U.S. Treasury Cybersecurity Breach: Latest in China’s Hack Attacks, Officials Claim

A significant security violation has occurred at the U.S. Department of the Treasury, where it was discovered that unauthorized parties gained access to its systems. This breach has been attributed to hackers believed to be associated with the Chinese government. The culprits managed to infiltrate employee computers and obtain unclassified documents, an event the department is calling a “significant incident.”

A report from BBC indicated that the cyberattacks were aimed at prominent figures, including President-elect Donald Trump and Vice-President-elect JD Vance, and even compromised a law enforcement database used for wiretapping, potentially exposing surveillance activities on foreign intelligence agents. Additionally, the attacks on various telecommunications providers might have led to personal data breaches affecting millions of Americans.

This recent breach is part of a larger trend of cyber-attacks on U.S. targets, encompassing major telecom companies and government bodies. In late October, both of the major U.S. presidential campaigns were attacked by groups believed to be working for the People’s Republic of China, as confirmed by the FBI and the Cybersecurity and Infrastructure Security Agency (CISA). Additionally, in September, it was revealed that several top telecom companies had been compromised, including giants like AT&T and Verizon, with a total of nine firms affected.

Back in March, the U.S. charged seven Chinese nationals for participating in a hacking scheme that spanned at least 14 years, targeting foreign dissenters of China, various businesses, and political figures. These espionage efforts have also targeted other Western entities, including the UK’s Electoral Commission and the legislative bodies of both the UK and New Zealand.

The cyber groups involved are known by different codenames. For instance, the group responsible for the telecom hacks has been dubbed “Salt Typhoon” by Microsoft researchers, and is also known as “Famous Sparrow,” “Ghost Emperor,” and “Earth Estrie” by other security entities. Another group, named “Volt Typhoon,” is suspected of targeting critical infrastructure, possibly planning disruptive operations. The earlier mentioned seven Chinese nationals were associated with a campaign known as “Zirconium” or “Judgment Panda,” which was also implicated in compromising the email accounts of UK parliament members in 2021, as reported by the UK’s National Cyber Security Centre.

Recently, just two weeks ago, the U.S. launched a national security probe into TP-Link, a top Chinese router manufacturer that controls about 65% of the router market in American homes and small businesses. This investigation stems from concerns that TP-Link routers may have been used in cyberattacks attributed to Chinese state-supported actors, affecting both government and private sectors, including contractors for the Department of Defense.

While the Chinese government has consistently denied any involvement in these cyber-attacks, the persistent and expansive nature of these incidents continues to escalate tensions between China and Western nations, leading to urgent calls for stronger cybersecurity defenses and greater international collaboration to combat the ongoing threat of state-backed cyber espionage. As the probe progresses, U.S. authorities are evaluating the scope of the damage and taking steps to strengthen the security of vital infrastructure and government operations.