DoJ Corrects China Hacking Claim, U.S. Agencies Were Targeted

The U.S. Department of Justice (DoJ) issued a correction on Friday, clarifying that several of its agencies were among those targeted by Chinese threat actors, rather than being victims of the attacks. This revision follows an initial press statement released last week which incorrectly asserted that agencies such as the National Aeronautics and Space Administration (NASA), the Federal Reserve, the Department of Energy, and the Department of Justice itself had been victimized. The DoJ's updated statement specifies that these entities were identified as targets within a broader cyber campaign attributed to China.

The initial announcement, made on March 20, 2024, had detailed a coordinated effort by the People's Republic of China to conduct widespread malicious cyber activity. This activity was described as targeting critical infrastructure, including government agencies and private sector organizations. The DoJ's initial statement had indicated that the Chinese Ministry of State Security (MSS) had engaged hackers to conduct these operations. The correction specifically addresses the language used to describe the impact on U.S. agencies, shifting from "victims" to "targets."

This correction is significant as it refines the understanding of the scope and impact of the alleged Chinese cyber operations. While the fact that U.S. agencies were targeted remains, the distinction between being a target and a victim implies a difference in the success or extent of the intrusion. The DoJ's initial statement had also mentioned that the MSS had allegedly used "malicious cyber actors" to conduct these operations, aiming to steal sensitive information and conduct espionage. The revised statement, however, focuses on the targeting aspect without explicitly detailing the success of any breaches against the named agencies.

The DoJ's correction underscores the complexities involved in attributing and describing cyber incidents, particularly those involving state-sponsored actors. The initial announcement had also highlighted the prosecution of four Chinese nationals by the DoJ for their alleged roles in these hacking campaigns. These individuals were charged with conspiracy to commit computer intrusion and wire fraud. The cyber activities in question were reportedly ongoing for years, with the MSS allegedly directing and compensating these hackers. The correction does not alter the charges or the individuals implicated but refines the description of the impact on the U.S. government entities.