Justice Department revises Chinese hacking claims, calls agencies targets, not victims

The Justice Department revised its statements on a Chinese state-sponsored hacking operation to clarify that listed agencies were targets, not confirmed victims. The department edited an August 26 press release after it described NASA, the Federal Reserve, the U.S. Senate, the Department of Energy, the Department of Justice, the Department of Health and Human Services, and the National Institutes of Health as victims. The updated statement calls the agencies among the targets of QTFY, a People's Republic of China state-sponsored group. The department said the edits were intended to reflect allegations in an affidavit supporting domain seizures. The affidavit shows that only some entities were compromised. Confirmed intrusions occurred in September 2024 at three Department of Energy national laboratories. Confirmed intrusions also occurred at the National Institutes of Health, a Health and Human Services agency, and a U.S. security device manufacturer. An attempted NASA breach was unsuccessful because NASA had patched the targeted software. The change reduces the number of confirmed breaches attributed to the years-long Chinese cyber-espionage effort against U.S. critical infrastructure and sensitive networks.