Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Yes. In December 2024, hackers used a compromised BeyondTrust remote-support service to reach certain U.S. Treasury Department workstations and access unclassified documents. U.S. officials attributed the operation to a China-linked actor, but public disclosures do not show that the attackers accessed classified systems, stole government funds, or disrupted the U.S. financial system.
What happened in the Treasury breach?
Treasury’s December 30, 2024 notice to Congress described the event as a “major cybersecurity incident.” The department said a threat actor accessed certain Treasury Departmental Offices workstations through a third-party remote-support service provided by BeyondTrust. The attackers also accessed unclassified documents stored on those workstations.
BeyondTrust notified Treasury on December 8. Treasury took the affected service offline and investigated with CISA, the FBI, the intelligence community, and outside forensic investigators. Treasury’s public notice described a compromise of departmental IT resources; it did not say that the department’s financial operations had been taken over.
Treasury’s notice to Congress and CISA’s update document the initial public account.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How did attackers get from a vendor to Treasury workstations?
The disclosed route was a supply-chain and privileged-access compromise, not simply an employee password stolen in a phishing attack. BeyondTrust said a zero-day vulnerability in a third-party application enabled access to an online asset in one of its AWS accounts. The attacker then obtained an infrastructure API key and used it against a separate AWS account supporting BeyondTrust Remote Support SaaS.
- A vulnerability in a third-party application enabled access to a BeyondTrust cloud asset.
- The attacker obtained a BeyondTrust infrastructure API key.
- The key enabled unauthorized access to affected customer Remote Support SaaS instances, including through resetting local application passwords.
- Treasury’s use of the remote-support channel provided a route to certain departmental workstations and files.
Remote-support products are designed to let administrators or support staff reach other computers, so access to the service can carry more power than an ordinary user account. The incident shows why organizations need to limit vendor access, protect and rotate service keys, monitor privileged sessions, and keep independent controls between a remote-support tool and sensitive systems. It does not mean that using remote-support software is inherently unsafe.
BeyondTrust’s incident account describes its investigation, the key compromise, and the vendor’s response.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What did the attackers access—and what remains unknown?
| Publicly established | Not established in public disclosures |
|---|---|
| Certain Treasury Departmental Offices workstations were remotely accessed. | The exact number of workstations, users, or devices affected. |
| Unclassified documents on those workstations were accessed. | The exact files viewed or taken, or the volume of information involved. |
| The route involved BeyondTrust Remote Support SaaS. | The precise duration of access or whether attackers moved laterally beyond the initially identified workstations. |
| U.S. authorities attributed the activity to a China-linked actor. | The full public technical evidence supporting attribution, or whether any information was later used for espionage, fraud, or influence activity. |
“Unclassified” does not mean “public” or “harmless.” Such documents can still contain sensitive policy, personnel, procurement, operational, or law-enforcement information. Treasury’s public notice did not identify the documents in detail. It said further information would be provided in a supplemental report; the public sources cited here do not provide a complete technical accounting, and the absence of such a public account does not show that no further investigation took place.
There is no public confirmation in these disclosures that classified information was accessed. Nor do they establish that Treasury payment systems, sanctions databases, debt-management operations, currency production, taxpayer accounts, or other core financial infrastructure were compromised.
Who did U.S. officials blame?
U.S. authorities attributed the intrusion to a China-linked or China-sponsored threat actor. On January 17, 2025, the Treasury Department’s Office of Foreign Assets Control sanctioned Shanghai-based cyber actor Yin Kecheng, identifying him as involved in the Treasury network compromise. That is the U.S. government’s public attribution; it should not be recast as a court finding that China’s government ordered this specific operation.
The January 3, 2025 Treasury action involving Integrity Technology Group and activity associated with Flax Typhoon is a separate announcement. It should not be merged with the January 17 designation into a claim that Flax Typhoon definitely carried out the Treasury breach. Treasury’s later March 5, 2025 announcement referenced the earlier Yin Kecheng designation.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Sources: Treasury’s January 17 announcement and Treasury’s January 3 announcement.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What does “major cybersecurity incident” mean?
Treasury used “major cybersecurity incident” in its congressional notice. The label reflects a government reporting and response classification; it is not, by itself, proof of a nationwide outage or catastrophic compromise. The public disclosures establish that this was a major incident for reporting purposes. They do not establish that Treasury’s public services were broadly disrupted or that mission-critical financial systems were breached.
