Chinese hackers stole 60,000 US State Dept. emails in breach reported in July

Chinese hackers who gained access to the email accounts of Commerce Secretary Gina Raimondo and other government officials this year stole 60,000 emails from the State Department alone, according to two people familiar with a briefing Senate staff members received on the matter Wednesday.

The emails came from 10 State Department email accounts, department officials told Senate staff members, according to the people familiar with the briefing, one of whom is a staff member for Sen. Eric Schmitt, R-Mo. Nine of the 10 email accounts belonged to people working on East Asian and Pacific affairs.

The hack, which compromised Microsoft-based email accounts at the State and Commerce departments, was first reported in July. At the time, neither US government officials nor Microsoft executives would disclose how many email accounts they believed had been affected, nor how many emails the hackers had taken. The scope of the hack was reported earlier Wednesday by Reuters.

Washington has not formally blamed China for the intrusion, but various US officials — including Raimondo — have made the connection.

The hackers used one stolen Microsoft certificate to penetrate the State Department email accounts, Biden administration officials told Senate staff members, and that token was used to hack 25 organizations and government agencies.

It is not yet clear what the substance of the emails was. US officials have downplayed the notion that sensitive information could have been caught up in the hack, arguing that it had not compromised classified email accounts. The breaches took place in the weeks before Secretary of State Antony Blinken traveled to China. He was the first of a series of Cabinet officials to make the trip as part of the Biden administration’s efforts to smooth over frayed diplomatic ties between Washington and Beijing, while at the same time imposing restrictions on investments Americans can make in certain Chinese sectors.

Schmitt said in a statement that the government’s reliance on lone vendors to facilitate systems — in this case, Microsoft — created unacceptable vulnerabilities in the system. He has pushed for the Defense Department to scrutinize its own reliance on similar single-vendor systems.

“We need to harden our defenses against these types of cyberattacks and intrusions in the future, and we need to take a hard look at the federal government’s reliance on a single vendor as a potential weak point,” Schmitt said in the statement, promising to press officials “for more answers to ensure China and other nefarious actors do not gain access to the federal government’s most sensitive information.”