US regulator OCC notifies Congress of major security breach

• The Office of the Comptroller of the Currency confirmed suffering a data breach
• It told US Congress it was a "major information security incident"
• The identity of the miscreants is not known at this time

The Office of the Comptroller of the Currency (OCC), a US federal agency that acts as a national banks regulator, has confirmed suffering a cyberattack.

In a short press release published on its website, the OCC said that in February 2025 it “identified, isolated and resolved” a security incident “involving an administrative account in the OCC email system.”

Running its due diligence, the OCC analyzed all email logs since 2022 and said it identified a “limited number” of affected email accounts, all of which have since been disabled.

Monitor your credit score with TransUnion starting at $29.95/month

TransUnion is a credit monitoring service that helps you stay on top of your financial health. With real-time alerts, credit score tracking, and identity theft protection, it ensures you never miss important changes. You'll benefit from a customizable online interface with clear insights into your credit profile. Businesses also benefit from TransUnion’s advanced risk assessment tools.

Preferred partner (What does this mean?)

View Deal

100 regulators' emails

“The OCC reported the incident to the Cybersecurity and Infrastructure Security Agency, as required,” the agency concluded. “There is no indication of any impact to the financial sector at this time.”

The OCC is an independent bureau of the US Department of the Treasury that regulates and supervises national banks and federal savings associations to ensure they operate safely, soundly, and in compliance with laws and regulations.

Its press release is quite vague, but the media managed to dig up a few more details. Citing anonymous sources familiar with the matter, BleepingComputer reports that the cybercriminals accessed more than 150,000 emails, and around 100 bank regulators’ emails.

It also said that OCC told the US Congress that this was a “major information security incident” that was discovered on February 11 and remedied on February 12.

The OCC told the body that "the unauthorized access to a number of its executives' and employees' emails included highly sensitive information relating to the financial condition of federally regulated financial institutions used in its examinations and supervisory oversight processes."

If all of this turns out to be true, this could be the second major government-related data incident since Trump's election. The first happened when The Atlantic's Jeffrey Goldberg was added to the White House Signal group chat in which airstrikes in Yemen were discussed.

Via BleepingComputer

You might also like

• Microsoft warns many big Android apps carry major flaws
• We've rounded up the best password managers
• Take a look at our guide to the best authenticator app