The Treasury considers the hacking a "major cybersecurity incident," an official wrote in a Monday letter.