A key used by third party service provider BeyondTrust to secure cloud-based remote support was stolen and used to access unclassified data, Treasury told lawmakers.

Treasury says hackers accessed “certain unclassified documents” in a “major” breach, but experts believe the attack’s impacts could prove to be more significant as new details emerge.

The US Treasury Department suffered a “major” security incident after a China state-sponsored hacker broke into the third-party remote management software it uses, as reported earlier by The New York Times.