Congressional Budget Office hit by cyberattack, raising concerns over US government network security

The Congressional Budget Office (CBO) confirmed it was hacked Thursday, potentially exposing key financial research to malicious actors.

The Washington Post first reported the breach appeared to come from a foreign actor. The CBO told Fox News Digital it had taken "immediate action" to contain the threat and strengthen its systems.

"The Congressional Budget Office has identified the security incident, has taken immediate action to contain it and has implemented additional monitoring and new security controls to further protect the agency’s systems going forward," the office said in a statement.

"The incident is being investigated and work for the Congress continues. Like other government agencies and private sector entities, CBO occasionally faces threats to its network and continually monitors to address those threats."

HACKERS STEAL MEDICAL RECORDS AND FINANCIAL DATA FROM 1.2M PATIENTS IN MASSIVE HEALTHCARE BREACH

The CBO provides Congress with nonpartisan analysis of the federal budget, economic outlook and cost of legislation. If internal communications, cost estimates or draft models were accessed, experts say a foreign actor could gain insight into congressional deliberations, the timing of bill releases or fiscal vulnerabilities, information that could be used to anticipate U.S. policy moves, craft disinformation or exert strategic influence.

"The CBO sits at the center of federal legislative decision-making as every major policy, including taxation, defense spending, and entitlement programs, runs through their analysis before it can move toward law. If an adversary gets inside the CBO network, they can gain strategic foresight into how the U.S. government will make economic or national security decisions before the public or even Congress knows. This would give them extraordinary power," said James Faxon, managing director and chief information security officer at NukuDo and former head of cybersecurity for Boeing.

"Accessing the CBO’s internal models and drafts allows a hostile nation to predict sanctions and military funding levels, anticipate economic policy shifts before they’re announced and adjust their own markets and investments," he said. "Knowing how the U.S. plans to spend money allows an adversary to adjust their playbook in advance, giving them a major advantage."

The breach fits into a broader pattern of cyber operations by U.S. adversaries such as China and Russia, which have increasingly targeted civilian and legislative institutions rather than just military or intelligence agencies.

Earlier this year, the Justice Department charged 12 Chinese nationals tied to Beijing’s Ministry of State Security in what officials described as a global hacking campaign. The group was accused of infiltrating multiple government systems, including the 2024 breach of the U.S. Treasury Department’s unclassified network through a compromised software key. Officials said the hackers accessed internal documents, exposing how even unclassified systems can reveal sensitive information about U.S. financial operations.

TRANSUNION BECOMES LATEST VICTIM IN MAJOR WAVE OF SALESFORCE-LINKED CYBERATTACKS, 4.4M AMERICANS AFFECTED

Another China-linked operation known as Salt Typhoon infiltrated major U.S. telecommunications providers, accessing metadata on more than a million users over an 18-month period. The group’s activity, according to U.S. cybersecurity officials, was aimed at mapping American communications infrastructure and identifying potential points of disruption, part of a wider shift toward targeting systems that connect government, commerce and daily life.

Russia’s military intelligence service, the GRU, has also remained active. In a joint cybersecurity advisory issued this spring, U.S. officials warned of a GRU campaign aimed at technology and logistics companies supporting Ukraine’s defense supply chains. Analysts say those operations mirror earlier Russian efforts to infiltrate Western energy grids and municipal networks, suggesting a continued focus on exploiting non-military systems for leverage during geopolitical conflicts.

Together, these campaigns highlight how foreign adversaries are expanding the definition of a strategic target, moving beyond classified networks to the broader infrastructure that supports U.S. governance and oversight. Legislative support agencies such as the CBO, which maintain sensitive economic data and communicate frequently with lawmakers, represent an attractive target for those seeking to understand or influence policy from the inside.

By reaching into the CBO’s network, a foreign actor could gain a rare window into congressional priorities and fiscal models that shape major legislation. Even limited access to that data could help adversaries anticipate U.S. policy decisions or attempt to manipulate public perception — demonstrating how modern cyber warfare increasingly blurs the line between espionage, influence and governance.