The U.S. Justice Department on Monday morning made a major announcement in connection with the Equifax data breach, calling it “a day of reckoning.”

With Equifax leadership “grateful to the Justice Department and the FBI for their tireless efforts,” officials said a federal grand jury in Atlanta returned an indictment last week charging four members of the Chinese People’s Liberation Army (PLA) with hacking into the computer systems of the credit reporting agency and stealing Americans’ personal data and Equifax’s valuable trade secrets.

The nine-count indictment alleges that Wu Zhiyong, Wang Qian, Xu Ke and Liu Lei were members of the PLA’s 54th Research Institute, a component of the Chinese military. The Justice Department said they allegedly conspired with each other to hack into Equifax’s computer networks, maintain unauthorized access to those computers, and steal sensitive, personally identifiable information of approximately 145 million American victims.

“This was a deliberate and sweeping intrusion into the private information of the American people,” said Attorney General William Barr, who made the announcement. “Today, we hold PLA hackers accountable for their criminal actions, and we remind the Chinese government that we have the capability to remove the Internet’s cloak of anonymity and find the hackers that nation repeatedly deploys against us.

“Unfortunately, the Equifax hack fits a disturbing and unacceptable pattern of state-sponsored computer intrusions and thefts by China and its citizens that have targeted personally identifiable information, trade secrets, and other confidential information,” Barr continued.

According to the indictment, the defendants exploited a vulnerability in the Apache Struts Web Framework software used by Equifax’s online dispute portal.  Officials explained the defendants used this access to conduct reconnaissance of Equifax’s online dispute portal and to obtain login credentials that could be used to further navigate Equifax’s network.  The defendants spent several weeks running queries to identify Equifax’s database structure and searching for sensitive, personally identifiable information within Equifax’s system. 

Once they accessed files of interest, the indictment indicated the conspirators then stored the stolen information in temporary output files, compressed and divided the files, and ultimately were able to download and exfiltrate the data from Equifax’s network to computers outside the United States.

In total, the Justice Department said the attackers ran approximately 9,000 queries on Equifax’s system, obtaining names, birth dates and social security numbers for nearly half of all American citizens.

The indictment also charges the defendants with stealing trade secret information, namely Equifax’s data compilations and database designs.

“In short, this was an organized and remarkably brazen criminal heist of sensitive information of nearly half of all Americans, as well as the hard work and intellectual property of an American company, by a unit of the Chinese military,” Barr said.

The Justice Department said the defendants took steps to evade detection throughout the intrusion, as alleged in the indictment.  They routed traffic through approximately 34 servers located in nearly 20 countries to obfuscate their true location, used encrypted communication channels within Equifax’s network to blend in with normal network activity, and deleted compressed files and wiped log files on a daily basis in an effort to eliminate records of their activity.

“Today’s announcement of these indictments further highlights our commitment to imposing consequences on cybercriminals no matter who they are, where they are, or what country’s uniform they wear,” FBI Deputy Director David Bowdich said in a news release. “The size and scope of this investigation — affecting nearly half of the U.S. population, demonstrates the importance of the FBI’s mission and our enduring partnerships with the Justice Department and the U.S. Attorney’s Office. 

“This is not the end of our investigation; to all who seek to disrupt the safety, security and confidence of the global citizenry in this digitally connected world, this is a day of reckoning.”

The defendants are charged with three counts of conspiracy to commit computer fraud, conspiracy to commit economic espionage, and conspiracy to commit wire fraud.  The defendants are also charged with two counts of unauthorized access and intentional damage to a protected computer, one count of economic espionage, and three counts of wire fraud.

The investigation was conducted jointly by the U.S. Attorney’s Office for the Northern District of Georgia, the Criminal and National Security Divisions of the Department of Justice, and the FBI’s Atlanta Field Office.  The FBI’s Cyber Division also provided support. 

Justice Department officials added Equifax cooperated fully and provided valuable assistance in the investigation that triggered a consumer settlement approaching $700 million.

“The details contained in the charging document are allegations,” officials said. “The defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.”

Reaction from Equifax

In a separate statement, Equifax chief executive officer Mark Begor shared the company’s gratitude for the actions by federal agencies.

“We are grateful to the Justice Department and the FBI for their tireless efforts in determining that the military arm of China was responsible for the cyberattack on Equifax in 2017,” Begor said. “It is reassuring that our federal law enforcement agencies treat cybercrime — especially state-sponsored crime — with the seriousness it deserves, and that the Justice Department is committed to pursuing those who target U.S. consumers, businesses and our government.

“The attack on Equifax was an attack on U.S. consumers as well as the United States,” he continued.

“Cybercrime is one of the greatest threats facing our nation today, and it is an ongoing battle that every company will continue to face as attackers grow more sophisticated,” Begor went on to say. “Combating this challenge from well-financed nation-state actors that operate outside the rule of law is increasingly difficult.

“Fighting this cyberwar will require the type of open cooperation and partnership between government, law enforcement and private business that we have experienced firsthand,” he added.

Begor noted that Equifax has made significant progress and investments to protect data during the past two years. The company is spending an incremental $1.25 billion between 2018 and 2020 on enhanced security and technology as part of its EFX 2020 cloud technology transformation.

“We have made tremendous progress toward embedding security into everything we do,” Begor said. “Our industry-leading cloud technology transformation will make us more secure and enable us to innovate and develop solutions with our differentiated data assets to better serve our customers and consumers.

“Today’s announcement is another positive step forward in helping us turn the page on the cybersecurity attack as we continue our focus on being a leader in data security,” he continued.

Begor closed with a few other points about the collaborative effort needed to stop another incident from happening.

“These cyberattacks on U.S. companies continue to escalate and are increasingly challenging to defend when well-financed state actors are involved,” he said. “We recognize that cybersecurity issues impact our entire industry, and we will continue to work openly with our peers, customers and partners, to tackle emerging security challenges, document best practices, provide vital data security thought leadership, and work together to deliver solutions that benefit both the security community and consumers.

“Working together is the only path to defend against these attacks,” he continued. “We greatly appreciate the work of every FBI investigator and Justice Department prosecutor who participated in this investigation.”