WSJ: Hackers still able to access US State Department network three months since email breach
Eric Beech / Reuters :
Context & Ripple Effects
This 2015 report is the earliest entry in what the related coverage now reads as a decade-long pattern: once inside US government networks, China-linked operators stay. In 2023, the State Department discovered its Azure-hosted mail was compromised via a stolen Microsoft key affecting roughly 25 organizations, and Microsoft later confirmed attackers held some accounts for a month before detection.
Subsequent reporting widened the blast radius — [[a:844644|officials told lawmakers the Microsoft breach yielded 60K emails from ten State Department accounts]], including the ambassador to China — and by late 2024 investigators found Salt Typhoon still holding parts of US broadband networks, while early 2025 brought word of senior Treasury officials' computers accessed. Against that backdrop, this story's finding that access persisted three months after discovery is less an anomaly than the template.
First-order effects
- State Department network defenders and incident responders face a remediation failure: eviction efforts over three months did not remove the intruders, so affected systems and credentials must be treated as continuously exposed.
Second-order effects
- Cloud providers hosting government mail — Microsoft most directly, given the later Azure key theft and month-long undetected access — come under pressure to harden key management and detection, since agency-level cleanup alone has repeatedly proven insufficient.
Third-order effects
- If long-dwell persistence keeps repeating across agencies and carriers, federal security planning shifts structurally from perimeter defense to assume-breach operations, and the State Department's own counter-moves — a dedicated emerging-threats bureau and ordered global pushback on Chinese IP theft — become standard institutional responses rather than one-offs.
The trend: Chinese state-sponsored intrusions into US government and telecom networks are converging on a signature of months-long dwell times that survive both detection and disclosed remediation.