Loading story…
The Congressional Budget Office (CBO), a nonpartisan federal agency providing budget and economic analysis to Congress, confirmed a cybersecurity incident attributed to a suspected foreign threat actor. Officials reported that the breach may have exposed sensitive communications between lawmakers and CBO analysts, as well as internal data such as draft reports and economic forecasts. The CBO responded by containing the incident, implementing additional monitoring, and enhancing security controls to protect its systems. The agency emphasized that work for Congress continues while the investigation is ongoing.
The breach was detected early, according to officials, but concerns remain about the potential exposure of confidential information. Some congressional offices have reportedly suspended email communications with the CBO as a precaution. This incident follows a pattern of recent cyberattacks targeting U.S. government agencies, including the Treasury Department and the Committee on Foreign Investment in the United States, with attribution in those cases linked to Chinese state-sponsored actors. The CBO has requested increased funding to bolster its cybersecurity and IT infrastructure in response to the growing threat landscape.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
By November 10, reporting indicated the cybersecurity incident at the Congressional Budget Office was still ongoing rather than fully resolved. Coverage continued to characterize the threat as linked to a suspected nation-state actor.
Following reports of the cyberattack, the Congressional Budget Office began putting additional security controls in place to contain risk and respond to the breach. This marked the agency's first publicly reported operational response to the incident.
The U.S. Congressional Budget Office was hit by a cybersecurity incident that multiple reports described as a suspected foreign or nation-state cyberattack. The incident affected the agency that provides budget and economic analysis to Congress.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
7 references tracked. Mallory keeps watching after this page renders.
politico.com
Open sourcescworld.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcetherecord.media
Open sourcecyberscoop.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Congressional Budget Office (CBO) confirmed that it successfully expelled threat actors from its systems following a sophisticated cyberattack that occurred two weeks prior. CBO Director Phillip Swagel testified before the House Budget Committee, stating that operations have returned to normal and that there is no further evidence of unauthorized access to CBO email systems. The agency acted swiftly to notify stakeholders and engaged both federal partners and private sector security specialists to assist in the investigation and remediation efforts. The nature of the attack involved unauthorized access to a subset of CBO's email accounts, and the incident is still under active investigation with the involvement of multiple government agencies, including the House, Senate, and U.S. Capitol Police. Details about the attack and ongoing security measures are being withheld from public disclosure to avoid impeding remediation activities, with further updates promised in a closed-door setting. The CBO's response was praised by lawmakers for its urgency and transparency, and additional funding has been allocated to bolster the agency's cybersecurity posture.
Jul 12, 2026
A Chinese state-sponsored hacking group, identified as Salt Typhoon and linked to China’s Ministry of State Security, breached email systems used by staffers on key U.S. House committees. The targeted committees included the House Select Committee on China, as well as panels overseeing foreign affairs, intelligence, and armed services. The breach, detected in December 2025, exposed sensitive communications and raised concerns about Beijing gaining insights into U.S. policy deliberations, military strategy, and counter-espionage measures. U.S. officials and cybersecurity experts highlighted the operation’s stealth and the ongoing threat posed by Chinese cyber-espionage campaigns against American legislators and government systems. The incident is part of a broader pattern of Chinese cyber operations targeting U.S. government entities to collect sensitive data. While the Chinese Embassy denied the allegations, the FBI and other agencies have not commented due to ongoing investigations. Previous campaigns by Salt Typhoon included intrusions into major U.S. telecommunications networks, further demonstrating the group’s capabilities and intent. The breach underscores persistent vulnerabilities in government email systems and the escalating cyber tensions between Washington and Beijing.
Jun 29, 2026
The FBI confirmed that **suspicious cyber activity** targeted one of its internal surveillance networks, and officials later classified the intrusion as a **"major incident"** under FISMA because of the potential national security impact. Reporting indicates the affected environment included systems tied to the FBI’s Virgin Islands operations, where attackers accessed highly sensitive law-enforcement information, including **pen register** and **trap-and-trace** returns as well as personally identifiable information connected to active investigations. The bureau said it detected unusual activity in February, informed lawmakers in early March, and publicly acknowledged that the activity had been contained while the investigation continued. Multiple reports said investigators linked the operation to **China**, and that the attackers appear to have reached FBI systems through a commercial internet service provider’s vendor infrastructure rather than by directly breaching the bureau first. The incident prompted a broader U.S. government response, with the White House convening officials from the FBI, NSA, and CISA and the Justice Department establishing a working group to strengthen resilience and incident response. The breach was reported as separate from another cyber matter involving the FBI director’s personal email, underscoring that the bureau was confronting several cyber threats at the same time.
Jun 29, 2026