The "threat actor" was able to access the workstations via a compromised third-party cybersecurity service provider called BeyondTrust, the department said.

“We have repeatedly stated our position on such groundless accusations that lack evidence,” Mao Ning said at a daily briefing. “China consistently opposes all forms of hacking, and we are even more opposed to the dissemination of false information against China for political purposes.”

Treasury has deemed the attack a "major incident" and—with assistance from the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and third-party forensic investigators—has attributed it to "a China state-sponsored Advanced Persistent Threat (APT) actor."