US bank regulator’s email system breached – Source: www.csoonline.com

A cyber intrusion at the US Office of the Comptroller of the Currency (OCC) is “massively serious” and comes at a time when “the good work done to improve cybersecurity in the US is under extraordinary pressure,” a security analyst said Tuesday.

David Shipley, head of Canadian security awareness training provider Beauceron Security, was responding to an alert issued by the OCC, an independent bureau of the Department of Treasury which charters, regulates, and supervises all national banks in the US.

According to a release, it has notified Congress of what it described as a “major information security incident,” which it is required to do under the Federal Security Modernization Act (FISMA).

The release noted that “this finding is the result of internal and independent third-party reviews of OCC emails and email attachments that were subject to unauthorized access. On February 11, 2025, the OCC learned of unusual interactions between a system administrative account in its office automation environment and OCC user mailboxes.”

It went on to state, “on February 12, the OCC confirmed the activity was unauthorized and immediately activated its incident response protocols, which include initiating an independent third-party incident assessment and reporting the incident to the Cybersecurity and Infrastructure Security Agency. On February 12, the OCC disabled the compromised administrative accounts and confirmed that the unauthorized access had been terminated. The OCC provided public notice of the incident on February 26.”

One published report released Tuesday indicated, “unknown attackers who breached the Treasury’s Office of the Comptroller of the Currency (OCC) in June 2023 gained access to over 150,000 emails.”

Shipley responded to that by saying the best case scenario for the OCC and the national banking industry in general is they might get “very, very, very lucky” if it turns out to be a nation state simply doing spying and preparatory work.

The worst case scenario is that an OCC regulated entity, or entities, were breached as a result of the email compromise, he said.

“It’s stunning, and this is coming at a time when the good work done to improve cybersecurity in the United States is under extraordinary pressures, both to limit the regulatory gains and insight, and also just the resources to go after this.”

Shipley added that “if this is not a canary in the coal mine of an immediate U turn required in investing in protecting the critical infrastructure of the United States, I don’t know what is. And we absolutely need a full, transparent accounting of this so that we can learn from it.” 

And the fact that the OCC is a regulator, he said, “does not mean that it was appropriately resourced to protect itself. I think a big question that needs to be asked is, are these extraordinarily important agencies appropriately resourced to protect themselves? And odds are, if you scratch the surface and dig, you’re going to find extraordinarily stretched IT teams, overworked, with inadequate funding to protect themselves. It is deeply ironic, but it would not be surprising to me.”

As for who masterminded the incident, Shipley said that whoever it is “is really, really audacious to go after the Department of the Treasury. Remember, this is where the Secret Service lives. Secret Service investigates financial cyber crime. You are poking one of the best resourced bears on the planet. But that should tell you something. Someone felt bold enough to pull this off, and pulled it off for a long time, and that should scare people.”

In an emailed statement Tuesday night, an OCC spokesperson said that the agency learned of the unauthorized access to its email system the day after the Acting Comptroller of the Currency, Rodney E. Hood, was sworn into office.

On February 25, Hood “received a high-level briefing of this incident, and the OCC provided public notice of the incident the following day. At that time, Mr. Hood had not been provided detailed information about the full duration of the unauthorized access, nor the specific number and content of email communications affected,” the spokesperson said, noting that the OCC has utilized third-part cybersecurity experts to perform a full review of the investigation and forensics efforts.

“The OCC operates a comprehensive information security and cyber protection program to protect its critical information recourses, including the sensitive financial institution information in its custody,” the spokesperson said.

The agency, they said, implements security and privacy controls that meet or exceed National Institute of Standards and Technology standards, and continually assesses those controls to evaluate their effectiveness.