According to the indictment, Wu Zhiyong, Wang Qian, Xu Ke, and Liu Lei exploited a vulnerability in the dispute resolution website within the Equifax system. From that initial access point, the hackers used a number of techniques to force their way into the company’s network and back-end databases.
In announcing the charges, U.S. Attorney General William Barr said the Equifax intrusion is among other efforts by the Chinese government to steal the personal data of Americans. The Justice Department believes the Chinese were also responsible for breaching systems controlled by the Office of Personnel Management, Marriott hotels, and the health insurance company Anthem.
“This data has economic value, and these thefts can feed China’s development of artificial intelligence tools as well as the creation of intelligence-targeting packages,” Barr said. “In addition to the thefts of sensitive personal data, our cases reveal a pattern of state-sponsored computer intrusions and thefts by China targeting trade secrets and confidential business information.”