Chinese hackers charged with stealing information on half of U.S. citizens

In a single stroke, according to the federal indictment, the People's Liberation Army obtained sensitive data on nearly half of U.S. citizens. This was not street ransomware. It was an identity harvest at census scale.

The breach opened in 2017 against Equifax, one of the three big credit bureaus. The operators — later named as Wu Zhiyong, Wang Qian, Xu Ke, and Liu Lei, members of the PLA — moved through the network for weeks. They collected names, birth dates, and Social Security numbers for about 145 million people, driver's license numbers for at least ten million, and card data for about 200,000 consumers. Nearly a million people in the United Kingdom and Canada were in the file too.

On February 10, 2020, the Department of Justice and the FBI filed the charges: computer fraud, economic espionage, and wire fraud. Attorney General William Barr placed the case on a longer line: the Office of Personnel Management, Marriott, Anthem. The pattern, Washington said, was the same — biographical files on Americans, kept for long-range intelligence.

Equifax was slow to speak. The technical hole — a known Apache Struts flaw, unpatched — became as political as it was forensic. Congress asked questions. The corporate cost passed a billion dollars. The people affected got credit monitoring. The accused, as usual in these files, stayed out of reach.

The figure — half the country — is not a press metaphor. It is in the indictment: “sensitive personally identifiable information for nearly half of all American citizens.” A national file, copied.