Four Chinese hackers charged over Equifax cyber attack

Four Chinese military hackers have been charged by US prosecutors for the 2017 Equifax cyber attack.

 

The wanted picture released by the FBI

Back in 2017, a cyber attack on consumer credit reporting agency Equifax resulted in a data breach that exposed 147 million customers’ personal data. The attackers were able to access full names, Social Security numbers, birth dates, addresses and driver license numbers of millions of American citizens. 209,000 people also had their credit card credentials stolen during the attack. In addition to the US, the breach also impacted UK and Canada residents.

Four Chinese hackers have been identified to be behind the Equifax cyber attack. The FBI has called the incident “the largest known theft of personally identifiable information ever carried out by state-sponsored actors”.

The four attackers, now identified as Wu Zhiyong, Wang Qian, Xu Ke and Liu Lei, exploited a vulnerability in the dispute resolution website in the Equifax system. They were then able to gain access to the company’s network and back-end databases. An investigation has shown that Equifax was aware of the vulnerability for weeks and failed to patch it in time. Equifax also knew of the breach for almost two months before making a public announcement. The company has to pay at least $575 million in fines after settling with the US Federal Trade Commissions.

According to the FBI, the four Chinese hackers used servers in multiple countries and approximately 40 different IP addresses to disguise the origin of the attack. US Justice Department has said that the four hackers work for the Chinese People’s Liberation Army (PLA) and were members of the PLA’s Research Institute, a component of the Chinese military.

“This data has economic value, and these thefts can feed China’s development of artificial intelligence tools as well as the creation of intelligence-targeting packages,” U.S Attorney General William Barr said. “In addition to the thefts of sensitive personal data, our cases reveal a pattern of state-sponsored computer intrusions and thefts by China targeting trade secrets and confidential business information.”

The four Chinese hackers have been charged with three counts of conspiracy to commit computer fraud, conspiracy to commit economic espionage, and conspiracy to commit wire fraud; two counts of unauthorized access and intentional damage to a protected computer; one count of economic espionage; and three counts of wire fraud. The current whereabouts of the four suspects are not known, and there is little chance that they will stand trial in the US.

China has denied the allegations and said that the China’s government, military and personnel do not engage in cyber theft.