Court filing sheds light on how US was able to attribute the Equifax hack to China and the techniques alleged state sponsored hackers used
Even for U.S. law enforcement, the Equifax hack was different. — Unlike in previous examples of apparent Chinese government-backed cyber-operations … Tweets: @shanvav , @decaturand , @profcarroll , @sinopsiscz , and @jeffstone500 Tweets: Shannon Vavra / @shanvav : 👀 At times Equifax moved so slowly in investigating its breach that DOJ officials briefly considered issuing a subpoena, a former official tells @jeffstone500...Read this post-mortem on investigating/attributing the Equifax hack to China @CyberScoopNews https://www.cyberscoop.com/... @decaturand : Even when this first happened, it wasn't like you could fire Equifax from being in charge of your credit report. On mine was an activated credit card which had not been in my possession since my divorce in 2001. When I went through the arduous efforts to get it out of my name.. https://twitter.com/... @profcarroll : Said it before. Will say it again. Equifax should have been seized and shuttered. Its protection by the credit cartel is unacceptable and endangers national security. https://twitter.com/... Sinopsis / @sinopsiscz : “Then, four officers from China's People's Liberation Army — Wu Zhiyong, Wang Qian, Xu Ke and Liu Lei — spent two months inside, stealing names, Social Security numbers and other information about nearly half the people in the U.S., prosecutors say.” https://twitter.com/... Jeff Stone / @jeffstone500 : Investigating the Equifax breach was a “huge pain in the ass,” one former DOJer told me. The company was slow to provide incident data, and hackers took more care to cover their tracks than in old Chinese cases. Lessons from the indictment @CyberScoopNews. https://www.cyberscoop.com/...
Context & Ripple Effects
This filing is the forensic back-story to last week's DOJ indictment of four Chinese intelligence officers for the 2017 Equifax breach, which exposed financial records of nearly half of U.S. residents. Where the indictment named the suspects, this post-mortem explains how investigators actually pinned the operation on the People's Liberation Army and what techniques the hackers used to cover their tracks.
The piece also fills in an awkward domestic chapter: Equifax had told the FBI two years before the hack that it suspected Chinese spies were taking code and HR files, and a researcher had warned about the unpatched vulnerability months ahead of the breach. Cooperation was so slow during the investigation that DOJ officials briefly weighed a subpoena.
First-order effects
- The DOJ now has a documented attribution chain against four named PLA officers, converting a 2017 breach disclosure into a prosecutable espionage case and putting Liu Lei, Wang Qian, and their co-defendants under formal U.S. criminal charges.
- Equifax's sluggish incident response — serious enough that officials considered a subpoena — becomes part of the public record, compounding earlier criticism that its data-hoarding strategy amplified the breach's blast radius.
Second-order effects
- Publicly detailing the hackers' tradecraft gives every U.S. company holding similar data troves a detection template, shifting pressure onto credit bureaus and data brokers to harden networks against the specific PLA techniques now in the open.
- Indicting serving military intelligence officers sets up diplomatic friction with Beijing and signals to other agencies that naming state hackers is now the default U.S. response rather than quiet attribution.
Third-order effects
- If the pattern holds, attribution filings become a standing instrument of cyber policy — evidence-gathering designed as much for public naming-and-shaming and alliance signaling as for prosecution, a line that runs straight through to the China-linked Salt Typhoon intrusions into Verizon and AT&T reported years later.
- The Equifax arc — pre-breach warnings ignored, slow cooperation, maximal data collection — feeds the case for regulators treating consumer-data concentration itself as a national-security exposure rather than a compliance checkbox.
The trend: U.S. cyber policy is shifting from private attribution of Chinese state hacking toward public criminal indictments of named military officers, with each filing doubling as intelligence disclosure.