The Chinese Hacker Network: What You Need to Know

Leaked documents posted online last week show how the Chinese government is working with private hackers to obtain sensitive information from foreign governments and companies.

The hackers worked for a security company called I-Soon, part of a network of hired spies working closely with Beijing.

The leak showed how China’s top regulatory body, the Ministry of Public Security, has increasingly recruited contractors to attack government targets and private companies as part of a cyberespionage campaign in Asia. The leak is likely to stoke fear among leaders in Washington who have warned of such attacks in the United States.

What information was revealed?

I-Soon targeted telecommunications companies, online gambling companies and local governments across Asia. The hackers were able to obtain private information, including:

• data from a Vietnamese airline, with the identity of travelers.

• personal information from accounts on platforms such as Telegram and Facebook.

• access to the private website of the traffic police in Vietnam.

• software that helped carry out disinformation campaigns and hack accounts on X.

The leak also included internal discussions at I-Soon, reflecting a tight workplace and the company’s efforts to market its services to the government. I-Soon is one of hundreds of private companies supporting China’s hacking efforts by selling spy services and stolen data.

How was the information sold?

I-Soon, a private security contractor, charged the Chinese government as little as $15,000 for access to the private website of Vietnam’s traffic police and as much as $278,000 for access to personal information from social media sites. China has a long history of suppressing dissent among its citizens through surveillance.

The leaks were posted publicly on GitHub, a software platform where programmers share code. Vital information has been leaked on the forum before, including X’s source code.

Cybersecurity experts interviewed by The New York Times said the documents appeared authentic. It is not clear who leaked the information and what their motives were.

What does this mean for the United States?

The leaked material does not involve US entities, but offers a rare insight into how China’s Ministry of State Security relies on private companies to carry out its espionage activities.

U.S. officials have long accused China of large-scale breaches of U.S. companies and government agencies. The warnings have grown louder as tech companies rush to develop artificial intelligence. The increased scrutiny has led Silicon Valley venture capitalists to withdraw their investments in Chinese startups.

In 2013, it was revealed that a Chinese military unit was behind hacks of several American companies. In 2015, a data breach apparently carried out by Chinese hackers obtained a trove of data from the US Office of Personnel Management, including personal information of millions of government employees.

Last weekend in Munich, FBI Director Christopher Wray said hacking operations from China were targeting the United States on a “larger scale than we had previously seen,” ranking it as one of the top threats to America’s national security.

What are the consequences for China?

Despite the embarrassment that leaking hacked documents could bring, few experts expect China to stop its hacking given the information it can provide.

“I wouldn’t expect such activities to stop as a result, just more efforts to prevent future leaks,” said Mareike Ohlberg, a specialist in Indo-Pacific relations at the German Marshall Fund of the United States.

David E. Sanger And Keith Bradsher reporting contributed.