Who’s responsible?

The list of offenders includes statesponsored hackers, criminal gangs, and “hacktivist” groups, with the lines often blurring between them. The Chinese have recruited a “hacker army” estimated at between 50,000 and 100,000 strong, including special military units, that is dedicated in part to seizing valuable data from U.S. companies and government agencies. The Russian military has focused heavily on recruiting hackers wherever it can find them, including from university programs, software companies, and even the criminal underworld. To maintain plausible deniability, the Russian government sponsors hacker collectives such as “Fancy Bear” and “Cozy Bear,” which pulled off successful spear-phishing attacks against the Democratic National Committee in 2016. Experts say that the Equifax hack appears similar to recent state-sponsored attacks on the insurance company Anthem and the U.S. Office of Personnel Management, with the hackers using tools favored by Chinese intelligence. But it’s also getting easier for non-state actors to pull off major attacks. Sophisticated hacking tools can be bought on the dark web for as little as $100. “It’s increasingly easy for anybody to wield the kind of capability that used to be reserved for nation-states, or required nation-state level of expertise and investment,” says Nate Fick, CEO of cybersecurity firm Endgame.