Attackers used a compromised Office of the Comptroller of the Currency (OCC) administrative account to access employee mailboxes. The OCC detected unusual activity on February 11, 2025, confirmed unauthorized access on February 12, disabled the affected administrative accounts, and disclosed the incident on February 26. The agency later told Congress that the incident was a major information-security incident because the emails contained sensitive bank-supervision information. The OCC’s official timeline does not confirm when the intrusion began; Bloomberg, citing people familiar with the matter and a draft congressional letter, reported access dating to 2023 and approximately 103 accounts. That reported duration and account count remain attributed figures.
What was breached
The OCC is an independent bureau within the Treasury Department that supervises national banks and federal savings associations. The publicly described incident involved its Microsoft cloud email environment, not a confirmed compromise of every OCC network or operational system.
A system-administrator account was used to access executive and employee mailboxes, including messages and attachments. The OCC’s April letter to supervised institutions says the breached account existed solely in the cloud environment. Mandiant and CrowdStrike found no indication of lateral movement into other OCC information-technology systems in the reviewed environment. The OCC letter describes those findings.
BankNet and the Large File Transfer system, which institutions use to exchange supervisory information, were subject to additional review. The letter does not say either system was compromised.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
- A great fit for 2-4 bedroom homes, this Alarm Kit includes one Base Station, two Keypads, eight Contact Sensors, two Motion Detectors, and one Range Extender.
- Includes an intuitive Keypad that can arm and disarm your Alarm and Contact Sensors that detect when doors or windows open.
- Choose the Ring Alarm Kit that fits your needs and detect even more with additional Alarm Sensors and accessories (sold separately) at any time.
- Receive mobile notifications when your system is triggered and monitor all your Ring devices all through the Ring app.
- More peace of mind. Subscribe to a compatible Ring Protect Plan (sold separately) to Arm your Alarm from anywhere, keep your system online if the Wi-Fi goes down, and more. Plus, get 24/7 Professional Monitoring for emergency police, fire and medical response, and more.
Timeline: reported access versus confirmed events
| Date | What is established |
|---|---|
| June 2023 | Bloomberg reported that attackers’ access to OCC email accounts may extend back to this period. The OCC’s public notices do not confirm June 2023 as the initial compromise date. |
| February 11, 2025 | The OCC detected unusual interactions involving an administrative account and user mailboxes. |
| February 12, 2025 | The OCC confirmed unauthorized activity, activated incident response, notified CISA, disabled compromised administrative accounts, and said unauthorized access had ended. |
| February 26, 2025 | The OCC publicly announced the email-system incident. |
| April 8, 2025 | The OCC notified Congress that the event met the definition of a major information-security incident. |
| April 15, 2025 | The OCC described the investigation, affected information, remediation and planned communications to supervised institutions. |
The official dates come from the OCC’s congressional notification and its letter to supervised institutions.
How many accounts were affected?
The OCC’s public notice says that a number of executives’ and employees’ emails were accessed but does not provide a total. Bloomberg reported approximately 103 bank-regulator email accounts. That figure should be treated as reported, rather than as an OCC-confirmed count, unless a later official release supplies the underlying number.
Rank #2
- A great fit for 1-2 bedroom homes, this kit includes one base station, one keypad, four contact sensors, one motion detector, and one range extender.
- Includes an intuitive Keypad that can arm and disarm your Alarm and Contact Sensors that detect when doors or windows open.
- Choose the Ring Alarm Kit that fits your needs and detect even more with additional Alarm Sensors and accessories (sold separately) at any time.
- Receive mobile notifications when your system is triggered and monitor all your Ring devices all through the Ring app.
- More peace of mind. Subscribe to a compatible Ring Protect Plan (sold separately) to Arm your Alarm from anywhere, keep your system online if the Wi-Fi goes down, and more. Plus, get 24/7 Professional Monitoring for emergency police, fire and medical response, and more.
What information could have been exposed?
The OCC says the affected material included email communications and attachments containing information about the financial condition of federally regulated institutions, supervisory information supplied by those institutions, and other nonpublic OCC information. The agency was reviewing compromised messages and attachments and assessing whether information appeared on the dark web or whether bank-customer information was involved. The April letter explains the categories and continuing review.
“Accessed” does not by itself prove that every attachment was downloaded, that data was exfiltrated, or that customer account records were exposed. The public notices do not identify specific banks, examination results or customer files as definitively stolen.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Simple to set up. Seriously secure - Get ready to protect right out of the box. Just plug in the Base Station, download the SimpliSafe App, place your sensors, and start protecting your home. No wiring or drilling required. Or contact SimpliSafe directly if you need help installing your system.
- 1 FREE month of professional monitoring for fast police response when you need it most. With optional monitoring services, our agents keep watch even when you can't, ready to instantly alert emergency responders. Starting at less than $1/day with no long-term contracts or hidden fees. (SimpliSafe products and professional monitoring services are only offered for sale and supported in the US)
- Complete control of your system with the SimpliSafe App - Arm, disarm and protect anytime, anywhere.
- Protection for entry points - Entry Sensors protect windows, doors, and cabinets and alert you when someone tries to enter. Customizable and can send Secret Alerts so you are quietly alerted if someone accesses private areas, without sounding an alarm.
