Loading story…
The Congressional Budget Office (CBO) confirmed that it successfully expelled threat actors from its systems following a sophisticated cyberattack that occurred two weeks prior. CBO Director Phillip Swagel testified before the House Budget Committee, stating that operations have returned to normal and that there is no further evidence of unauthorized access to CBO email systems. The agency acted swiftly to notify stakeholders and engaged both federal partners and private sector security specialists to assist in the investigation and remediation efforts.
The nature of the attack involved unauthorized access to a subset of CBO's email accounts, and the incident is still under active investigation with the involvement of multiple government agencies, including the House, Senate, and U.S. Capitol Police. Details about the attack and ongoing security measures are being withheld from public disclosure to avoid impeding remediation activities, with further updates promised in a closed-door setting. The CBO's response was praised by lawmakers for its urgency and transparency, and additional funding has been allocated to bolster the agency's cybersecurity posture.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
CBO Director Phillip Swagel testified that hackers had been expelled from the agency's email systems and that the incident had been contained. This public statement marked the first official confirmation of the response status.
The Congressional Budget Office experienced a cyberattack affecting its email systems. The intrusion was later described by CBO leadership as having been contained and the attackers removed.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Congressional Budget Office (CBO), a nonpartisan federal agency providing budget and economic analysis to Congress, confirmed a cybersecurity incident attributed to a suspected foreign threat actor. Officials reported that the breach may have exposed sensitive communications between lawmakers and CBO analysts, as well as internal data such as draft reports and economic forecasts. The CBO responded by containing the incident, implementing additional monitoring, and enhancing security controls to protect its systems. The agency emphasized that work for Congress continues while the investigation is ongoing. The breach was detected early, according to officials, but concerns remain about the potential exposure of confidential information. Some congressional offices have reportedly suspended email communications with the CBO as a precaution. This incident follows a pattern of recent cyberattacks targeting U.S. government agencies, including the Treasury Department and the Committee on Foreign Investment in the United States, with attribution in those cases linked to Chinese state-sponsored actors. The CBO has requested increased funding to bolster its cybersecurity and IT infrastructure in response to the growing threat landscape.
Jun 29, 2026
A Chinese state-sponsored hacking group, identified as Salt Typhoon and linked to China’s Ministry of State Security, breached email systems used by staffers on key U.S. House committees. The targeted committees included the House Select Committee on China, as well as panels overseeing foreign affairs, intelligence, and armed services. The breach, detected in December 2025, exposed sensitive communications and raised concerns about Beijing gaining insights into U.S. policy deliberations, military strategy, and counter-espionage measures. U.S. officials and cybersecurity experts highlighted the operation’s stealth and the ongoing threat posed by Chinese cyber-espionage campaigns against American legislators and government systems. The incident is part of a broader pattern of Chinese cyber operations targeting U.S. government entities to collect sensitive data. While the Chinese Embassy denied the allegations, the FBI and other agencies have not commented due to ongoing investigations. Previous campaigns by Salt Typhoon included intrusions into major U.S. telecommunications networks, further demonstrating the group’s capabilities and intent. The breach underscores persistent vulnerabilities in government email systems and the escalating cyber tensions between Washington and Beijing.
Jun 29, 2026
Five House Democrats asked the Government Accountability Office to investigate whether deep staffing and program cuts at the Cybersecurity and Infrastructure Security Agency have weakened the federal government’s ability to defend civilian networks and critical infrastructure. Lawmakers said CISA has lost nearly one-third of its workforce—falling from about 3,300 employees to roughly 2,200, with nearly 1,000 employees fired or departing—during a period of elevated cyber and physical threats, including attacks affecting utilities in at least 12 states and other active threats to critical infrastructure. The lawmakers asked GAO to review CISA’s workforce changes over the past five years, identify which programs were affected, and determine whether the agency’s human capital strategy aligns with its mission. The request comes as officials report reduced responsiveness, disrupted service delivery, leadership instability following Jen Easterly’s departure, and no Senate-confirmed director in place, while budget uncertainty persists over a proposed fiscal 2027 plan that would eliminate about 870 more positions and cut more than **$700 million**, even as House appropriators have backed additional funding and critical hires.
Aug 21, 2026