Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →In December 2024, an actor Treasury attributed to China accessed several Treasury employee workstations through BeyondTrust’s remote-support service, using a compromised security key; Treasury said unclassified documents were accessed.
How did the attackers get into Treasury computers?
The access path ran through BeyondTrust, a third-party provider whose cloud-based remote-support service supported Treasury Departmental Office end users. Treasury said BeyondTrust notified the department on December 8, 2024, that a threat actor had gained access to a key used to secure that service. The service was taken offline.
The public accounts do not describe how the key was obtained or provide a forensic explanation of the intrusion. They establish the vendor service and compromised key as the route into Treasury systems, but not the attacker’s precise method.
What did the Treasury hackers access, and how many workstations were affected?
Treasury reported access to several employee workstations and unclassified documents. It has not published a dependable number of affected workstations, a document count, a list of the documents, or a dollar-loss figure. The public record does not establish that classified information was accessed.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Who did Treasury blame, and what happened to the named attacker?
In a December 30, 2024, notice to Senate Banking Committee leadership, Treasury described the incident as a “major incident” and stated: “Based on available indicators, the incident has been attributed to a China state-sponsored Advanced Persistent Threat (APT) actor.” That wording reflects Treasury’s attribution based on the indicators available to it.
On January 17, 2025, the U.S. Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Shanghai-based cyber actor Yin Kecheng for involvement in the Treasury network compromise. OFAC described him as affiliated with China’s Ministry of State Security. The same release separately sanctioned Sichuan Juxinhe for direct involvement in Salt Typhoon; that separate action does not establish that the same actor conducted both intrusions.
Did the attackers still have access after Treasury contained the incident?
Treasury said that, at the time of its notice, it had no evidence the threat actor retained continued access to Treasury information after the remote-support service was taken offline. This is a time-bounded statement about the evidence then available. It does not establish that no information was viewed or copied during the intrusion.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How did Treasury respond?
Treasury said it worked with the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, the intelligence community, and third-party forensic investigators to characterize the incident and determine its impact. CISA separately said it was working with Treasury and BeyondTrust to understand and mitigate the effects.
Free tools Windows power users keep installed
One-click scans. No signup required.
The incident demonstrates how compromise of a vendor-held authentication key can create a pathway to a customer’s workstations. Treasury’s and CISA’s public accounts identify that access path and the response, but do not provide a full forensic account of persistence or the files viewed.
Quick Recap
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What is the confirmed timeline?
- December 8, 2024: BeyondTrust notified Treasury that a threat actor had gained access to a key used to secure its cloud-based remote-support service.
- December 30, 2024: Treasury notified Senate Banking Committee leadership that the event qualified as a major cybersecurity incident and attributed it, based on available indicators, to a China state-sponsored APT actor.
- January 17, 2025: OFAC sanctioned Yin Kecheng for involvement in the Treasury compromise.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
