Chinese hackers broke into the email accounts of Commerce Secretary Gina Raimondo and other State and Commerce Department officials in the weeks before Secretary of State Antony J. Blinken traveled to Beijing in June, officials said. US on Wednesday.
The investigation into the efforts of Chinese hackers, who are likely affiliated with China’s military or spy services, is ongoing, American officials said. But US officials played down the idea that hackers stole sensitive information, insisting that no classified email or cloud systems had been penetrated. The State Department’s cybersecurity team first discovered the intrusion.
Ms. Raimondo, who has been one of the most outspoken critics of China in the administration, was among the targets, according to two US officials. Based on the current investigation, officials believe he is the only cabinet-level official to have been successfully hacked. Hackers were unable to get emails in Mr. Microsoft 365 account. Blinken, though they gained access to other state department email boxes, officials said.
Multiple officials said the attack was aimed at individual email accounts, rather than a large-scale exfiltration of data, which Chinese hackers have been suspected of doing in the past. Biden administration officials declined to specify which officials were targeted by the hackers.
Microsoft, which disclosed the hack on Tuesday, said it began in May, according to the company’s investigation. The State Department discovered the intrusion on June 16 and notified Microsoft that day, before Mr. Blinken’s trip to Beijing, a US official said. He left Washington that night.
The trip is critical for both Washington and Beijing: It is the first visit to China by a US secretary of state in five years and aims to establish high-level communication channels and improve deteriorating relations. Since then, Treasury Secretary Janet L. Yellen has visited Beijing, and John Kerry, the special envoy for climate, plans to land there on Sunday for four days of talks.
President Biden and Xi Jinping, leader of China, agreed at a meeting in Bali, Indonesia, in November to try strengthen the relationship, but tensions between the two countries escalated when the Pentagon discovered and shot down a Chinese spy balloon floating over the continental United States in early February. Mr. Blinken canceled a trip to China at that stage; weeks later, he publicly accused Beijing of considering sending military aid to Russia for use in Ukraine.
A senior State Department official, who spoke on condition of anonymity to discuss the sensitive incident, said the hack was initially not directly related to Mr. Blinken. Other officials cautioned that the investigation into what material, if any, the hackers stole was still in its early stages.
In a statement Wednesday, the State Department said that after identifying “anomalous activity,” the government took steps to secure systems and “will continue to monitor and respond quickly to any additional activity.”
The Commerce Department, according to a spokeswoman, learned that this cloud-based email had been compromised when it was notified by Microsoft, which began looking for other compromises after the State Department alerted the company of its breach. Commerce has been leading efforts to impose export controls to prevent China’s military from gaining access to critical American technology, a drive that has been a major irritant to Beijing.
After the State Department reported the Microsoft hack, the company learned that hackers were also targeting some 25 organizations, including government agencies. An official from the Cybersecurity and Infrastructure Security Agency said some of those organizations are based overseas and the number of US-based organizations is in the single digits.
US officials said the hackers only targeted a few email accounts at each organization, rather than carrying out a widespread intrusion. But neither US nor Microsoft officials would say precisely how many accounts they believe may have been compromised by Chinese hackers.
The US government has not formally linked the attack to China, perhaps because the Biden administration is trying to keep talks with Beijing on track. But privately, US officials said they agreed with Microsoft’s attribution of the hack to China and said it had the hallmarks of a sophisticated government-backed attack.
American officials have described the intrusions as surgical, in contrast to the hacking of SolarWinds in 2019 and 2020, in which Russian intelligence used a vulnerability in software supply chains to gain access to thousands of computer networks .
Spy agencies typically use intrusions into adversarial networks to try to obtain as much information as possible without being detected.
The United States and China are locked in an intensifying intelligence competition, with both governments trying to expand their collection on the other. US officials say that while such spying and hacking is expected, they are conducting a robust investigation to close the same vulnerability used by Chinese hackers against the State Department as well as other potential which is a security vulnerability in cloud computing.
On Wednesday, American officials said State Department cybersecurity experts detected the intrusion by examining email access logs — a record of what emails were hacked and when.
Microsoft, American officials said, charges organizations extra for regular access to those logs. Some of the entities affected by the hack didn’t have that access, meaning that without Microsoft’s help they couldn’t detect the intrusion. US officials are pushing for Microsoft to provide access logs to all organizations that have cloud computing contracts with them.
The State Department is a frequent target of foreign government hacking. Russian intelligence has repeatedly targeted State Department computer networks. In 2014 and 2015, Russian hackers breached the State Department, the Joint Chiefs of Staff and the White House and other critical, but unclassified, computer networks.