Wu Zhiyong, Wang Qian, Xu Ke, Liu Lei, Computer Fraud, Economic Espionage, Wire Fraud, Georgia 2020

Four Chinese PLA Members Charged with Hacking into Equifax and Stealing Americans' Personal Data and Trade Secrets

ATLANTA, GEORGIA - Four members of the Chinese People's Liberation Army (PLA) have been charged with hacking into the computer systems of the credit reporting agency Equifax and stealing Americans' personal data and Equifax's valuable trade secrets.

The indictment alleges that Wu Zhiyong (吴志勇), Wang Qian (王乾), Xu Ke (许可) and Liu Lei (刘磊) were members of the PLA's 54th Research Institute, a component of the Chinese military. They allegedly conspired with each other to hack into Equifax's computer networks, maintain unauthorized access to those computers, and steal sensitive, personally identifiable information of approximately 145 million American victims.

The indictment alleges that the defendants exploited a vulnerability in the Apache Struts Web Framework software used by Equifax's online dispute portal. They used this access to conduct reconnaissance of Equifax's online dispute portal and to obtain login credentials that could be used to further navigate Equifax's network.

The indictment also charges the defendants with stealing trade secret information, namely Equifax's data compilations and database designs. The indictment alleges that the defendants spent several weeks running queries to identify Equifax's database structure and searching for sensitive, personally identifiable information within Equifax's system.

According to U.S. Attorney Pak, the charges and other information presented in court: The defendants used this access to conduct reconnaissance of Equifax's online dispute portal and to obtain login credentials that could be used to further navigate Equifax's network.

The indictment alleges that the defendants stole sensitive, personally identifiable information of approximately 145 million American victims, including names, birth dates, and social security numbers. The indictment also alleges that the defendants stole trade secret information, namely Equifax's data compilations and database designs.

The charges against the defendants include computer fraud, economic espionage, and wire fraud. The indictment was returned by a federal grand jury on July 31, 2020. The case is being prosecuted by the U.S. Attorney's Office for the Northern District of Georgia and is being investigated by the FBI.

Source: https://www.justice.gov/usao-ndga/pr/chinese-military-personnel-charged-computer-fraud-economic-espionage-and-wire-fraud