US charges four Chinese military hackers over 2017 Equifax breach

They are accused of stealing company secrets and personal data; China denies the claims

Attorney-General William Barr announced the indictments of the Chinese Liberation Army members in Washington on Monday. PHOTO: AGENCE FRANCE-PRESSE
Attorney-General William Barr announced the indictments of the Chinese Liberation Army members in Washington on Monday. PHOTO: AGENCE FRANCE-PRESSE

WASHINGTON • The US has charged four Chinese military hackers in the 2017 breach of the Equifax credit reporting agency that affected nearly 150 million American citizens, Attorney-General William Barr said on Monday.

"This was a deliberate and sweeping intrusion into the private information of the American people," Mr Barr said in announcing the indictments of four members of the Chinese Liberation Army in connection with one of the largest data breaches in US history.

Chinese Foreign Ministry spokesman Geng Shuang denied the allegations yesterday and said China's government, military and their personnel "never engage in cyber theft of trade secrets".

The announcement is the latest in an aggressive campaign by the American authorities to root out Chinese espionage operations in the US.

Since turning the spotlight on China in 2018, the United States has snared a growing group of Chinese government officials, business people and academics pursuing American secrets.

Roughly 147 million people had their information, including social security numbers, birth dates and driver's licence data, compromised by the Equifax breach.

The hackers spent weeks in the Equifax system, breaking into computer networks, stealing company secrets and personal data.

The hackers routed traffic through approximately 34 servers located in nearly 20 countries to obfuscate their true location.

Equifax chief executive Mark Begor said the company was grateful for the Justice Department investigation. "It is reassuring that our federal law enforcement agencies treat cybercrime - especially state-sponsored crime - with the seriousness it deserves," he said in a statement.

US officials have said Chinese hackers were behind a massive breach at the Office of Personnel Management, which came to light in 2015 and involved the compromise of sensitive personal data submitted by applicants for US government security clearances.

That breach exposed the names, social security numbers and addresses of more than 22 million current and former US federal employees and contractors, as well as 5.6 million fingerprints.

Chinese hackers are similarly suspected of being behind a massive breach at hotel group Marriott International.

The Equifax hack fits into a pattern of past Chinese cyber attacks, said Mr Michael Daniel, a former White House cyber-security coordinator, because the stolen data can support other spying efforts.

"Its primary utility would be in developing potential targets for approach by intelligence operatives or feeding artificial intelligence machine learning tools," said Mr Daniel, who currently serves as president of the Cyber Threat Alliance, a cyber-security information-sharing group.

Mr Geng, when asked about the indictments, said yesterday that Beijing is also a victim of US "cyber intrusion, surveillance and monitoring activities".

"We have lodged stern representations to the US and asked it to make explanations and immediately stop such activities," he said.

Senator Ben Sasse, a Republican member of the Senate Select Committee on Intelligence, urged tougher action to counter Chinese hacking.

"The Chinese Communist Party will leave no stone unturned in its effort to steal and exploit American data. These indictments are good news, but we've got to do more to protect Americans' data from Chinese Communist Party influence operations," he said in a statement.

Policymakers and consumer groups have questioned how private companies could amass so much personal data, sparking efforts to bolster consumers' ability to control their information.

Both the Senate Banking and House of Representatives Financial Services committees are considering legislation that would require companies to better protect consumer data.


Join ST's Telegram channel and get the latest breaking news delivered to you.

A version of this article appeared in the print edition of The Straits Times on February 12, 2020, with the headline US charges four Chinese military hackers over 2017 Equifax breach. Subscribe