It's been more than two and a half years since Equifax (EFX 0.46%) suffered one of the biggest data breaches in history. Yet while investors were quick early on to focus on Equifax's responsibility for the breach, the U.S. Department of Justice just opened a brand new chapter in the story of the breach, its causes, and its consequences.
What the DoJ says happened
The Justice Department announced Monday that an Atlanta-based federal grand jury returned indictments against four Chinese military personnel last week. The indictments charged the four members of the People's Liberation Army with hacking into Equifax's computer systems and stealing both trade secrets and personal data from about 145 million Americans.
Image source: Getty Images.
According to the DoJ statement announcing the move , the four individuals charged were all members of a military unit called the 54th Research Institute. Among the allegations made in the indictment, these military personnel conspired to hack into systems by exploiting a vulnerability in a piece of software that Equifax used to receive online disputes from customers. They then expanded their access to other parts of Equifax's network infrastructure, running weeks' worth of database queries to understand the way the company structured its data. The military members then accumulated stolen information, stored it temporarily, and eventually downloaded it beyond U.S. borders. As a result of its efforts to break Equifax's database structure, the thieves also took key trade secrets from the company.
Attorney General William Barr didn't pull any punches in his assessment of the nature of the Chinese military move. "This was a deliberate and sweeping intrusion into the private information of the American people," Barr said, arguing that the attack "fits a disturbing and unacceptable pattern of state-sponsored computer intrusions and thefts by China and its citizens."
Will U.S.-China relations cool again?
The news comes as an abrupt about-face in what had appeared to be warming relations between the U.S. and China. With a phase 1 trade deal in the books and further efforts to reduce some of the tariffs that China had imposed, many investors were starting to conclude that they wouldn't have to pay much attention to that part of the geopolitical picture much longer.
Even so, there's reason to be optimistic. There's nothing particularly new about the U.S. accusing Chinese operatives of trying to steal intellectual property and data with the help of the Chinese central government. The Attorney General did do his best to emphasize the limits to the U.S. government's patience. "We remind the Chinese government," Barr said, "that we have the capability to remove the Internet's cloak of anonymity and find the hackers [China] repeatedly deploys against us."
Stock markets certainly didn't seem to be worried about the move, as most major market benchmarks were solidly higher on Monday following the announcement. Equifax shares were down almost 1%, as CEO Mark Begor took the opportunity to go over all the improvements that the credit reporting bureau has made to its systems to defend against future attacks like this. Yet even with vigorous enforcement action by the Department of Justice, it's likely that there'll be still more attacks on personal data in the future -- and some of them might come from the nation with the world's second-largest economy.
