US Justice Department charges four members of Chinese military over Equifax hack

All accused currently live in China, and none of them is in custody

The US Department of Justice (DoJ) has charged four members of China's People's Liberation Army (PLA) over the cyber attack on credit reference agency Equifax in 2017.

The hackers, who are listed as Wang Qian, Wu Zhiyong, Liu Lei, and Xu Ke in the DoJ's indictment, are charged with unauthorised access and damage to a protected computer, conspiracy to commit computer fraud, wire fraud, and economic espionage.

According to the DoJ, the four Chinese nationals hacked into the computer networks of Equifax and stole valuable trade secrets, as well as the personal data of nearly 145 million Americans.

They collected names, addresses, driving licence numbers, valuable Social Security numbers, and a number of other details stored in Equifax's poorly secured systems. The data breach also compromised the credit card details of more than 200,000 individuals.

Last year, Equifax agreed to pay up to $700 million in fines and compensation in a settlement with US regulators over the data breach.

"The scale of the theft was staggering," Attorney General William Barr said on Monday.

"This theft not only caused significant financial damage to Equifax, but invaded the privacy of many millions of Americans, and imposed substantial costs and burdens on them as they have had to take measures to protect against identity theft."

"Today, we hold PLA hackers accountable for their criminal actions, and we remind the Chinese government that we have the capability to remove the Internet's cloak of anonymity and find the hackers that nation repeatedly deploys against us," he added.

Prosecutors disclosed that the suspects exploited a security flaw in Apache Struts framework to break into Equifax's network. They obtained login credentials and used them to access the company's entire database. To hide their tracks, they wiped log files on a daily basis and also routed traffic through multiple servers located in about 20 countries.

They run nearly 9,000 queries on Equifax's system to obtain personal details of nearly half of all American citizens.

All the accused hackers currently live in China, and none of them is in custody. There is no extradition treaty between the US and China and the suspects are unlikely to appear in a US court.

This is the second time that the US DoJ has indicted alleged members of China's PLA in an economic espionage case. In 2014, the DOJ indicted five members of the PLA with charges of trade secret theft, economic espionage, conspiracy to commit computer fraud, identity theft, and other related crimes.

US law enforcement agencies also suspect the involvement of Chinese state organisations in the 2015 breach of the Federal Office of Personnel Management (OPM) and in infiltrations into the networks of health insurer Anthem Inc. and Marriott hotel chain.