(NewsNation) — A Chinese state-sponsored hacker accessed U.S. Treasury workstations and stole documents in a “major incident” in early December, a letter sent to lawmakers and reviewed by NewsNation confirmed.

The Treasury Department was notified on Dec. 8, 2024, that a bad actor had “gained access to a key” used by a third-party software service provider, BeyondTrust.

“Based on available indicators, the incident has been attributed to a China state-sponsored Advanced Persistent Threat (APT) actor,” the letter reads in part.

With this key, the hacker was able to override security measures, remotely access workstations and access “certain unclassified documents” from users.

The Treasury Department said it is working with the U.S. Cybersecurity and Infrastructure Security Agency and the Federal Bureau of Investigation to “fully characterize the incident and determine its overall impact.”

As of Dec. 30, the BeyondTrust service is offline, according to the letter.

The department also assured lawmakers that “there is no evidence indicating the threat actor has continued access to Treasury information.”