The US treasury department revealed on Monday that Chinese hackers managed to access several workstations and unclassified documents by breaching a third-party software service provider.
The attack occurred earlier this month and is now being investigated as a major cybersecurity incident.
The Treasury did not reveal how many workstations were accessed or what documents were stolen, but assured lawmakers that there was no evidence the hackers still had access to its data. A spokesperson said the department was taking the breach seriously and strengthening its cyber defences.
“Treasury takes all threats against our systems and the data it holds very seriously,” the spokesperson said in a statement to the Associated Press. “Over the last four years, Treasury has significantly bolstered its cyber defence, and we will continue to work with both private and public sector partners to protect our financial system from threat actors,” they added.
The breach occurred after a third-party service provider, BeyondTrust, alerted the department on December 8 that hackers had stolen a key that allowed them to bypass security and gain remote access to employee workstations. The affected service has since been taken offline.
The Treasury is working closely with the FBI and the cybersecurity and infrastructure security agency to investigate the attack, which has been linked to alleged Chinese state-sponsored hackers.
According to the US, this incident is part of a broader series of cyberattacks linked to China, including the Salt Typhoon campaign, which has targeted telecommunications companies, affecting at least nine.
In response to the allegations, Beijing has denied any involvement, saying that it opposes such actions and takes measures against all forms of cyberattacks.
The Treasury’s investigation is ongoing, and officials are focused on determining the full scale of the breach.
