- The US Congressional Budget Office has confirmed a cyber incident
- The attack may have been from a foreign adversary.
- This is one of many recent incidents against US government institutions.
The US Congressional Budget Office has confirmed that it was the subject of a cybersecurity incident that it suspects can be attributed to a foreign hacker.
The nonpartisan accounting service maintains financial records and assessments for the legislative branch and contains confidential government information.
“The Congressional Budget Office has identified the security incident, taken immediate action to contain it, and implemented additional monitoring and new security controls to further protect the agency’s systems in the future,” CBO spokesperson Caitlin Emma said in a statement.
A continuing threat
Sensitive data may very well have been compromised in the attack, and specific concerns have been raised around emails exchanged between analysts and congressional offices. It is likely that a breach could expose economic forecasts, draft reports, personal contact details and political plans.
Unfortunately, incidents like these are all too common, and critical infrastructure comes under near-continuous attack, both from private hackers and state-backed attackers, with the intent of data exfiltration, espionage, disruption, or sometimes for profit.
“The incident is under investigation and work for Congress continues. Like other government agencies and private sector entities, CBO occasionally faces threats to its network and continually monitors to address those threats,” the statement continued.
This is not the first time a congressional department has been attacked. In late 2024, US Congressional staff were exposed in a Library of Congress email hack that compromised nearly a year of correspondence between legislative staff and researchers in what was called a “foreign adversary” incident.
Although these may seem like small-scale attacks that do not result in dramatic takeovers of government institutions or shutdowns, the incidents could provide foreign adversaries with valuable information about upcoming policies, economic expectations, or even network access. Access to internal communications could lead to sophisticated social engineering attacks targeting employees, leading to even more serious incidents.
Through NextGovernment
The best identity theft protection for every budget
