WASHINGTON — The Justice Department says four members of the Chinese military have been charged with breaking into the computer networks of the Equifax credit reporting agency and stealing the personal information of about 145 million Americans.
Law enforcement officials say the suspects, Wu Zhiyong, Wang Qian Xu Ke and Liu Lei, are also accused of stealing the company's trade secrets. The defendants are all members of the People's Liberation Army, an arm of the Chinese military.
According to an indictment, the defendants exploited a vulnerability in the Apache Struts Web Framework software used by Equifax to conduct reconnaissance of the company’s online dispute portal and to obtain login credentials that could be used to further navigate Equifax’s network.
The suspects allegedly spent several weeks running queries to identify Equifax’s database structure and searching for sensitive, personally identifiable information within Equifax’s system.
Once they accessed files of interest, officials say the conspirators then stored the stolen information in temporary output files, compressed and divided the files, and ultimately were able to download and exfiltrate the data from Equifax’s network to computers outside the U.S.
“This was a deliberate and sweeping intrusion into the private information of the American people,” said Attorney General William P. Barr. “Today, we hold PLA hackers accountable for their criminal actions, and we remind the Chinese government that we have the capability to remove the Internet’s cloak of anonymity and find the hackers that nation repeatedly deploys against us. Unfortunately, the Equifax hack fits a disturbing and unacceptable pattern of state-sponsored computer intrusions and thefts by China and its citizens that have targeted personally identifiable information, trade secrets, and other confidential information.”
Officials say the defendants took steps to evade detection throughout the intrusion.
"They routed traffic through approximately 34 servers located in nearly 20 countries to obfuscate their true location, used encrypted communication channels within Equifax’s network to blend in with normal network activity, and deleted compressed files and wiped log files on a daily basis in an effort to eliminate records of their activity," the Justice Department said.
The defendants are charged with three counts of conspiracy to commit computer fraud, conspiracy to commit economic espionage, and conspiracy to commit wire fraud. The defendants are also charged with two counts of unauthorized access and intentional damage to a protected computer, one count of economic espionage, and three counts of wire fraud.
“In short, this was an organized and remarkably brazen criminal heist of sensitive information of nearly half of all Americans, as well as the hard work and intellectual property of an American company, by a unit of the Chinese military,” said Barr.
The case comes as the Trump administration has warned against what it sees as the growing political and economic influence of China, and efforts by Beijing to collect data on Americans and steal scientific research and innovation.
