Cyber Incident Victim: U.S. Department of State
Date:
May 2023
Location:
United States of America
Summary
Chinese state-linked hackers stole approximately 60,000 emails by breaching the U.S. State Department's Microsoft email platform. The compromise affected ten accounts, with nine focused on East Asia and Pacific diplomacy and one on European affairs. The intrusion, which also resulted in the theft of a list containing all department email addresses, was enabled by the prior compromise of a Microsoft engineer's corporate account.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In May 2023, a Chinese state-linked hacking group known as Storm-0558 breached Microsoft's email platform. This intrusion provided the hackers with access to email accounts at approximately 25 organizations. Among the affected entities were agencies of the United States government, specifically the U.S. Department of Commerce and the U.S. Department of State. The initial compromise was not publicly disclosed until July 2023, when both U.S. officials and Microsoft confirmed the incident had occurred. The method of entry was through the compromise of a Microsoft engineer's corporate account, which gave the attackers a foothold within Microsoft's systems. This access was then leveraged to target customers of Microsoft's Outlook service, including the government agencies.
The breach of the U.S. State Department's email accounts was a significant component of this wider campaign. According to a briefing provided by State Department IT officials to lawmakers in September 2023, the hackers successfully exfiltrated 60,000 emails from 10 specific State Department accounts. The targeting of these accounts was not random; nine of the compromised accounts belonged to individuals working on issues pertaining to East Asia and the Pacific, while the tenth account was associated with an employee focused on European affairs. This indicated a clear intelligence-gathering motive aligned with Chinese geopolitical interests, specifically focused on the Indo-Pacific region. Furthermore, the attackers were able to obtain a list containing all of the department's email addresses, potentially facilitating further targeting or espionage operations.
The incident had immediate consequences for diplomatic relations between the United States and China. The U.S. government's public attribution of the attack to Chinese state-linked actors strained an already tense relationship between the two countries. The Chinese government denied the allegations, creating a point of public contention. Beyond the diplomatic fallout, the theft of 60,000 emails from officials deeply involved in Indo-Pacific diplomacy efforts represented a significant loss of sensitive information. The content of these emails could potentially reveal U.S. negotiating positions, diplomatic assessments, and other classified or sensitive data, providing a strategic advantage to the adversary.
In response to the breach, the U.S. State Department initiated several measures to protect its systems and prevent a recurrence. As detailed in the September briefing, the department began moving its IT infrastructure to "hybrid" environments that incorporated multiple vendor companies instead of relying solely on Microsoft. This strategy was aimed at diversifying its technological base to avoid a single point of failure. Additionally, the department worked to improve the uptake of multi-factor authentication across its systems, adding a critical layer of security to protect user accounts. These actions represented a direct effort to harden defenses following the intrusion.
The incident also triggered a broader examination of the U.S. federal government's reliance on major technology vendors. The sweeping nature of the hack refocused attention on Microsoft's outsize role in providing IT services to the government. Following the briefing, Senator Eric Schmitt, whose staffer received the details, issued a statement calling for a hardening of defenses against such cyberattacks. He emphasized the need to take a hard look at the federal government's reliance on a single vendor as a potential weak point in national security. This criticism was part of a wider wave of scrutiny faced by Microsoft over its security practices in the wake of the breaches. Microsoft itself publicly acknowledged that Storm-0558 had broken into webmail accounts running on its Outlook service, confirming the broad nature of the attack vector. The company stated the intrusion began with the compromise of one of its engineer's accounts, which was then used to facilitate the wider campaign against its customers. The full extent of the data compromise across all 25 organizations remained unclear as of September 2023.