US Treasury workstations accessed through a stolen BeyondTrust Remote Support key
On December 8, 2024 BeyondTrust told Treasury that an attacker had obtained a key BeyondTrust used to secure a cloud service for its Remote Support SaaS. With it, the attacker bypassed the service's security, remotely accessed some Treasury workstations and took unclassified documents. Treasury attributed the intrusion to a China state-sponsored actor in a December 30 letter to Congress; BeyondTrust had disclosed CVE-2024-12356 and CVE-2024-12686 that month but has not said how they figured in the attack.
- Victim
- US Department of the Treasury
- Industry
- Government
- Country
- United States
- Intrusion began
- Dec 2024
- First disclosed
- Dec 30, 2024
- Actor
- China state-sponsored APT (unnamed by Treasury) (Nation-state)
- Initial access
- Third-party access
- Identity control that failed
- Non-human identity
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
A single vendor-held key opened remote access into customer endpoints. Remote support tools are privileged access paths that need short-lived, scoped credentials and customer-side approval for each session.
Regulatory and legal outcome
Treasury reported the intrusion to Congress as a major cybersecurity incident in a December 30, 2024 letter to Senate Banking Committee leaders.
Go deeper on SWI
- Technique: Static API key abuse
- Product involved: BeyondTrust
Sources
- Treasury Department breached through BeyondTrust service, TechTarget, Dec 31, 2024
- Chinese-sponsored hackers accessed Treasury documents in 'major incident', Nextgov/FCW, Dec 30, 2024
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Stolen ConnectWise app credentials open Microsoft 365 tenants across MSP customers 2026 · Third-party access
- Danish CPR register queried through a private company's abused access 2026 · Third-party access
- Commvault Metallic breach exposes Microsoft 365 app secrets 2025 · Third-party access
- Zeabur shared cluster breached with a non-expiring admin token and plaintext AWS keys 2026 · Exposed secrets
Cite this record
SWI Community Team. (2026). US Treasury workstations accessed through a stolen BeyondTrust Remote Support key. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2024-us-treasury-beyondtrust-api-key/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.