- Blanket a whole room - Motion sensors detect motion within 35 feet, have a 90 degree field of view and get along great with pets under 60lbs. Perfect for full room coverage when placed in a corner.
Why an OCC mailbox is a high-value target
An OCC mailbox can contain far more than routine government correspondence. Supervisory work may discuss a bank’s financial condition, examination findings, capital and liquidity concerns, cybersecurity weaknesses, proposed mergers, enforcement matters and remediation plans. Exposure could therefore support intelligence collection, targeted phishing, impersonation, market manipulation or pressure on a regulated institution even if no bank system was entered.
The OCC classified the event as major because of the sensitivity of the information in the emails. That classification reflects the potential impact of the material, not proof that every category of sensitive data was taken.
Rank #4
- Like-New Ring Alarm 8-piece kit is refurbished, tested, and certified to look and work like new and comes with the same limited warranty as a new device. Like-New Amazon devices may be packaged in generic Amazon-branded boxes.
- A great fit for 1-2 bedroom homes, this kit includes one base station, one keypad, four contact sensors, one motion detector, and one range extender.
- Includes an intuitive Keypad that can arm and disarm your Alarm and Contact Sensors that detect when doors or windows open.
- Choose the Ring Alarm Kit that fits your needs and detect even more with additional Alarm Sensors and accessories (sold separately) at any time.
- Receive mobile notifications when your system is triggered and monitor all your Ring devices all through the Ring app.
Was this the Chinese Treasury breach?
The public record treats the OCC email incident and the December 2024 Treasury intrusion through the BeyondTrust remote-support provider as separate events. Bloomberg reported that it was unclear whether they were related. The record also does not establish that the OCC attacker was Chinese or state-sponsored. The Bloomberg account provides the available connection and attribution caveats.
A precise description is therefore: the OCC suffered unauthorized access to cloud email through an administrative account; a separate Treasury breach was attributed in public reporting to Chinese state-backed hackers, but no primary source cited here links that actor to the OCC incident.
What the OCC did after detection
- Activated incident-response protocols and reported the event to CISA.
- Disabled the compromised administrative accounts and confirmed that unauthorized access had ended.
- Conducted internal and independent reviews of messages and attachments.
- Worked with Microsoft GHOST, Mandiant and CrowdStrike.
- Planned outside-counsel review of policies and procedures.
- Increased oversight of contractors managing the Microsoft email environment.
- Reviewed BankNet and the Large File Transfer system as a precaution.
- Planned to share information with regulated institutions, notify institutions when their information was identified, and provide affected institutions with email domains found in the compromised material.
These steps address containment and investigation. They do not resolve the still-public questions about the initial attack method, the exact mailbox count, the identity of the attacker, or whether particular institutions’ information was accessed.
Best Value
- Outdoor 4 is our most affordable wireless smart security camera yet, offering up to two-year battery life for around-the-clock peace of mind. Local storage not included with Sync Module Core.
- See and speak from the Blink app — Experience 1080p HD live view, infrared night vision, and crisp two-way audio.
- Two-year battery life — Set up in minutes and get up to two years of power with the included AA Energizer lithium batteries and a Blink Sync Module Core.
- Enhanced motion detection — Be alerted to motion faster from your smartphone with dual-zone, enhanced motion detection.
- Person detection — Get alerts when a person is detected with embedded computer vision (CV) as part of an optional Blink Subscription Plan (sold separately).
What regulated banks should do now
- Map the exposure window. Identify messages and attachments sent to OCC personnel during the period in which unauthorized access may have existed, including correspondence dating back to 2023 if your records permit.
- Preserve evidence. Retain relevant mail, attachment, audit-log and Large File Transfer records under legal and incident-response hold procedures.
- Classify the content. Determine whether communications contained confidential supervisory information, examination material, transaction-sensitive details, credentials or personal information.
- Ask the OCC for institution-specific information. Confirm whether your domains or information appeared in the affected material and use the contact process supplied by the agency.
- Model follow-on attacks. Alert staff to phishing, invoice fraud, executive impersonation and social engineering that uses authentic OCC names, subjects or supervisory details.
- Coordinate internally. Bring legal, compliance, risk, information security, communications and fraud teams into one response plan; assess notification duties under applicable law and contracts.
- Use verified channels. Do not send new sensitive material through a channel the OCC has not confirmed as secure, and independently verify urgent requests that appear to come from regulators.
- Track official updates. Monitor OCC, Treasury, CISA and financial-sector information-sharing notices for new findings.
What remains unknown
- The initial intrusion vector and persistence technique.
- Whether June 2023 was the actual start date.
- The exact number of affected mailboxes.
- Which institutions’ information was viewed.
- Whether customer information was exposed.
- Whether data was copied, exfiltrated or published on the dark web.
- Whether BankNet or the Large File Transfer system was compromised.
- Whether the incident was connected to the 2024 Treasury breach.
The OCC’s own acting comptroller described long-held organizational and structural deficiencies in the agency’s response context. That creates an accountability issue for Congress and for banks that must entrust sensitive supervisory information to their regulator. The key distinction is that the public evidence shows a serious cloud-email compromise, while not showing a confirmed takeover of the OCC’s broader IT environment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
