A Trump administration official tells me that the cyberattack on the U.S. government and corporate America, apparently by Russia, is looking worse by the day — and secrets may still be being stolen in ways not yet discovered.

• "We still don't know the bottom of the well," the official said.

Stunningly, the breach goes back to at least March, and continued all through the election. The U.S. government didn't sound the alarm until this Sunday.

• Damage assessment could take months.

Microsoft President Brad Smith told the N.Y. Times that at least 40 companies, government agencies and think tanks had been infiltrated.

• The hack is known to have breached the departments of Defense, State, Homeland Security, Treasury, Commerce, and Energy and its National Nuclear Security Administration — plus the National Institutes of Health.
• 8 countries: Microsoft, which has helped respond to the breach, said in a statement that 80% of its 40 customers known to have been targeted are in the U.S., plus others in the U.K., Israel, UAE, Canada, Mexico, Belgium and Spain.

In unusually vivid language for a bureaucracy, the U.S. Cybersecurity and Infrastructure Security Agency, part of Homeland Security, said yesterday that the intruder "demonstrated sophistication and complex tradecraft."

• The agency said the breach "poses a grave risk to the Federal Government and state, local, tribal, and territorial governments as well as critical infrastructure entities and other private sector organizations."

If this had been a physical attack on America's secrets, we could be at war.

• Imagine if during the Cold War, the Soviet Union had broken into a building in Washington and walked out with correspondence, budgets and more.
• Sen. Chris Coons (D-Del.) told Andrea Mitchell on MSNBC: "It's pretty hard to distinguish this from an act of aggression that rises to the level of an attack that qualifies as war. ... [T]his is as destructive and broad scale an engagement with our military systems, our intelligence systems as has happened in my lifetime."

The gravity wasn't immediately apparent because this wasn't the "cyber Pearl Harbor" that experts have warned about: No one took out a power grid, or stole a bunch of money or destabilized the markets.

• Instead, it's more like someone has been walking in and out of your house for months, and you don't really know what they took.
• And they may have built a secret door. "For someone to have access that long, who's this sophisticated, it's pretty likely they built other ways to get in that are hard to find," one official told me.

What's next: President Trump has stayed silent on the hack, meaning that President-elect Biden's overflowing inbox now includes Russian reprisal, damage mitigation and future deterrence.

• Promising to impose "substantial costs" on the perpetrator, Biden said in a statement: "I will not stand idly by in the face of cyber assaults on our nation."

Share this story.

• 💡 Worthy of your time: Big Tech's big reckoning, by the Axios tech team.

The new normal for air travel in 2021 could include two, three or even more COVID-19 tests per trip until vaccines are widely available, Axios Navigate author Joann Muller writes.

• Why it matters: The healthiest people — those most likely to travel — will be vaccinated last. In a partially vaccinated world, passengers will still need to wear masks and get tested before, during and after their journey.
• Vaccines could one day be required for international travel, but there are no uniform requirements across the world, which means getting vaccinated in one country might not guarantee entry into another.

Keep reading.

Hospitals around the country have been thrown into confusion after the administration informed state after state that they'll be getting 25%-40% fewer COVID vaccine doses next week than they'd been expecting.

• Why it matters: The snafu reveals communication gaps between the Trump administration and Pfizer, and between the administration and the states.

What's happening: A senior administration official told me that the states had been relying on planning numbers that were reduced because Pfizer committed to supplying fewer doses than originally forecast.

• Pfizer said in a statement that it is "not having any production issues."

MSNBC's Rachel Maddow last night showed a parade of nearly identical headlines from Iowa, Kansas, Maryland, Michigan, Missouri, Nebraska, Oregon, Rhode Island and Washington State.

• In a Seattle Times story with the headline, "Washington to receive 40% fewer COVID-19 vaccines next week," Cassie Sauer, president of the Washington State Hospital Association, said: "Everyone wanted to cry or take a shot of tequila or something."

Pfizer said in the statement: "[N]o shipments containing the vaccine are on hold or delayed. This week, we successfully shipped all 2.9 million doses that we were asked to ship by the U.S. Government to the locations specified by them."

• "We have millions more doses sitting in our warehouse but, as of now, we have not received any shipment instructions for additional doses.

The senior administration official said that if Pfizer has more doses available for release in the U.S. than have been accounted for — i.e., being held for second shots and as safety stock — "the government ... wants to know immediately.”

A tufted titmouse grabs a seed from a snow-covered bird feeder yesterday during the snowstorm in North Andover, Mass.

In the last week alone, 1 out of every 220 Americans was diagnosed with the coronavirus — an astronomically large portion of the population to be sick at the same time, Axios' Dani Alberti and Sam Baker write.

• About 1 in 20 have been diagnosed since the pandemic began.

Why it matters: The new infections will translate into large numbers of hospitalizations — and eventually deaths — in the coming weeks.

• It also means the rest of us have a decent chance of interacting with someone who is infected, anywhere we go.

Share this graphic.

President-elect Joe Biden told Stephen Colbert on "The Late Show" last night that he believes life will be "awfully close to normal, if not there," by next Christmas, citing the vaccine rollout and his request for Americans to commit to 100 days of mask-wearing.

• Watch a clip.

In Congress, the most brutal battles are internal. House Democratic colleagues of Rep. Alexandria Ocasio-Cortez sent her a chilly message yesterday when she lost 46-13 to a fellow New Yorker, Rep. Kathleen Rice, in a secret ballot for a seat on the powerful Energy and Commerce Committee.

• I'm told Ocasio-Cortez lost the vote by the House Democratic Steering Committee because she didn't personally ask for enough votes, and because some members fear she'll support a primary against them from the left.

Rice worked the committee, tightly controlled by Speaker Pelosi, and was showered with seconding speeches.

• One member told me Rep. Alexandria Ocasio-Cortez "doesn't have enough relationships. She needs to learn from this."
• Conscious of AOC's power with progressives and online, the member said: "The vote would have been very different if it wasn't secret."

An aide to Ocasio-Cortez didn't immediately answer a request for comment.

Matt Gorman, a Republican strategist, told the N.Y. Times:

I look forward to 2020 ending sometime in 2025.

In an exclusive for Axios AM readers, here are this year's five most downloaded episodes of the N.Y. Times' Michael Barbaro's four-year-old "The Daily" podcast, which in September crossed two billion total downloads:

1. "Bernie's Big Bet" (Jan. 17)
2. "The Woman Defending Harvey Weinstein" (Feb. 7)
3. "The Coronavirus Goes Global" (Feb. 27) 
4. "The Next Year (or Two) of the Pandemic" (April 20)
5. "The Field: Biden’s Last Hope" (Feb. 28)

Retiring Sen. Lamar Alexander (R-Tenn.) plays Christmas songs in the Hart Senate Office Building atrium, with Sen. Tim Kaine (D-Va.) on the harmonica.