakers within 30 days.
There are gaps. Treasury did not say what kind of files were taken, when the hack began or how long it lasted. It also did not give the confidentiality level of the systems or the seniority of the staff whose material was reached. The hackers are believed to have been after information rather than money.
Beijing’s answer
China rejected the accusation. Foreign ministry spokeswoman Mao Ning called it “baseless accusations lacking evidence” and said China “consistently opposes all forms of hacking.” A Chinese embassy spokesman in Washington, Liu Pengyu, described it as a smear and said the US “needs to stop using cyber security to smear and slander China.” The US has not supplied evidence that China is responsible.
The Treasury case follows a hack of telecoms companies in December that may have exposed phone record data across a wide share of American society. Two suspected Chinese groups have been named in the past year: Volt Typhoon, accused of breaking into critical infrastructure, and Salt Typhoon, accused of the telecoms espionage.
