CISA said the Treasury Department breach , revealed last week, does not appear to have affected other federal agencies .
“ At this time, there is no indication that other federal agencies have been impacted by this incident ,” CISA said . The agency explained that it continues to monitor the situation and work with the appropriate federal authorities to reach a safe conclusion about the scope of this breach.
Violation of the Ministry of Finance
Last Monday, the US Treasury Department revealed that Chinese hackers had breached its network. Authorities described the attack as a “major incident cybersecurity” after a BeyondTrust instance used by the federal agency was compromised. The hackers did so using a stolen Remote Support SaaS API key.
See also: US arrests soldier for breaching AT&T and Verizon
In a letter to Congress, the Treasury Department said remote support provider BeyondTrust notified them of the breach on December 8.
“Based on available indicators, the incident has been attributed to a Chinese-sponsored Advanced Persistent Threat (APT) actor. In accordance with Treasury Department policy, intrusions attributed to APT groups are considered a significant cybersecurity incident,” the letter added.
US officials have since revealed that the attackers specifically targeted the Office of Foreign Assets Control (OFAC), which administers and enforces trade and economic sanctions programs. The hackers were likely trying to collect information about Chinese citizens and organizations that the US wants to sanction.
See also: Hackers steal ZAGG customers' credit cards in breach
Hackers also breached the Treasury Department's Office of Economic Research, but the full impact of the attack is still being assessed. However, officials say there is no evidence that the Chinese hackers retained access to the systems after the compromised BeyondTrust instance was shut down. No other federal agencies appear to have been affected.
However, the Treasury Department breach raises concerns about vulnerabilities associated with third-party remote support tools. Cybersecurity experts have stressed the importance of securing API keys and implementing strong access controls to prevent similar breaches in the future.
“The security of federal systems and data is critical to our national security,” the US cybersecurity agency explained.
“We are working aggressively to guard against any further impacts and will provide updates as appropriate“.
As technology continues to advance and cyber threats evolve, it is vital for organizations and federal agencies to strengthen their security. This includes conducting regular risk assessments, implementing multi-factor authentication, and educating employees on cybersecurity best practices.
See also: American Addiction Centers: Data breach affects 422,000 people
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
CISA and other government agencies will continue to work diligently to achieve this goal, but it is also important for every individual and organization to play their part in protecting our digital world.
Source: www.bleepingcomputer.com
