Hackers Spied on 100 US Bank Regulators’ Emails for Over a Year

Hackers intercepted about 100 bank regulators’ emails for more than a year, gaining access to messages containing agency deliberations and sensitive details about banks it oversees, according to two people familiar with the matter.

The attackers were able to monitor employee emails at the Office of the Comptroller of the Currency after breaking into an administrator’s account, said the people. The intrusion was discovered earlier this year, the people added.

The OCC is an independent bureau of the Department of the Treasury which regulates and supervises all national banks, federal saving associations and the federal branches and agencies of foreign banks — together holding trillions of dollars in assets.

On Feb. 26, the OCC disclosed a “cybersecurity incident” involving an administrative account in the agency’s email system which it discovered that month. It identified a “limited number of affected email accounts” and said they have since been disabled.

The unidentified hackers penetrated the mailboxes of senior deputy comptrollers, international banking supervisors and other staff, said one of the people. In all, they had access to more than 150,000 emails from June 2023 until they were discovered and ousted earlier this year, the person said

The incident was reported to the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, and there was no indication of any impact on the financial sector “at this time,” the agency said. CISA operates as the cyber unit of the Department of Homeland Security, where it helps secure federal systems and shares information about digital threats with the public and private sector.

It’s now believed the hacker accessed more email accounts than previously thought, according to the people, who asked not to be identified as they were not authorized to discuss the matter.

It’s unclear who is responsible for the breach. The OCC declined to comment. The Treasury Department didn’t immediately respond to a request for comment.

The Treasury revealed in December that it fell victim to Chinese state-sponsored hackers who breached their network through a third-party provider, giving them access to some unclassified documents and former Secretary Janet Yellen’s computer. It wasn’t immediately clear if the OCC breach was related, according to the two people.