Chinese hackers breach US Treasury sanctions office in major cyber attack

Chinese government hackers have infiltrated sensitive offices within the US Treasury Department, including the unit responsible for administering economic sanctions against foreign entities, American officials revealed on Wednesday.

The breach, which compromised the Office of Foreign Assets Control and the Office of Financial Research, occurred through a third-party software contractor and gave hackers access to unclassified documents, according to US officials speaking to the Washington Post.

Treasury assistant secretary for management Aditi Hardikar described the incident as "major" in a letter to lawmakers, explaining that officials were alerted to the breach on 8 December by cybersecurity provider BeyondTrust.

The hackers obtained access by compromising a security key used to secure cloud-based technical support services, allowing them to bypass security protocols and remotely access Treasury workstations.

Chinese foreign ministry spokesperson Mao Ning rejected the allegations, stating that "China has always opposed all forms of hacker attacks" and was "even more opposed to the spread of false information against China for political purposes."

Former US Justice Department official David Laufman highlighted the potential significance of the breach, telling the Washington Post that "gaining access to even unclassified information held by OFAC could provide the Chinese government with valuable intelligence, as such information is used to build a case for sanctioning organizations and individuals."

The incident comes amid heightened tensions between Washington and Beijing, and follows the discovery of another major Chinese cyber espionage campaign dubbed "Salt Typhoon" that targeted nine American telecommunications companies.

BeyondTrust acknowledged the security incident in a statement, saying it had "notified the limited number of customers who were involved" and was supporting the investigation.

The Treasury Department has taken the compromised service offline and says there is no evidence the hackers maintain access to its systems. The breach is currently being investigated by the Federal Bureau of Investigation and other US government agencies.

The targeting of the sanctions office is particularly significant as the United States regularly uses economic sanctions as a key foreign policy tool against Chinese entities and individuals, making information about potential future designations valuable intelligence for Beijing.



Share Story:

Recent Stories


Bringing Teams to the table – Adding value by integrating Microsoft Teams with business applications
A decade ago, the idea of digital collaboration started and ended with sending documents over email. Some organisations would have portals for sharing content or simplistic IM apps, but the ways that we communicated online were still largely primitive.

Automating CX: How are businesses using AI to meet customer expectations?
Virtual agents are set to supplant the traditional chatbot and their use cases are evolving at pace, with many organisations deploying new AI technologies to meet rising customer demand for self-service and real-time interactions.