3rd Party Risk Management
,
Finance & Banking
,
Governance & Risk Management
Treasury Tells Lawmakers Chinese Threat Actor Remotely Breached Agency Workstations
Chinese hackers breached U.S. Treasury Department workstations through a third-party cloud service, exploiting the access in what the agency called a “major incident” in a letter to lawmakers Friday.
See Also: OnDemand | CISO Leadership Blueprint to Managing Budgets, Third-Party Risks & Breaches
BeyondTrust, a third-party software provider for Treasury, was forced to suspend its cloud-based technical support services after detecting the breach earlier this month, according to the letter. Treasury, alongside the Cybersecurity and Infrastructure Security Agency, forensic investigators and other partners, is now investigating the breach after confirming hackers accessed unclassified documents from affected end users.
“CISA was engaged immediately upon Treasury’s knowledge of the attack, and the remaining governing bodies were contacted as soon as the scope of the attack became evident,” Treasury said in the letter, first reported by Reuters. Assistant Secretary for Management Aditi Hardikar wrote that Treasury was alerted to the breach on December 8, attributing the incident to “a China state-sponsored advanced persistent threat actor.”
BeyondTrust did not immediately respond to a request for comment, but a post on its website earlier this month said the service “identified a medium-severity vulnerability” within its remote support and privileged remote access products. The company said all cloud instances had been patched for the vulnerability by December 16.
CISA declined to comment on the record for this story, referring to the Treasury Department for official comment. Treasury did not immediately respond to multiple requests for comment.
Treasury told lawmakers investments made using discretionary appropriations provided under the Cybersecurity Enhancement Account helped ensure the agency had “strong incident processes and access to detailed logs” to support incident response efforts. The letter added that the ongoing probe was aiming “to fully characterize the incident and determine its overall impact.”
The specific threat actor behind the attack and their intent remain unclear. Over the past year, the Treasury Department has tightened restrictions on investments in Chinese technology firms, issuing final regulations to prevent U.S. dollars from supporting Beijing’s military and intelligence operations (see: US Bans Investments Into Cutting-Edge Chinese Tech).