The US Treasury Department stated on Monday that it was subjected to a cyberattack by a Chinese state agent who gained access to servers and non-classified documents, according to a letter reviewed by The Washington Post.
The department was notified on December 8 by software provider BeyondTrust that a hacker gained access to a security key, which allowed the attacker to bypass certain security protocols and access some Treasury Department servers and the non-classified documents stored on them, according to a letter to Congress. The Treasury did not disclose whose computers were hacked, noting only that it involved "end users".
As soon as the Treasury was alerted to the issue, it contacted the Cybersecurity and Infrastructure Security Agency (CISA), and it disabled the BeyondTrust service. At the moment, there is no evidence that the hacker still has access to the Treasury's systems, a representative said.
The company BeyondTrust discovered and "took measures to address the security incident" this month, according to a company representative's statement. "BeyondTrust notified a limited number of clients who were involved in the incident and has since been working to support these clients".
As suggested by WP, the intrusion appears to be part of longstanding efforts by the Chinese government to spy on the US government. The department did not disclose whose workstations were hacked, telling only senators that it involved "end users".
Earlier this year, a Chinese hacker group infiltrated more than a dozen American telecommunications companies, allowing them to monitor phone calls and text messages of hundreds of people, including President-elect Donald Trump and Vice President-elect J.D. Vance.
Last year, Chinese cyber spies hacked into the email accounts of the US Commerce and State Departments, including Commerce Secretary Gina Raimondo, as well as a congressional staffer, an American human rights advocate, and American think tanks.