China has hacked into American power grids and companies for decades, stealing sensitive files and intellectual property such as chip designs as it seeks to gain an edge over the United States.
But a sweeping cyberattack by a group known as Salt Typhoon is China’s most ambitious yet, experts and officials have concluded after a year of investigating it. It targeted more than 80 countries and may have stolen information from nearly every American, officials said. They see it as evidence that China’s capabilities rival those of the United States and its allies.
The Salt Typhoon attack was a yearslong, coordinated assault that infiltrated major telecommunications companies and others, investigators said in a highly unusual joint statement last week. The range of the attack was far greater than originally understood, and security officials warned that the stolen data could allow Chinese intelligence services to exploit global communication networks to track targets including politicians, spies and activists.
Hackers sponsored by the Chinese government “are targeting networks globally, including, but not limited to, telecommunications, government, transportation, lodging, and military infrastructure networks,” the statement said.
British and American officials have described the attack as “unrestrained” and “indiscriminate.” Canada, Finland, Germany, Italy, Japan and Spain were also signatories to the statement, which was part of a name-and-shame effort directed at the Chinese government.
“I can’t imagine any American was spared given the breadth of the campaign,” said Cynthia Kaiser, a former top official in the F.B.I.’s cyber division, who oversaw investigations into the hacking.
It was unclear whether the Salt Typhoon hack was intended to store ordinary people’s data or if that data was incidentally swept up in the attack. But its scope was broader than previous hacks, in which China more narrowly targeted Westerners working on security or other sensitive government issues, Ms. Kaiser said.
The Salt Typhoon hack could signal a new era of Chinese cyber capabilities that will test its strategic rivals, including the United States, security experts said. It highlights China’s ambitions for global influence, which were on display on Wednesday at an elaborate military parade in Beijing that featured fighter jets, tanks and thousands of troops marching across Tiananmen Square.
“In many ways, Salt Typhoon marks a new chapter,” said Jennifer Ewbank, the former C.I.A. deputy director for digital innovation. A decade ago, she noted, Western allies worried about China’s thefts of trade secrets, personal information and government data, which used more rudimentary techniques.
“Today, we see patient, state-backed campaigns burrowed deep into the infrastructure of more than 80 countries, characterized by a high level of technical sophistication, patience and persistence,” she added.
The Chinese Embassy in London did not respond to a message seeking comment.
The statement from Western allies gave the fullest accounting yet of what the F.B.I. has called China’s “cyberespionage campaign.”
Investigators linked the Salt Typhoon attack to at least three China-based technology companies that have been operating since at least 2019, but the operation was uncovered only last year. The joint statement said the companies worked for China’s military and civilian intelligence agencies, which carry out foreign operations.
The hackers’ goal was to give Chinese officials the “capability to identify and track their targets’ communications and movements around the world,” the statement said. Among the targets were phones used by prominent politicians, including President Trump and Vice President JD Vance, during their campaign last year. The effort also took aim at Democrats.
The attackers stole data from telecommunications and internet service companies, penetrating more than a half dozen U.S. telecommunications companies alone. The hackers exploited old vulnerabilities in the networks, the British authorities said. They also hacked into lodging and transportation companies, among other targets.
The hackers were able to listen in on telephone conversations and read unencrypted text messages, Senator Mark Warner of Virginia, the top Democrat on the Senate Intelligence Committee, has said.
The attack built on China’s earlier hacks, said Jamie MacColl, a senior research fellow in cybersecurity at Royal United Services Institute, an analytical group affiliated with the British military. For years, China has collected large data sets, Mr. MacColl said, intending to one day exploit that information.
“If you’re a cyber power, then it makes sense you would want to compromise the global communications network,” he said.
Chinese operators previously targeted American companies such as Marriott International, health insurers and the U.S. Office of Personnel Management, which keeps government security clearance files. In 2021, the Biden administration accused the Chinese government of breaching widely used Microsoft email systems.
Russian state-sponsored hackers have also carried out successful breaches. The U.S. and British governments and their closest allies also have vast spying capabilities. It is not clear how Western countries responded to Salt Typhoon.
The operation was “more than a one-off intelligence success for China,” Anne Neuberger, a Biden administration cybersecurity official, wrote recently in Foreign Affairs magazine.
“It reflected a deeper, troubling reality,” she wrote, adding, “China is positioning itself to dominate the digital battle space.”
Adam Goldman writes about the F.B.I. and national security for The Times. He has been a journalist for more than two decades.
The post ‘Unrestrained’ Chinese Cyberattack May Have Stolen Data From Almost Every American appeared first on New York Times.
