US Treasury says Chinese hackers stole documents in major cyber breach

BeyondTrust, based in Georgia, disclosed the issue on its website, stating that a “digital key had been compromised” in an incident affecting a small number of its clients. The company added that an investigation is ongoing but did not respond to further comments.

The Treasury Department said it learned about the breach on 8 December, after being alerted by BeyondTrust. It is now working with the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) to understand the full impact. CISA directed all questions to the Treasury Department, while the FBI did not immediately respond to Reuters’ inquiries.

A spokesperson for the Chinese Embassy in Washington denied any involvement in the hack. “Beijing firmly opposes the US’s smear attacks against China without any factual basis,” the embassy told Reuters.

Cybersecurity expert Tom Hegel from SentinelOne noted the attack fits a “well-documented pattern” seen in Chinese hacking campaigns. “These groups often target trusted third-party services, and this method has become more common in recent years,” he told Reuters.

The incident highlights the growing risks of relying on third-party vendors for critical security services.