CBO Cyber Attack: Foreign Actor Breaches US Congress's Financial Hub

The U.S. Congressional Budget Office (CBO) has confirmed it was the victim of a significant cyberattack, with a foreign nation-state actor suspected of orchestrating the breach. The incident, first reported on November 6, 2025, represents a serious intrusion into the core infrastructure of the U.S. legislative process, potentially exposing sensitive economic data and internal communications that shape federal lawmaking.

The CBO, a strictly nonpartisan agency, functions as the official financial analyst for the U.S. Congress, providing crucial economic projections and cost estimates—or “scores”—for every piece of legislation. The breach raises alarms that a foreign adversary may have gained insight into U.S. economic policy, legislative priorities, and potential fiscal vulnerabilities. U.S. officials familiar with the matter have indicated that state-sponsored hackers from China are believed to be behind the attack.

“The Congressional Budget Office has identified the security incident, has taken immediate action to contain it, and has implemented additional monitoring and new security controls to further protect the agency’s systems going forward,” CBO spokesperson Caitlin Emma said in a statement. “The incident is being investigated and work for the Congress continues”.

A dramatic image of the U.S. Capitol Building under a digital cyberattack, representing the CBO data breach by a foreign threat actor.

Anatomy of the Breach: An Unpatched Firewall

While the CBO has not officially commented on the technical specifics, evidence points to the exploitation of a known vulnerability in the agency’s network hardware.

The Attack Vector: Security researcher Kevin Beaumont identified that the CBO was using an outward-facing Cisco ASA firewall that had not been patched since 2024. This left the device vulnerable to a series of critical security flaws that were being actively exploited by suspected Chinese government-backed hackers.
The Timing: The lack of patching may have been exacerbated by the recent government shutdown, which could have delayed critical IT and cybersecurity operations, creating a window of opportunity for the attackers.
The Intrusion: By exploiting the firewall vulnerability, the hackers were able to gain access to the CBO’s internal network. Officials are now concerned that the intruders accessed internal emails, office chat logs, and sensitive communications between CBO researchers and the offices of U.S. lawmakers.

Following the public disclosure of the breach, the vulnerable Cisco firewall was taken offline.

A High-Value Intelligence Target

The CBO is a uniquely valuable target for foreign intelligence agencies for several reasons:

Economic Forecasting: The agency produces detailed, non-public analyses of the U.S. and global economies, which could give an adversary a significant advantage in anticipating market movements and U.S. policy shifts.
Legislative Insight: By “scoring” legislation, the CBO is privy to the details of bills long before they become public. Access to this information could reveal U.S. government priorities and legislative plans, allowing a foreign power to craft counter-strategies or disinformation campaigns.
Access to Lawmakers: The breach of communications between the CBO and congressional offices provides a wealth of intelligence on the internal deliberations of the U.S. government. The Senate Sergeant at Arms has already sent out a warning to congressional staff, advising them to be wary of phishing attacks sent from seemingly legitimate CBO accounts.

This incident is part of a broader pattern of cyberattacks targeting U.S. legislative and financial bodies. A similar breach last year targeted communications between congressional staffers and the Congressional Research Service, indicating a concerted effort by foreign adversaries to infiltrate the heart of American policymaking.

Response and Investigation

The response to the CBO breach has been swift, involving multiple government agencies.

Containment: The CBO has confirmed it took immediate action to contain the breach and has implemented enhanced security monitoring and controls.
Investigation: A full investigation into the incident is underway to determine the full scope of the data exfiltrated and the exact identity of the attackers.
Congressional Oversight: The House Homeland Security Committee has stated it is closely monitoring the situation and is in contact with both the CBO and the Cybersecurity and Infrastructure Security Agency (CISA) regarding mitigation efforts.

The attack on the Congressional Budget Office is a stark reminder of the persistent and sophisticated cyber threats facing the U.S. government. As foreign actors increasingly target the sensitive data that underpins the legislative process, the security of these core institutions has become a critical component of national security.

CBO Cyber Attack: Foreign Actor Breaches US Congress’s Financial Hub

Anatomy of the Breach: An Unpatched Firewall

A High-Value Intelligence Target

Response and Investigation

SOURCES

About Ansari Alfaiz