“Baseless accusations lacking evidence.” That was Beijing’s reply when the US Treasury Department said Chinese state-sponsored hackers had broken into its systems earlier in December.
American officials said the intruders reached employee workstations and some unclassified documents. Treasury disclosed the breach in a letter to lawmakers and labeled it a “major incident.” It said it was working with the FBI and other agencies to judge the impact.
The letter laid out how it happened. China-based actors overrode security using a key belonging to a third-party service provider, whose application gives Treasury staff remote technical support. The provider, BeyondTrust, has been taken offline. Officials said there was no sign the hacker still had access.
Who Treasury blames
Early investigations suggest “a China-based Advanced Persistent Threat (APT) actor.” Treasury officials said that under department policy, “intrusions attributable to an APT are considered a major cybersecurity incident.”
China’s foreign ministry spokeswoman Mao Ning told a briefing that the claims were baseless, and added that China “firmly rejects the dissemination of false information targeting China for political purposes.” The BBC reported that the US has not supplied any evidence that China is responsible.
The department told the BBC that BeyondTrust alerted it on 8 December. A supplemental report to lawmakers is due in 30 days. Treasury did not say when the hack began, how long it ran or what the stolen documents contained.
A run of China-linked cases
The breach is the latest in a series of embarrassing intrusions in the US that have been blamed on China. A December hack of telecoms companies may have exposed phone record data across large swathes of American society.
Two groups of suspected Chinese government hackers have been identified in the past year. Volt Typhoon stands accused of breaking into critical infrastructure organizations for possible disruption attacks, and Salt Typhoon of espionage, including the telecoms hack.
