The US has charged four Chinese military officers over the huge cyber-attack of credit rating giant Equifax.
More than 147 million Americans were affected in 2017 when hackers stole sensitive personal data including names and addresses.
Some UK and Canadian customers were also affected.
Announcing the indictments Attorney General William Barr called the hack “one of the largest data breaches in history”.
According to court documents, the four are allegedly members of the People’s Liberation Army’s 54th Research Institute, a component of the Chinese military.
They spent weeks in the company’s system, breaking into security networks and stealing personal data, the documents said.
The nine-count indictment also accuses the group of stealing trade secrets including data compilation and database designs.
The whereabouts of the suspects is unknown and it is highly unlikely that they would come to the US for a trial.
FBI Deputy Director David Bowdich said: “We can’t take them into custody, try them in a court of law, and lock them up – not today, anyway.”
What happened in 2017?
Equifax said hackers accessed the information between mid-May and the end of July 2017 when the company discovered the breach.
The accused allegedly routed traffic through 34 servers in nearly 20 countries to try and hide their true location.
The credit rating firm holds data on more than 820 million consumers as well as information on 91 million businesses.
Mr Bowdich said there was no evidence so far of the data being used to hijack a person’s bank account or credit card.
Equifax CEO Mark Begr said in a statement that the company was grateful for the investigation.
“It is reassuring that our federal law enforcement agencies treat cybercrime – especially state-sponsored crime – with the seriousness it deserves.”
After the hack was identified, Equifax paid a $700m (£541m) settlement to the Federal Trade Commission.
The US regulator alleged the Atlanta based firm failed to take reasonable steps to secure its network. At least $300m of the settlement went towards paying for identity theft services and other related expenses run up by the victims.
In a statement Mr Barr said: “This was a deliberate and sweeping intrusion into the private information of the American people.
“Today we hold PLA hackers accountable for their criminal actions, and we remind the Chinese government that we have the capability to remove the internet’s cloak of anonymity and find the hackers that nation repeatedly deploys against us.”
China has not yet commented on the charges.
This is not the first time the US has charged members of the Chinese military with hacking US companies.
The first indictment came back in 2014 and helped lead to a deal the following year to try and restrain such activity.
But clearly the US feels that it needs to return to the weapon of public indictments to increase pressure again.
The US has become increasingly concerned not just at the alleged theft of economic secrets but also the intelligence risks.
Equifax was one of a series of large data breaches linked to China – others include health care providers and, most significantly, the theft of data from the Office of Personnel Management which carried sensitive records for almost all US federal employees.
One of the concerns for US security officials is how Chinese spies may be able to put together these vast databases about US citizens.
Officials say the information could be used to create ‘targeting packages’, establishing which individuals have access to sensitive information and potential vulnerabilities which would allow them to be approached. They add though that so far they have not seen the Equifax information being used for that purpose.
Source: bbc.co.uk
Be the first to comment