Justice Department Charges Four Members of China’s People’s Liberation Army in Equifax Hack
The Department of Justice has announced an indictment charging four individuals serving in the Chinese military with the Equifax breach that stole sensitive information from nearly 150 million Americans. The individuals hacked into the computer systems of the credit reporting agency Equifax, stealing Americans’ personal data and Equifax’s valuable trade secrets.
The nine-count indictment alleges that Wu Zhiyong (吴志勇), Wang Qian (王乾), Xu Ke (许可), and Liu Lei (刘磊) conspired with each other to hack into Equifax’s computer networks, maintain unauthorized access to those computers, and steal sensitive, personally identifiable information of approximately 145 million American victims, according to a Justice Department release.
The release explains that the individuals exploited a vulnerable software used by the Equifax online dispute portal. With this access, the individuals obtained login credentials that could be used to further navigate the company’s network. The defendants spent several weeks running queries to identify Equifax’s database structure and searching for sensitive, personally identifiable information within Equifax’s system. The defendants were able to download and exfiltrate the data from Equifax’s network to computers outside the United States.
The indictment alleges that, in total, the individuals ran approximately 9,000 queries on Equifax’s system, obtaining names, birth dates, and social security numbers for nearly half of all American citizens.
The indictment also notes that the individuals stole Equifax trade secrets, including Equifax’s data compilations and database designs.
The defendants covered their tracks by routing traffic through approximately 34 servers located in nearly 20 countries, used encrypted communication channels within Equifax’s network to blend in with normal network activity, and deleted compressed files and wiped log files on a daily basis to hide their activity.
The defendants are charged with three counts of conspiracy to commit computer fraud, conspiracy to commit economic espionage, and conspiracy to commit wire fraud. The defendants are also charged with two counts of unauthorized access and intentional damage to a protected computer, one count of economic espionage, and three counts of wire fraud.
In a speech announcing the charges, Attorney General William Barr explained, “We do not normally bring criminal charges against the members of another country’s military or intelligence services outside the United States. In general, traditional military and intelligence activity is a separate sphere of conduct that ought not be subject to domestic criminal law. There are exceptions to this rule, of course… the deliberate, indiscriminate theft of vast amounts of sensitive personal data of civilians, as occurred here, cannot be countenanced.”