China's campaign to build a database on Americans began with hacking travel records in 2013; recent OPM breach was part of the same campaign
Hacked in the U.S.A.: China's Not-So-Hidden Infiltration Op — The vast cyber-attack in Washington began with, of all things, travel reservations.
Context & Ripple Effects
What Bloomberg reports here is the origin story of a campaign the press had been piecing together all summer: a June report found the records of roughly four million federal employees in Chinese hands, and days later investigators linked the same rare tool to the Anthem breach. This piece pushes the timeline back further — to 2013 travel reservation hacks — and reframes OPM not as an isolated intrusion but as one node in a deliberate effort to compile dossiers on Americans.
The arc since has only confirmed it: by late July sources said the same hackers had hit United Airlines for flight manifest data, American Airlines and Sabre followed in August, and by 2018 the Marriott hack was tied to the same intelligence effort spanning insurers, hotels, and clearance files.
First-order effects
- OPM's personnel and security-clearance databases are now understood as targets inside a years-long collection program, meaning the exposure covers not just current staff but anyone whose travel, health insurance, or hotel records crossed the same operators.
Second-order effects
- Every sector holding identity-rich commercial data — airlines, insurers, hotel chains like Marriott — becomes a counterintelligence surface, forcing companies that thought they faced ordinary financial crime to treat breaches as state espionage with national-security fallout for their customers.
Third-order effects
- If the pattern holds, espionage shifts from stealing documents to assembling population-scale dossiers on individuals, leaving agencies like the FBI to defend distributed private-sector datasets rather than their own networks — the dynamic behind US officials' admission of being one step behind China through the decade.
The trend: Chinese state hacking is consolidating from isolated breaches into a persistent, multi-sector database-building operation on Americans, with travel, health, and hospitality data feeding the same intelligence file.