The U.S. Congressional Budget Office cyberattack has revealed once again how fragile government cybersecurity can be. A suspected foreign hacker breached the CBO’s internal network, potentially exposing sensitive data and confidential communications between congressional offices and analysts.

In a statement to reporters, CBO spokesperson Caitlin Emma confirmed the security incident and said the agency acted immediately to contain the breach. “The Congressional Budget Office has identified the issue, taken steps to secure its systems, and added new monitoring tools to prevent further compromise,” she said. Work for Congress continues, but investigations into the scope of the attack are still underway.

The Congressional Budget Office cyberattack was first reported by the Washington Post, which said officials detected the intrusion within recent days. Although early signs suggest the breach was caught quickly, some congressional offices have paused email communication with the agency out of caution.

The CBO provides lawmakers with economic forecasts and cost analyses for pending legislation. That means a breach could expose not just staff data, but also draft reports that influence national policy and markets before they are public.

Experts warn that such data is a prime target for state-sponsored groups seeking intelligence on U.S. financial or political strategy.

The Congressional Budget Office cyberattack adds to a growing list of intrusions on federal institutions over the past year. In December 2024, the U.S. Treasury Department confirmed a similar incident that was later linked to the Chinese state-sponsored hacking group Silk Typhoon, also known as APT41. That same group has been tied to earlier attacks on the Committee on Foreign Investment in the United States (CFIUS) and even private sector companies.

Silk Typhoon became infamous in 2021 after exploiting the Microsoft Exchange Server vulnerabilities known as ProxyLogon, compromising tens of thousands of systems worldwide. Their pattern is consistent: move quietly, steal data, and remain undetected for as long as possible.

If Silk Typhoon or a similar group is behind the Congressional Budget Office cyberattack, the implications reach far beyond one agency. It shows how even nonpartisan, analytical institutions are becoming part of the geopolitical cyber battlefield.

Cybersecurity researcher Lara Hendrickson, commenting on the breach, said third-party applications and automated systems that interact with government platforms often create weak entry points. “The problem is not just the attacker,” she said. “It is how many systems in government are still not built for continuous threat monitoring.”

That concern is not new. Despite major investments in modernization, many U.S. government networks still run on outdated software. Each incident exposes the same core issue, federal cybersecurity is only as strong as its least protected agency.

For citizens, the Congressional Budget Office cyberattack is more than another security headline. It highlights how digital espionage now targets the very infrastructure that informs national decision-making. For lawmakers, it is another call to overhaul the fragmented security standards that leave even high-value institutions exposed.

This event may also accelerate a shift toward greater centralization of cybersecurity oversight, new cloud security mandates, and stronger coordination between civilian and intelligence agencies.

The Congressional Budget Office cyberattack stands as a reminder that data itself has become a weapon and that even the institutions designed to measure economic stability are now defending themselves in a digital cold war.

Read the original report on BleepingComputer.

For more Laterstack cybersecurity coverage, see EU phone data breach exposes top officials through data brokers and AI browsers cybersecurity time bomb.

[thb_gap height=”150″]

A shocking new report has revealed that data brokers were selling the phone location data of European Union officials, exposing what experts now call the EU phone data breach. The discovery has raised urgent questions about whether Europe’s privacy protections work at all.

Journalists across Europe obtained a dataset from a commercial broker that included 278 million location points. Inside were traces from hundreds of government phones, including those used by senior officials working at the European Commission and European Parliament.

The EU phone data breach included thousands of markers that showed where top policymakers lived, worked, and traveled. All of it came from ordinary apps that quietly sent users’ coordinates to data brokers, who then sold the information to advertisers, governments, and private buyers.

According to the report by Netzpolitik, over 2,000 data points belonged to 264 officials, and nearly 6,000 markers came from 750 phones used inside the Parliament. That means the movement of key decision-makers could be reconstructed in detail.

The General Data Protection Regulation (GDPR) was meant to make such practices impossible. Yet, as this EU phone data breach proves, the data trade continues to thrive in Europe because enforcement remains weak. Regulators rarely act against data brokers who claim user consent, even when that consent comes from buried app permissions.

Following the revelation, the European Commission issued new internal guidance to protect staff from tracking. But experts say this is only a temporary fix. “Once location data is sold, it cannot be taken back,” said a privacy researcher. “The EU phone data breach shows that even regulators are not safe.”

Last year’s Gravy Analytics incident in the United States revealed similar patterns. That breach exposed the movements of millions of people, proving how location data can easily be used for surveillance, blackmail, or manipulation.

Device makers like Apple and Google have since added features that anonymize tracking IDs, but these safeguards only work going forward. The data already in circulation from the EU phone data breach cannot be erased.

The breach highlights a growing irony. Europe built its reputation on privacy leadership, but the very institutions enforcing those laws are now caught in their own surveillance net.

Read the original coverage at TechCrunch.

Explore more Laterstack cybersecurity insights:

AI browsers cybersecurity time bomb

Inside TikTok’s silent policy shift on government data requests