- Major incident: A government classification that triggers reporting and response attention.
- Large operational outage: Broad interruption of public services; this was not established in the disclosed account.
- Catastrophic compromise: A breach of highly sensitive or mission-critical systems; this was not established either.
Was Treasury’s money or the financial system affected?
No public evidence in the cited disclosures indicates that Treasury funds were stolen, federal payments were redirected, taxpayer accounts were accessed, or the dollar and Treasury securities markets were technically compromised. The confirmed account concerns certain department workstations and documents—not the financial infrastructure Treasury oversees or operates.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
That distinction matters to personal-finance readers: the incident was serious because Treasury handles consequential economic policy and enforcement work, but the public record does not describe a breach of consumers’ bank accounts or a disruption to federal payments.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Was the breach still active?
As of its December 30, 2024 disclosure, Treasury said it had no evidence that the threat actor retained access. CISA said it was coordinating with Treasury and BeyondTrust to understand and mitigate the incident.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallBeyondTrust later said its investigation was completed on January 17, 2025. The company reported that 17 Remote Support SaaS customers were involved and that it found no unauthorized access to those instances after early December 2024. It also said no FedRAMP instances were affected, no other BeyondTrust systems were compromised, and ransomware was not involved. Those are the vendor’s reported findings, not a substitute for a fully detailed public Treasury forensic report. The figure of 17 refers to affected vendor customers, not 17 Treasury systems or 17 government agencies.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Sources: Associated Press, CISA, and BeyondTrust.
How the incident unfolded
| Date | Event |
|---|---|
| December 5, 2024 | BeyondTrust said it confirmed anomalous behavior, identified affected Remote Support SaaS instances, revoked the compromised API key, and began incident response. |
| December 8, 2024 | BeyondTrust notified Treasury of the incident. |
| December 10, 2024 | BeyondTrust said it notified federal law-enforcement partners. |
| December 13, 2024 | BeyondTrust said it identified CVE-2024-12356 and CVE-2024-12686 during its investigation. |
| December 14–15, 2024 | BeyondTrust said Remote Support SaaS environments were patched. |
| December 19, 2024 | BeyondTrust said law enforcement attributed the unauthorized activity to China-nexus threat actors. |
| December 30, 2024 | Treasury notified Congress and publicly described the incident as major, disclosing access to certain workstations and unclassified documents. |
| January 3, 2025 | Treasury announced sanctions involving Integrity Technology Group and activity associated with Flax Typhoon. |
| January 17, 2025 | Treasury sanctioned Yin Kecheng in connection with the Treasury compromise; BeyondTrust said its forensic investigation was complete. |
| March 5, 2025 | Treasury announced further sanctions and referenced the January designation of Yin Kecheng. |
Timeline sources: BeyondTrust, Treasury’s notice to Congress, Treasury’s January 3 announcement, January 17 announcement, and March 5 announcement.
How this differs from the SolarWinds breach
This was separate from the 2020 SolarWinds-era campaign, in which Treasury was among the federal agencies affected. The December 2024 incident involved BeyondTrust Remote Support SaaS; it was not a continuation of the SolarWinds intrusion. The shared fact that Treasury was a victim in both episodes does not make them the same campaign.
For context, see this overview of the 2020 federal breach.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why the breach matters beyond Treasury
The incident illustrates a risk that applies to governments, banks, businesses, and other organizations: a vendor’s privileged support channel can become a path into a customer’s systems. A stolen infrastructure key can reach across customer environments in ways that differ from compromising one employee account. Separating cloud environments, revoking keys quickly, patching affected systems, reviewing logs, rotating credentials, and checking for persistence can reduce the blast radius, but no single measure eliminates supply-chain risk.
For organizations that depend on remote-support vendors, the practical lesson is to treat the product as high-value administrative infrastructure. Evaluate how keys are managed, whether customer environments are isolated, what privileged-session controls and audit logs are available, how quickly vulnerabilities are patched, and how promptly the provider must notify customers of incidents. The breach does not establish that any particular product choice would have prevented it.
The Treasury intrusion was also strategically significant because of the department’s role in economic policy and sanctions enforcement. That significance should be kept distinct from claims about technical impact: the public account does not show a compromise of the U.S. financial system.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
