It Was The Chinese Army That Hacked Equifax

US has charged four Chinese military officers for cyber-attacks on credit rating giant Equifax in 2017 and stealing the personal information of about 145 million Americans. Millions of Canadian and British customers were also affected by the cyber-attack, which has been described as one of the largest data breaches in history.

Between May and the end of July 2017, the hackers stole 145.5 million social security numbers and 209,000 payment card numbers and expiration dates as well as names and addresses and Equifax’s company secrets, according to US Law Enforcement officials.

The charges against the men include conspiracy to commit computer fraud, conspiracy to commit economic espionage and conspiracy to commit wire fraud.In an indictment handed up by a grand jury in Atlanta, the men face nine counts including conspiracy to commit computer fraud and conspiracy to commit economic espionage. 

Attorney General William Barr, who announced the charges, called it the latest example of what he said was a sweeping campaign by China's government to steal seemingly endless amounts of data from the United States. "Unfortunately, the Equifax hack fits a disturbing and unacceptable pattern of state-sponsored computer intrusions and thefts by China and its citizens that have targeted personally identifiable information, trade secrets and other confidential information," Barr said.

Equifax, which is based in Atlanta, compiles information on millions of Americans as part of the loan and finance system. Last year, it paid up to $700 million in fines and monetary relief to consumers.
The four men who have been charged are members of the 54th Research Institute of the People's Liberation Army, according to the indictment. 

Cyber Attack Access
The defendants illegally accessed Equifax's network through a vulnerability in the company's online dispute portal, prosecutors say. Once inside the system, they vacuumed up names, birth dates and social security numbers for 145 million Americans, nearly half of all Americans. They stole credit card numbers and other information for some 200,000 Americans as well as Equifax trade secrets, the indictment says."For years, we have witnessed China's voracious appetite for the personal data of Americans, including the theft of personnel records from the Office of Personnel Management, the intrusion into Marriott Hotels and Anthem health insurance companies, and now the wholesale theft of credit and other information from Equifax," Barr said.

"This data has economic value," he added, "and these thefts can feed China's development of artificial intelligence tools, as well as the creation of intelligence targeting packages."

The FBI's deputy director, David Bowdich, said there's no indication at this point that the stolen information has been used, including to target U.S. government officials. Prosecutors say the hackers tried to cover their tracks to avoid detection by routing their work through around 34 servers located in nearly 20 countries.

Cyber War 
The charges recently announced are the latest against Chinese or China-linked defendants in a string of Justice Department prosecutions, part of what Barr and other officials call a huge wave of espionage activity, including economic, directed at the US. 

Equifax CEO Mark Begor said in a statement on Monday that his company has tried to keep pace with cybersecurity but the sophistication of threats like that posed by China would test any company, or other targets. "Combating this challenge from well-financed nation-state actors that operate outside the rule of law is increasingly difficult," he said. "Fighting this cyberwar will require the type of open cooperation and partnership between government, law enforcement and private business that we have experienced firsthand."

Equifax was also fined £500,000 by the UK’s Information Commissioner’s Office for failing to protect the personal information of up to 15 million British consumers.

One year after the attacks Equifax reportedly spent more than £1 billion in clean-up costs and to overhaul its information security programme.As well as financial reimbursement, the company must also provide all of its US customers with six free credit reports every year for seven years.

NPR:     The Week:         DIGIT:      BBC:        Washington Examiner

You Might Also Read: 

The Financial Services Industry Just Does Not Get It:

Equifax: Insider Trading Charges:

 

 

« Cyber Attacks On Banks Could Trigger Financial Crisis
Labour Party Risks £15m Fine For Not protecting Members' Data »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Tines

Tines

The Tines security automation platform helps security teams automate manual tasks, making them more effective and efficient.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Information Security Media Group (ISMG)

Information Security Media Group (ISMG)

Information Security Media Group is the world’s largest media organization devoted solely to information security and risk management.

Clifford Chance

Clifford Chance

Clifford Chance are one of the world's pre-eminent law firms with resources across five continents. Practice areas include Cyber Security & Information Protection

Boxcryptor

Boxcryptor

Boxcryptor encrypts your sensitive files before uploading them to cloud storage services.

SKKU Security Lab (seclab)

SKKU Security Lab (seclab)

SKKU Security Lab supports research and education in information security engineering. The lab is a part of the College of Software, Sungkyunkwan University.

macmon secure

macmon secure

macmon secure develops network security software, focussing on Network Access Control.

Redbelt Security

Redbelt Security

Redbelt is a cyber security consultancy. We integrate people, systems, services and products to transform how your information security is delivered.

Crypto4A Technologies

Crypto4A Technologies

Crypto4A quantum-ready cybersecurity solutions significantly improve protection for Cloud, loT, Blockchain, V2X, government and military application deployments.

S2S Group

S2S Group

S2S Group specialise in the destruction and management of IT assets at the end of the lifecycle.

Absolute IT Asset Disposals

Absolute IT Asset Disposals

Absolute IT Asset Disposals is an IT asset disposal (ITAD) company providing safe and secure recycling of IT assets.

The Legal 500

The Legal 500

The Legal 500 Hall of Fame highlights, to clients, the law firm partners who are at the pinnacle of the profession. Practice areas covered include Data Protection, Privacy and Cybersecurity.

PreVeil

PreVeil

We started PreVeil to bring radically better security to ordinary business and personal communication and information storage.

Cybercentry

Cybercentry

Cybercentry is a specialist information security, data protection and cyber security consultancy.

DynTek

DynTek

DynTek delivers exceptional, cost-effective professional IT consulting services, end-to-end IT solutions and managed IT services.

Diversified Technical Services Inc. (DTSI)

Diversified Technical Services Inc. (DTSI)

DTSI provides a wide range of technology solutions for Federal Agencies, the Department of Defense, and commerical organizations with capabilities including Cyber Security and DevSecOps.

Hydden

Hydden

Hydden gives security teams the ability to create a solid foundation to build a truly next-gen identity security practice by bridging the gaps between siloed teams and technologies.

ClearSale (CLSA3)

ClearSale (CLSA3)

Clearsale’s innovative fraud solutions combine advanced technology with a passionate team of seasoned experts that understand every client’s unique needs.