Congressional Budget Office hacked, China suspected in breach

By Sean Lyngaas, CNN

(CNN) — The Congressional Budget Office has been hacked, potentially exposing its communications with the offices of lawmakers, according to an email sent to congressional staff this week and obtained by CNN.

The email from the Senate sergeant at arms did not name a culprit, but a US official briefed on the hack told CNN on Thursday that Chinese state-backed hackers are suspected of being behind the breach. The email said the hacking incident was “ongoing” and that staffers should avoid clicking on links sent from CBO accounts because the accounts may still be compromised.

CBO’s economists and analysts provide lawmakers with cost estimates and analysis of legislation in Congress. The office also does long-term projections for the US budget and analyzes the president’s budget — the type of information that could be of interest to foreign intelligence services keeping close tabs on US economic policy.

It’s one of multiple hacks in recent months linked to China that have targeted non-public information about US policies amid fierce US-China trade tensions. In July, CNN reported that suspected Chinese hackers had breached Wiley Rein, a powerful law firm and key player in helping US companies and the government navigate the trade war with China.

“The Congressional Budget Office has identified the security incident, has taken immediate action to contain it, and has implemented additional monitoring and new security controls to further protect the agency’s systems going forward,” CBO spokesperson Caitlin Emma said in a statement on Thursday evening. “The incident is being investigated and work for the Congress continues. Like other government agencies and private sector entities, CBO occasionally faces threats to its network and continually monitors to address those threats.”

Emma declined to comment further, including on who was behind the hack. Beijing routinely denies allegations that it conducts cyberattacks.

China “consistently opposes and strictly combats all forms of cyberattacks in accordance with the law,” Liu Pengyu, spokesperson for the Chinese Embassy in Washington, DC, said in an email.

The Washington Post first reported on the hack, but did not identify a suspect other than describing it as a “foreign actor.”

The federal government has been shut down for a record 37 days, leaving resources for cyber defense stretched thin. The Cybersecurity and Infrastructure Security Agency, a main agency for defending against cyberattacks, planned to furlough roughly two-thirds of its 2,540-person workforce at the start of the shutdown.

As the shutdown drags on, the threat from state-backed and criminal hackers to federal networks has not subsided. CISA issued an “emergency order” in September requiring federal agencies to defend a hacking campaign that had compromised at least one agency.

The-CNN-Wire
™ & © 2025 Cable News Network, Inc., a Warner Bros. Discovery Company. All rights reserved.