US DOJ charges four Chinese intelligence officers with hacking Equifax; the breach was disclosed in 2017 and exposed financial records of 150M Americans

Federal prosecutors announced charges Monday against four Chinese intelligence officers for hacking the credit-reporting giant Equifax …

Politico 2020-02-11 Eric Geller

Context & Ripple Effects

The Equifax indictment is the Justice Department's most prominent use yet of a playbook it has been building for years: in 2017 it charged three members of a Chinese cyber-espionage unit over hacks of Moody's Analytics, Siemens, and Trimble, establishing the pattern of naming state-linked hackers in federal criminal complaints even when they will never see a US courtroom.

What makes this case different is scale and target — a credit bureau holding financial records on 150 million Americans — and the follow-through: days after the announcement, a court filing detailed how investigators attributed the intrusion to China and the techniques the alleged state-sponsored hackers used, giving the attribution a technical paper trail rather than leaving it a diplomatic assertion.

First-order effects

Four named Chinese intelligence officers are now fugitives under US federal indictment, converting what had been an anonymous 2017 breach disclosure into a formally attributed act of state-directed theft of Americans' financial data.
Equifax's breach moves from corporate security failure to evidence in a national-security prosecution, reshaping how the company's 2017 handling of 150 million consumers' records is judged.

Second-order effects

The indictment did not close the file — months later the DOJ charged five more Chinese citizens over hacks targeting 100 US companies and institutions, with two arrests in Malaysia, showing prosecutors extending the same charging strategy from one marquee breach to a broad campaign.
By mid-2021 the DOJ was unsealing charges against members of China-backed APT 40 covering activity from 2011 to 2018, indicating each public indictment feeds intelligence from prior cases into the next round of prosecutions.

Third-order effects

If the cadence holds, public criminal indictment becomes the standing US response to state-sponsored hacking — a deterrence-by-naming regime where attribution quality, like the Equifax court filing, is the actual weapon.
Companies holding concentrated troves of financial and identity data are structurally recast as espionage targets whose breaches carry geopolitical consequences, not just liability exposure.

The trend: US cyber policy is shifting from quiet diplomatic protest to routine public criminal indictments of Chinese state hackers, with each attribution filing raising the evidentiary bar for the next.

