A federal grand jury has returned an indictment charging four members of the Chinese People’s Liberation Army (PLA) with hacking into the computer systems of the credit reporting agency Equifax and stealing Americans’ personal data and Equifax’s valuable trade secrets.
The nine-count indictment alleges that Wu Zhiyong (吴志勇), Wang Qian (王乾), Xu Ke (许可) and Liu Lei (刘磊) were members of the PLA’s 54th Research Institute, a component of the Chinese military. They allegedly conspired with each other to hack into Equifax’s computer networks, maintain unauthorized access to those computers, and steal sensitive, personally identifiable information of approximately 145 million American victims.
“This was a deliberate and sweeping intrusion into the private information of the American people,” said Attorney General William Barr, who made the announcement. “Today, we hold PLA hackers accountable for their criminal actions, and we remind the Chinese government that we have the capability to remove the Internet’s cloak of anonymity and find the hackers that nation repeatedly deploys against us. Unfortunately, the Equifax hack fits a disturbing and unacceptable pattern of state-sponsored computer intrusions and thefts by China and its citizens that have targeted personally identifiable information, trade secrets, and other confidential information.”
“The indictment exposes the Chinese military’s effort to collect sensitive information of Americans on an unprecedented scale and steal proprietary information for the benefit of the Chinese government. With this announcement, we underscore our resolve to protect our citizens from state-sponsored cyber threats and to unmask those who perpetrate unlawful attacks,” said U.S. Attorney Byung “BJay” Pak of the Northern District of Georgia. “These charges were made possible because Equifax worked closely, and early, with our dedicated law enforcement team to hold the perpetrators accountable. As corporations like Equifax continue to be targeted by cyber attacks, this investigation illustrates the critical importance of public-private collaboration to combat the most sophisticated cyber threats.”
“The FBI is dedicated to working with our federal partners to seek justice for anyone who would threaten the safety, security and confidence of our American citizens,” said Chris Hacker, Special Agent in Charge of FBI Atlanta. “These criminal hackers, sponsored by their government, were not able to hide behind the internet curtain thanks to the determination of FBI Atlanta’s cyber squad, FBI Headquarters Cyber Division, the U.S. Attorney’s Office Northern District of Georgia and the Justice Department. This does not end our investigation into one of the biggest threats to our national security today.”
According to U.S. Attorney Pak, the charges and other information presented in court: The defendants exploited a vulnerability in the Apache Struts Web Framework software used by Equifax’s online dispute portal. They used this access to conduct reconnaissance of Equifax’s online dispute portal and to obtain login credentials that could be used to further navigate Equifax’s network. The defendants spent several weeks running queries to identify Equifax’s database structure and searching for sensitive, personally identifiable information within Equifax’s system.
Once they accessed files of interest, the conspirators then stored the stolen information in temporary output files, compressed and divided the files, and ultimately were able to download and exfiltrate the data from Equifax’s network to computers outside the United States. In total, the attackers ran approximately 9,000 queries on Equifax’s system, obtaining names, birth dates and social security numbers for nearly half of all American citizens.
The indictment also charges the defendants with stealing trade secret information, namely Equifax’s data compilations and database designs. “In short, this was an organized and remarkably brazen criminal heist of sensitive information of nearly half of all Americans, as well as the hard work and intellectual property of an American company, by a unit of the Chinese military,” said Barr.
The defendants took steps to evade detection throughout the intrusion, as alleged in the indictment. They routed traffic through approximately 34 servers located in nearly 20 countries to obfuscate their true location, used encrypted communication channels within Equifax’s network to blend in with normal network activity, and deleted compressed files and wiped log files on a daily basis in an effort to eliminate records of their activity.
The defendants are charged with three counts of conspiracy to commit computer fraud, conspiracy to commit economic espionage, and conspiracy to commit wire fraud. The defendants are also charged with two counts of unauthorized access and intentional damage to a protected computer, one count of economic espionage, and three counts of wire fraud. The details contained in the charging document are allegations. The defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.
The U.S. Attorney’s Office for the Northern District of Georgia, the Criminal and National Security Divisions of the Department of Justice, and the FBI’s Atlanta Field Office are investigating the case. The FBI’s Cyber Division also provided support. Equifax cooperated fully and provided valuable assistance in the investigation.
Assistant U.S. Attorneys Nathan Kitchens, Samir Kaushal, and Thomas Krepp of the Northern District of Georgia; Senior Counsel Benjamin Fitzpatrick of the Criminal Division’s Computer Crime and Intellectual Property Section; and Trial Attorney Scott McCulloch of the National Security Division’s Counterintelligence and Export Control Section are prosecuting this case. Attorneys with the Office of International Affairs provided critical assistance in obtaining evidence from overseas.
