Congressional Budget Office hacked in 'security incident'

The Congressional Budget Office (CBO) confirmed Thursday it had been hacked, saying it was taking action to contain the fallout.

“The Congressional Budget Office has identified the security incident, has taken immediate action to contain it, and has implemented additional monitoring and new security controls to further protect the agency’s systems going forward,” CBO spokesperson Caitlin Emma said in a statement.

“The incident is being investigated and work for the Congress continues. Like other government agencies and private sector entities, CBO occasionally faces threats to its network and continually monitors to address those threats.”

The statement follows a report from The Washington Post that officials suspected a foreign actor was behind the attack, risking insight into lawmakers’ communications with nonpartisan staff.

The CBO evaluates the financial impact of legislation, including “scoring” a bill on how much it would impact the national debt.

According to the Post, the hackers may have accessed emails as well as chat logs at the CBO.

The news comes after the Cybersecurity and Infrastructure Security Agency (CISA) told reporters in September that at least one government agency had been hacked, issuing an emergency directive noting the “alarming ease with which a threat actor can exploit” vulnerabilities in Cisco software.

A second emergency directive was issued last month, warning of a “nation-state affiliated cyber threat actor” accessing federal networks using F5 devices and software.

CBO typically garners little attention, and is relied on by lawmakers on both sides of the aisle when crafting legislation.

But the agency was criticized by Republicans during the formulation of President Trump’s Big Beautiful Bill, when CBO determined the legislation would add $2.4 trillion to the deficit over the course of a decade.

Speaker Mike Johnson (R-La.) complained in June that he was “not buying the CBO's estimates,” while Sen. Rand Paul (R-Ky.) referred to its personnel as “bean counters” who were failing to account for economic growth.

Updated at 5:22 p.m. EST