US charges 4 Chinese spies with hacking Equifax

" The Equifax breach was disclosed in 2017, exposed financial records of 150M Americans

" FBI Deputy Director David Bowdich: "This is the largest theft of sensitive PII by state-sponsored hackers ever recorded."

The U.S. Department of Justice today announced charges against four intelligence agents of the Chinese government for the legendary Equifax hack. Disclosed in September 2017, the breach exposed sensitive financial records of nearly 150 million Americans and many other foreigners.

Read more about the charges here at justice.gov.

More: Politico, The Verge, The New York Times.

Twitter reactions below, followed by the full announcement from the Department of Justice.

DOJ announcement of Chinese hackers ties together whole series of state-sponsored data thefts: OPM, Marriott, Anthem, and Equifax. Huge pool of data, will take decades to undo damage to US intelligence.

- Garrett M. Graff (@vermontgmg) February 10, 2020

Equifax statement. (It would've been nice had Equifax at least acknowledged its own massive fuckups that led to the breach in the first place.)

A House report in 2018 that the breach was "entirely preventable" had Equifax bothered to patch its systems. https://t.co/8tyVTwaUlY pic.twitter.com/zmFj09lljv

- Zack Whittaker (@zackwhittaker) February 10, 2020

DOJ Indicts 4 members of PLA for Equifax hack (part of 54th Research Institute).

One of the few publicly disclosed cyber actions from PLA since 2016 Cyber Agreement. Most activity in recent years has emanated from MSS and their contractorshttps://t.co/7wjhTidYv6

- Dmitri Alperovitch (@DAlperovitch) February 10, 2020

I can't believe that Equifax is still in business https://t.co/Q5g8NJaAYQ

- alex (@alex) February 10, 2020

Overlooked moment in the DoJ press conference today: Barr linked the Marriott breach to the Chinese. I believe that is the first time the U.S. government has publicly acknowledged a connection to Beijing. https://t.co/dB1bSAsE9h pic.twitter.com/3MN2SfRU93

- Dustin Volz (@dnvolz) February 10, 2020

Hello whatever your spy OPSEC-we will hunt you down, and send your mugshot on a WANTED poster to all your friends https://t.co/5XJqQGHWzo pic.twitter.com/LyR5cmx7yF

- Thomas Rid (@RidT) February 10, 2020

The indictment is here: https://t.co/fUoAYRqy3y

Nothing new on a first read. It mostly echoes the findings of a 2018 GOA report: https://t.co/SDwiwixj2R pic.twitter.com/IKHBppgM1L

- Catalin Cimpanu (@campuscodi) February 10, 2020

Equifax becomes the latest example of protecting privacy and customer security at scale turning into an issue of national security.

- Joe Uchill (@JoeUchill) February 10, 2020

US published images of the defendants in the Equifax hack indictment, two in their Chinese military uniform...https://t.co/065yO8xcLL pic.twitter.com/1iPJg5rIvB

- Thomas Brewster (@iblametom) February 10, 2020

Bowdich admits that the FBI likely won't be able to apprehend these hackers any time soon.

"We'll keep putting pressure on these bad actors, making sure they understand the risks and the consequences of their actions."

- Eric Geller (@ericgeller) February 10, 2020

Department of Justice
Office of Public Affairs
FOR IMMEDIATE RELEASE
Monday, February 10, 2020

Chinese Military Personnel Charged with Computer Fraud, Economic Espionage and Wire Fraud for Hacking into Credit Reporting Agency Equifax

Indictment Alleges Four Members of China's People's Liberation Army Engaged in a Three-Month Long Campaign to Steal Sensitive Personal Information of Nearly 150 Million Americans

A federal grand jury in Atlanta returned an indictment last week charging four members of the Chinese People's Liberation Army (PLA) with hacking into the computer systems of the credit reporting agency Equifax and stealing Americans' personal data and Equifax's valuable trade secrets.

The nine-count indictment alleges that Wu Zhiyong (aa-a), Wang Qian (ca^13/4), Xu Ke
(e(R)a) and Liu Lei (ac) were members of the PLA's 54th Research Institute, a component of the Chinese military. They allegedly conspired with each other to hack into Equifax's computer networks, maintain unauthorized access to those computers, and steal sensitive, personally identifiable information of approximately 145 million American victims.

"This was a deliberate and sweeping intrusion into the private information of the American people," said Attorney General William P. Barr, who made the announcement. "Today, we hold PLA hackers accountable for their criminal actions, and we remind the Chinese government that we have the capability to remove the Internet's cloak of anonymity and find the hackers that nation repeatedly deploys against us. Unfortunately, the Equifax hack fits a disturbing and unacceptable pattern of state-sponsored computer intrusions and thefts by China and its citizens that have targeted personally identifiable information, trade secrets, and other confidential information."

According to the indictment, the defendants exploited a vulnerability in the Apache Struts Web Framework software used by Equifax's online dispute portal. They used this access to conduct reconnaissance of Equifax's online dispute portal and to obtain login credentials that could be used to further navigate Equifax's network. The defendants spent several weeks running queries to identify Equifax's database structure and searching for sensitive, personally identifiable information within Equifax's system. Once they accessed files of interest, the conspirators then stored the stolen information in temporary output files, compressed and divided the files, and ultimately were able to download and exfiltrate the data from Equifax's network to computers outside the United States. In total, the attackers ran approximately 9,000 queries on Equifax's system, obtaining names, birth dates and social security numbers for nearly half of all American citizens.

The indictment also charges the defendants with stealing trade secret information, namely Equifax's data compilations and database designs. "In short, this was an organized and remarkably brazen criminal heist of sensitive information of nearly half of all Americans, as well as the hard work and intellectual property of an American company, by a unit of the Chinese military," said Barr.

The defendants took steps to evade detection throughout the intrusion, as alleged in the indictment. They routed traffic through approximately 34 servers located in nearly 20 countries to obfuscate their true location, used encrypted communication channels within Equifax's network to blend in with normal network activity, and deleted compressed files and wiped log files on a daily basis in an effort to eliminate records of their activity.

"Today's announcement of these indictments further highlights our commitment to imposing consequences on cybercriminals no matter who they are, where they are, or what country's uniform they wear," said FBI Deputy Director David Bowdich. "The size and scope of this investigation - affecting nearly half of the U.S. population, demonstrates the importance of the FBI's mission and our enduring partnerships with the Justice Department and the U.S. Attorney's Office. This is not the end of our investigation; to all who seek to disrupt the safety, security and confidence of the global citizenry in this digitally connected world, this is a day of reckoning."

The defendants are charged with three counts of conspiracy to commit computer fraud, conspiracy to commit economic espionage, and conspiracy to commit wire fraud. The defendants are also charged with two counts of unauthorized access and intentional damage to a protected computer, one count of economic espionage, and three counts of wire fraud.

The investigation was conducted jointly by the U.S. Attorney's Office for the Northern District of Georgia, the Criminal and National Security Divisions of the Department of Justice, and the FBI's Atlanta Field Office. The FBI's Cyber Division also provided support. Equifax cooperated fully and provided valuable assistance in the investigation.

Assistant U.S. Attorneys Nathan Kitchens, Samir Kaushal, and Thomas Krepp of the Northern District of Georgia; Senior Counsel Benjamin Fitzpatrick of the Criminal Division's Computer Crime and Intellectual Property Section; and Trial Attorney Scott McCulloch of the National Security Division's Counterintelligence and Export Control Section are prosecuting this case. Attorneys with the Office of International Affairs provided critical assistance in obtaining evidence from overseas.

The details contained in the charging document are allegations. The defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.