Discussion

@dnvolz Dustin Volz on x
Overlooked moment in the DoJ press conference today: Barr linked the Marriott breach to the Chinese. I believe that is the first time the U.S. government has publicly acknowledged a connection to Beijing. https://www.wsj.com/... https://twitter.com/...
@dalperovitch Dmitri Alperovitch on x
DOJ Indicts 4 members of PLA for Equifax hack (part of 54th Research Institute). One of the few publicly disclosed cyber actions from PLA since 2016 Cyber Agreement. Most activity in recent years has emanated from MSS and their contractors https://www.justice.gov/...
@zackwhittaker Zack Whittaker on x
Equifax statement. (It would've been nice had Equifax at least acknowledged its own massive fuckups that led to the breach in the first place.) A House report in 2018 that the breach was “entirely preventable” had Equifax bothered to patch its systems. https://techcrunch.com/... …
@swiftonsecurity @swiftonsecurity on x
Equifax stole your data, China just copied it without paying them.
@hshaban Hamza Shaban on x
“The attack on Equifax was an attack on US consumers as well as the United States” -Equifax, the company that collected the data in the first place, without anyone's permission, and then failed to safeguard it, and this whole thing was completely preventable.
@vermontgmg Garrett M. Graff on x
DOJ announcement of Chinese hackers ties together whole series of state-sponsored data thefts: OPM, Marriott, Anthem, and Equifax. Huge pool of data, will take decades to undo damage to US intelligence.
@sentoomey Senator Pat Toomey on x
The Chinese gov. hacked & stole the private data of millions of Americans, including over 5.5 million Pennsylvanians. This reckless, unacceptable, & brazen disregard for the rule of law must not stand. I fully support @TheJusticeDept's indictments today. https://apnews.com/...
@ajitpaifcc Ajit Pai on x
You don't say. “[I]n a single breach, the [People's Liberation Army of China] obtained sensitive personally identifiable information for nearly half of all American citizens.” From @TheJusticeDept indictment of four individuals involving @Equifax hack. https://www.justice.gov/...…
@repjackbergman Rep. Jack Bergman on x
With today's report about China's involvement in the @Equifax breech, we must pass the HACT Act, that I introduced w/@RepAndyKimNJ, to protect Americans from cyberattacks. Enough is enough! Cc:@JacksonLeeTX18 @RepValDemings https://www.washingtonpost.com/ ...
@repandybiggsaz Rep Andy Biggs on x
AG Barr & his team at the DOJ are working tirelessly to protect American interests - especially in the face of severe IP & data theft from China. These Chinese efforts must stop, & I am pleased to see the @realDonaldTrump administration taking action. https://www.wsj.com/...
@merlemaigre Merle Maigre on x
“Equifax employed the username ‘admin’ and the password ‘admin’ to protect a portal used to manage credit disputes,” it reads. #howlongisyourpassword https://twitter.com/...
@kennwhite Kenn White on x
“PLA...attackers ran approximately 9,000 [SQL] queries on Equifax's system. [Then] created an archive containing 49 directories. Once created...split it into 600MB segments which were then downloaded from the Equifax network to a Dutch server via HTTP.” https://www.justice.gov/..…
@selectedwisdom Clint Watts on x
Indictment @FBI against PLA contains good cyber forensic work. Some interesting notes, time breach to detection/removal seems be +/- 45 days, took 2+ years for this indictment, imagine how many attacks conducted by these 4 & 10000s of hacker in meantime https://www.justice.gov/..…
@senwarren Elizabeth Warren on x
The @Equifax data breach that compromised 145 million Americans' personal info is a national security nightmare: a hostile foreign attack on a giant US corporation that, without consent, holds all of our personal data - & lacks incentive to keep it safe. https://www.nytimes.com/.…
@swiftonsecurity @swiftonsecurity on x
Equifax is not a victim they're fucking co-conspirators
@emptywheel @emptywheel on x
Q: I don't dispute that it does, but how does Equifax have economic value but stolen Democratic fundraising information does not?
@dnvolz Dustin Volz on x
Prosecutors said PLA's 54th Research Institute—traditionally focused on supporting electronic warfare akin to Cyber Command as opposed to cyber espionage—was behind the hack, an indication the group's “missions may be evolving,” @EBKania said. https://www.wsj.com/...
@robertmaguire_ Robert Maguire on x
Your regular reminder that Equifax still exists. Nearly everyone who was running the company when it allowed a breach of 143 million Americans' personal data is still rich, and their former lawyer is in charge of the office at the FTC that's supposed to investigate them https://t…
@alfredwkng @alfredwkng on x
Update: Equifax's CISO tells me that even if they had patched that vulnerability, it's possible that the breach still would've happened, given how sophisticated the Chinese military hackers are https://www.cnet.com/... https://twitter.com/...
@alex @alex on x
I can't believe that Equifax is still in business https://twitter.com/...
@profcarroll @profcarroll on x
Equifax should be in bankruptcy court, decimated by legal exposure. We watched Cambridge Analytica go belly up shedding its liabilities while Equifax seems incompetent yet invincible? (Answer: the credit agency triopoly and lack of national data rights.)
@ridt Thomas Rid on x
Hello 👋 whatever your spy OPSEC—we will hunt you down, and send your mugshot on a WANTED poster to all your friends https://www.justice.gov/... https://twitter.com/...
@kimzetter Kim Zetter on x
You can't say the PLA hackers are lazy, but Equifax certainly didn't make it hard for them https://twitter.com/...
@hshaban Hamza Shaban on x
1)Equifax collects data about hundreds of millions of Americans without our consent and there is no “opting out” 2)Equifax failed to patch a known vulnerability which is how hackers accessed this data 3)Nothing about how data brokers operate has changed https://www.washingtonpost…
@senatorromney Senator Mitt Romney on x
The Equifax hack is yet another example of China's commitment to data theft. A warning to our allies: remember the inherent threat that accompanies incorporating Chinese technology into your infrastructure. https://www.washingtonpost.com/ ...
@alfredwkng @alfredwkng on x
In a statement, Equifax's CEO said that it was “increasingly difficult” to protect against nation-state hackers. Just a reminder that Equifax's hack happened because of a months-old vulnerability that it failed to patch, not a sophisticated 0-day: https://www.cnet.com/...
@kimzetter Kim Zetter on x
The timing of this makes me wonder if DoJ intentionally withheld going public with the indictment until after Equifax reached its settlement agreement https://www.ftc.gov/... https://twitter.com/...
@campuscodi Catalin Cimpanu on x
The indictment is here: https://www.scribd.com/... Nothing new on a first read. It mostly echoes the findings of a 2018 GOA report: https://www.gao.gov/... https://twitter.com/...
@alexstamos Alex Stamos on x
Some excellent work by the FBI and, I assume, IC partners like NSA/CYBERCOM to provide some narrative and attribution for the Equifax hack. We are still missing a critical function: an NTSB style report on the technical, operational and leadership failures that got us here. https…
@joeuchill Joe Uchill on x
Equifax becomes the latest example of protecting privacy and customer security at scale turning into an issue of national security.
@privacyproject @privacyproject on x
From the @nytimes newsroom: “The nine-count indictment accused the Chinese military of hacking into the company's computer networks, maintaining unauthorized access to them and stealing sensitive, personally identifiable information,” reports @ktbenner https://www.nytimes.com/...
@shashj Shashank Joshi on x
Interesting shift of recent years is how US officials have tried to stigmatise cyber-espionage against “personally identifiable information”, putting it on par with theft of commercial secrets and election interference. Recall that Michael Hayden called it “honourable espionage”.…
@iblametom Thomas Brewster on x
US published images of the defendants in the Equifax hack indictment, two in their Chinese military uniform... https://www.forbes.com/... https://twitter.com/...
@ericgeller Eric Geller on x
FBI Deputy Director David Bowdich: “This is the largest theft of sensitive PII by state-sponsored hackers ever recorded.”
@ericgeller Eric Geller on x
Bowdich admits that the FBI likely won't be able to apprehend these hackers any time soon. “We'll keep putting pressure on these bad actors, making sure they understand the risks and the consequences of their actions.”

Chronicles