The United States Department of Justice today announced charges against 4 Chinese military hackers who were allegedly behind the Equifax data breach that exposed the personal and financial data of nearly 150 million Americans.
In a joint press conference held today with the Attorney General William Barr and FBI Deputy Director David Bowdich, the DoJ officials labeled the state-sponsored hacking campaign as the largest hacking case ever uncovered of this type.
The four accused, Wu Zhiyong (吴志勇), Wang Qian (王乾), Xu Ke (许可) and Liu Lei (刘磊), have also been indicted for their involvement in hacking and stealing trade secrets, intellectual property and confidential information from several other U.S. businesses in recent years.
In September 2017, credit reporting agency Equifax disclosed it had become a victim of a massive cyberattack that left highly sensitive data of nearly half of the U.S. population in the hands of hackers.
As The Hacker News reported earlier, hackers compromised Equifax servers using a critical vulnerability in Apache Struts Web Framework that the company forgets to patch on time even when an updated secure version of the software was available.
"They used this access to conduct reconnaissance of Equifax's online dispute portal and to obtain login credentials that could be used to further navigate Equifax's network. The defendants spent several weeks running queries to identify Equifax's database structure and searching for sensitive, personally identifiable information within Equifax's system," the DoJ said.
"Once they accessed files of interest, the conspirators then stored the stolen information in temporary output files, compressed and divided the files, and ultimately were able to download and exfiltrate the data from Equifax's network to computers outside the United States. In total, the attackers ran approximately 9,000 queries on Equifax's system, obtaining names, birth dates, and social security numbers for nearly half of all American citizens."
"The defendants took steps to evade detection throughout the intrusion, as alleged in the [nine-count] indictment. They routed traffic through approximately 34 servers located in nearly 20 countries to obfuscate their true location, used encrypted communication channels within Equifax's network to blend in with normal network activity, and deleted compressed files and wiped log files on a daily basis in an effort to eliminate records of their activity."
As a result of the breach, the credit monitoring company Equifax was fined £500,000 by the U.K.'s privacy watchdog for failing to take appropriate steps to protect its customers and also agreed to pay up to $700 million in fines to settle a series of state and federal investigations in the United States.
The DoJ officials said the FBI started this investigation two years ago with only 40 IP addresses that were involved in the attacks that lead the agency to these four members of the People's Liberation Army's 54th Research Institute.
All four indicted suspects are still at large, residing in China and have been added to the FBI's Most Wanted Cyber list.
This is not the first time when the U.S. has charged Chinese intelligence officers over hacking and cyber espionage. In 2014, similar charges were announced against five Chinese military officials for hacking and cyber espionage against several American companies.
Besides this, the U.S has also charged the other two Chinese hackers in 2015 for a massive data breach where hackers stole the personal information of over 80 million customers of the Anthem health insurance company.
This story is developing and will be updated shortly as details become available. Stay tuned with The Hacker News on Twitter for quick updates.
