Chinese military linked to 2017 Equifax breach

Four members of the Chinese military are facing charges for allegedly breaking into Equifax Inc. systems in 2017 and stealing data connected with Canadians, the U.S. Department of Justice revealed Monday.

An indictment filed by the department says the breach of the Atlanta-based credit monitoring company’s system compromised a “colossal repository of sensitive personally identifiable information.”

The breach affected the accounts of at least19,000 Canadians, hundreds of thousands of Britons and 145 million Americans. The hacked information included names, addresses, social insurance and credit card numbers, usernames, passwords and secret question and answer data.

The four Beijing residents that the indictment alleges were involved in the hacking are facing charges of computer fraud, economic espionage and conspiracy to commit wire fraud.

The indictment says that over several weeks the group used a software vulnerability and encrypted communication channels to carry out the breach. They allegedly made use of 34 servers located in nearly 20 countries and wiped log files on a daily basis to reduce the likelihood that they would be caught.

Equifax, the documents said, did not notice the hackers’ activity for more than six weeks. The document also accuses the men of stealing trade secrets from the company.

Equifax reached a $700-million (U.S.) settlement last year with the U.S. government over the data breach, earmarking most of the funds for consumers impacted by the incident.