The Department of Justice announced Monday morning four members of the Chinese military are responsible for the 2017 hacking of credit monitoring service Equifax. A grand jury in Atlanta returned an indictment against Wu Zhiyong, Wang Qian, Xu Ke and Liu Lei last week. The breach was an attack on millions of Americans as sensitive information, like social security numbers, was stolen. Equifax trade secrets were also illegally taken.
"This was a deliberate and sweeping intrusion into the private information of the American people," Attorney General Bill Barr stated during his announcement of the indictment Monday. "Today, we hold PLA hackers accountable for their criminal actions, and we remind the Chinese government that we have the capability to remove the Internet's cloak of anonymity and find the hackers that nation repeatedly deploys against us. Unfortunately, the Equifax hack fits a disturbing and unacceptable pattern of state-sponsored computer intrusions and thefts by China and its citizens that have targeted personally identifiable information, trade secrets, and other confidential information."
Zhiyong, Qian, Ke and Lei are charged with a series of crimes including conspiracy to commit economic espionage, multiple counts of conspiracy to commit computer fraud, unauthorized access with the intent to do damage, multiple counts of wire fraud and more.
"According to the indictment, the defendants exploited a vulnerability in the Apache Struts Web Framework software used by Equifax's online dispute portal. They used this access to conduct reconnaissance of Equifax's online dispute portal and to obtain login credentials that could be used to further navigate Equifax's network. The defendants spent several weeks running queries to identify Equifax's database structure and searching for sensitive, personally identifiable information within Equifax's system," DOJ released. "Once they accessed files of interest, the conspirators then stored the stolen information in temporary output files, compressed and divided the files, and ultimately were able to download and exfiltrate the data from Equifax's network to computers outside the United States. In total, the attackers ran approximately 9,000 queries on Equifax's system, obtaining names, birth dates and social security numbers for nearly half of all American citizens."
Republican Senator Ben Sasse, a regular critic of China, has already weighed in on the situation.
"Warning lights are still flashing red. First the Chinese Government hacked OPM and built a massive spy-database in 2014, and now four Chinese military members have been indicted in the 2017 Equifax breach that put millions of families at risk," Sasse released in a statement. "The Chinese Communist Party will leave no stone unturned in its effort to steal and exploit American data. These indictments are good news, but we've got to do more to protect Americans' data from Chinese Communist Party influence operations."