By 
4 Chinese hackers allegedly behind the Equifax data breach that divulged the personal and financial data of closely 150 million Americans have been charged by the United States Department of Justice.
The four charged, Wu Zhiyong (吴志勇), Wang Qian (王乾), Xu Ke (许可) and Liu Lei (刘磊), have also been indicted for being involved in hacking and stealing business secrets, intellectual property and private information from numerous other U.S. businesses recently.
In September 2017, credit reporting agency Equifax revealed it had become a victim of a huge cyberattack that left highly sensitive data of closely half of the U.S. population in the hands of hackers.
Hackers are reported to have compromised Equifax servers using a serious susceptibility in Apache Struts Web Framework that the company forgot to fix on time even when an updated secure version of the software was on hand.
“They used this access to conduct reconnaissance of Equifax’s online dispute portal and to obtain login credentials that could be used to further navigate Equifax’s network. The defendants spent several weeks running queries to identify Equifax’s database structure and searching for sensitive, personally identifiable information within Equifax’s system,” the DoJ said.
“Once they accessed files of interest, the conspirators then stored the stolen information in temporary output files, compressed and divided the files, and ultimately were able to download and exfiltrate the data from Equifax’s network to computers outside the United States. In total, the attackers ran approximately 9,000 queries on Equifax’s system, obtaining names, birth dates, and social security numbers for nearly half of all-American citizens.”
“The defendants took steps to evade detection throughout the intrusion, as alleged in the indictment. They routed traffic through approximately 34 servers located in nearly 20 countries to obfuscate their true location, used encrypted communication channels within Equifax’s network to blend in with normal network activity, and deleted compressed files and wiped log files on a daily basis in an effort to eliminate records of their activity.”
Due to the breach, Equifax was fined £500,000 by the U.K.’s privacy watchdog for not being able to take suitable steps to shield its customers and also decided to pay up to $700 million in fines to settle a string of state and federal investigations in the United States.
The DoJ officials said the FBI began this inquiry two years ago with only 40 IP addresses that were involved in the attacks.
All four indicted accused are still at large and have been added to the FBI’s Most Wanted Cyber list.
