The attackers broke into an administrator's account at the Office of the Comptroller of the Currency, monitoring employee emails and accessing roughly 150,000 emails from May 2023 until they were discovered and ousted earlier this year.
“The analysis concluded that the highly sensitive bank information contained in the emails and attachments is likely to result in demonstrable harm to public confidence,” OCC Chief Information Officer Kristen Baldwin wrote in the draft letter to Congress that was seen by Bloomberg News.