Threat actors entered Treasury Department systems through BeyondTrust. The breach may be related to the Salt Typhoon attacks.

The US Treasury Department told lawmakers in a letter back in December that its documents and workstations were accessed by an external party in a security breach. It described the attack as "a major cybersecurity incident" and attributed it to a "China state-sponsored Advanced Persistent Threat actor.

The US Treasury Department declared in a letter sent to Congress on Monday, December 30, that a China state-sponsored actor was behind a cyber breach resulting in access to some of its workstations.

Treasury Department reports a major cybersecurity incident involving a China state-sponsored actor infiltrating Treasury workstations. No evidence of continued access.

The Treasury Department was breached by a Chinese state-sponsored hacker in a “major” cybersecurity incident earlier this year, the department told lawmakers Monday.

After unclassified documents from the US Treasury Department were accessed in a hack blamed on China, many in the cybersecurity community are wondering how such breaches might intensify in the weeks and months ahead.

The attacks appear to have targeted influential individuals, aiming to gather information that could serve the interests of the Chinese government.