The case of 5 Chinese hackers who earlier breached US steel firms shows the ease of foiling US corporate security systems
David Talbot / MIT Technology Review :
Context & Ripple Effects
This 2015 case is the opening entry in what the surrounding coverage turns into a ten-year pattern file: five Chinese hackers penetrated US steel firms with such ease that MIT Technology Review framed it less as a breach than as an indictment of corporate defense itself. The legal follow-on came later, when the DOJ charged five Chinese citizens over hacks touching 100 companies and institutions in the sweeping 2020 indictment, showing the steel-firm case had become precedent rather than anomaly.
What changed since then is the target set, not the method. The intrusions migrated from commercial IP toward strategic access: US Navy contractors were hit for advanced military technology, Microsoft reported state-sponsored hackers inside critical infrastructure organizations, and by 2024 allied governments were warning that Volt Typhoon had held access to major US infrastructure for over five years while Salt Typhoon worked through telco networks for targeted espionage. Read against that arc, the steel-firm breach reads as the early proof that perimeter security was failing at every tier.
First-order effects
- US steel firms learned their existing security systems could be foiled without exotic techniques, forcing immediate reevaluation of perimeter-based defense at industrial companies.
- The case handed US prosecutors a working template for charging state-linked hackers, later scaled up in the DOJ's 100-target indictment of five Chinese citizens.
Second-order effects
- Once corporate IP theft drew indictments, operators shifted to harder-to-prosecute targets — Navy contractors and critical infrastructure organizations — where access itself, not stolen files, is the prize.
- Allied governments moved from quiet attribution to public joint advisories, as with the Five Eyes warning on Volt Typhoon, turning intrusion disclosure into a diplomatic instrument.
Third-order effects
- If the pattern holds, Chinese state-linked operations consolidate around long-dwell pre-positioning in infrastructure — telcos, utilities, military supply chains — rather than one-off exfiltration, which reframes US cyber policy from loss prevention to access denial.
- A decade of failed perimeters pushes the structural burden onto shared defense: vendor-level monitoring (Microsoft's own disclosures), intergovernmental advisories, and regulation of critical-infrastructure security become the default control points instead of individual corporate firewalls.
The trend: State-linked Chinese hacking has shifted over the past decade from stealing corporate trade secrets to establishing persistent footholds in US critical infrastructure, with each disclosed intrusion expanding the government response from indictment to joint allied advisories.