Congressional Budget Office implementing new security controls following cyberattack

The Congressional Budget Office (CBO) disclosed a cybersecurity incident this week after an alleged nation-state breached its systems. 

The federal agency offers budget and economic information to Congress. The Washington Post reported on Thursday that an unnamed “foreign actor” hacked into the agency and may have gained access to messages and chats between Congressional offices and staffers. 

A spokesperson for the CBO confirmed the security incident and said the agency has taken immediate action to contain it while also implementing “additional monitoring and new security controls to further protect the agency’s systems going forward.”

“The incident is being investigated and work for the Congress continues,” the spokesperson said. “Like other government agencies and private sector entities, CBO occasionally faces threats to its network and continually monitors to address those threats.”

An anonymous source told The Washington Post that the breach was discovered in “recent days” and that the agency told Congress it detected the incident “early.”

The CBO declined to answer follow-up questions about the nature of the breach and how the hackers gained entry. The agency provides analysis of the financial impact of legislation to Congress. 

Nation-state hackers have repeatedly targeted federal government agencies involved in the country’s finances. Threat actors gained access to “highly sensitive information” in February after breaching the email system used by the U.S. Office of the Comptroller of the Currency (OCC).

Chinese hackers breached systems at the Treasury Department in December 2024 and accessed computers used by then Secretary Janet Yellen, Deputy Secretary Adewale Adeyemo and acting Undersecretary Brad Smith. Several Chinese citizens and companies were eventually sanctioned for their role in the cyberattacks. 

Last year, several U.S. agencies were also attacked by Russian government hacking groups through a vulnerability in software from Microsoft. 

Throughout 2025, federal cybersecurity agencies have warned of several vulnerabilities that would likely be used by hackers to target government systems. The Cybersecurity and Infrastructure Security Agency has released urgent emergency directives about bugs affecting popular federal government tools from Microsoft, Cisco and Oracle.