DOJ: Chinese spies carried out an elaborate, global hacking attack for over a decade

The Justice Department charged two Chinese nationals allegedly linked to the Ministry of State Security in connection with hacking attacks on government agencies including NASA, the Navy, and dozens of tech companies, and went on for more than a decade.

The pair, Zhu Hua and Zhang Shilong, were allegedly part of a hacking group–called APT 10 by Western security firms–and are said to have stolen intellectual property from companies in a variety of high-tech industries, including telecom, biotech, and aviation, since at least 2006.

“The indictment alleges that the defendants were part of a group that hacked computers in at least a dozen countries and gave China’s intelligence service access to sensitive business information,” said Deputy Attorney General Rod Rosenstein in a statement. “This is outright cheating and theft, and it gives China an unfair advantage at the expense of law-abiding businesses and countries that follow the international rules in return for the privilege of participating in the global economic system.”

The charges unsealed on Thursday were released in coordination with allies around the world. The United Kingdom said it was the first time it has accused the Chinese government in a hacking campaign, and Australia also expressed “serious concern” about the group.

The hackers are said to have targeted “managed service providers,” IT companies that serve a wide range of industries, in order to steal data from their clients. They allegedly infected these companies’ computers with malware and stole administrative logins in order to siphon out customer data. They’re also said to have stolen sensitive data including names, Social Security numbers, and contact information for more than 100,000 Navy personnel, as well as data from the NASA Goddard Space Center, the Jet Propulsion Laboratory, and the Lawrence Berkeley National Laboratory.

The pair could in theory face decades in prison, although foreign hacking suspects are essentially never extradited to the United States. However, the charges come amid trade tensions between the United States and China, and the hacking is said to have violated a 2015 pledge by China to stop breaking into foreign computers to steal intellectual property.