U.S. Charges Chinese Military Officers in Massive Equifax Hack

Four members of China's People's Liberation Army were charged with masterminding the 2017 Equifax data breach that compromised the personal information of approximately 145 million Americans, prosecutors announced on February 10, 2020.

The indicted individuals—Wu Zhiyong, Wang Qian, Xu Ke, and Liu Lei—all members of the PLA's 54th Research Institute—were accused of exploiting a known vulnerability in Apache Struts software that powered Equifax's dispute resolution portal. Through this entry point, the attackers gained persistent access to the company's network and maintained their presence undetected for nearly three months.

Hackers first penetrated Equifax's systems no later than May 13, 2017, and continued stealing data through July 30, 2017. During that window, they conducted approximately 9,000 search queries across Equifax's databases, extracting Social Security numbers, driver's license numbers, and passport photos belonging to millions of Americans. The breach also exposed Equifax trade secrets, including proprietary methods for assembling and storing data.

To avoid detection, the attackers employed sophisticated techniques. They routed stolen data through roughly 34 servers spanning approximately 20 countries, encrypted their communications, and systematically deleted logs on a daily basis. This methodical approach allowed them to operate within Equifax's network for weeks without triggering alarms.

U.S. Attorney General William Barr described the theft as staggering in scale. "This was one of the largest data breaches in history," Barr said, characterizing the attack as part of a broader pattern of state-sponsored Chinese intrusions targeting American companies and institutions.

The charges—returned by a federal grand jury in Atlanta, where Equifax is headquartered—include computer fraud, economic espionage, and wire fraudespionage, and wire fraud. At the time of the indictment, none of the four defendants had been apprehended or tried.

Equifax CEO Mark Begor responded to the charges by framing the attack as a threat not only to individual consumers but to the nation itself. "The attack on Equifax was an attack on U.S. consumers as well as the United States," Begor stated.

The breach had far-reaching consequences for Equifax. The company's former CEO Richard Smith resigned in the aftermath, and the incident triggered multiple lawsuits and congressional hearings. Despite the concern at the time of indictment, investigators found no evidence that the stolen data had been actively used by cybercriminals, though officials warned of potential circulation on the black market.

China categorically denied responsibility for the hack, rejecting U.S. accusations against its military personnel.

The 2017 Equifax breach became a watershed moment in discussions about corporate cybersecurity and the vulnerability of major American institutions to state-sponsored attacks. The scale of compromised data—affecting roughly 44 percent of the U.S. population—highlighted the potential for foreign intelligence services to harvest sensitive personal information at unprecedented scale.

Sources: https://cyberscoop.com/equifax-hack-china-pla-department-of-justice/ https://www.politico.com/news/2020/02/10/us-charges-chinese-spies-with-massive-equifax-hack-113129 https://www.cbsnews.com/news/china-denies-responsibility-in-equifax-breach-after-doj-charges-four-military-members/ https://threatpost.com/equifax-breach-four-members-of-chinese-military-charged-with-hacking/152739/