How China’s hackers may have stolen data from almost every American, even Trump

Americans beware. There’s a huge possibility that almost every American’s data is in the hands of a Chinese-based hacker group, as it seeks to gain an edge over the United States.

According to US officials, even data belonging to US President Donald Trump and Vice President JD Vance may have been stolen by this Chinese hacker group, with investigators saying the cyberattack goes much deeper than they initially predicted, and has been a result of a years-long coordinated effort.

But who’s behind it? How bad has the cyberattack been? Who all have been affected? We get you all the answers you may be looking for.

More from Explainers

Trump says Xi put up military show hoping ‘I was watching’; China replies ‘confirmed’ he watched ‘Never intimidated by any bullies’: Putin and Kim on dias, Xi sends message to Trump with military show

What cyberattack?

Last December, multiple news agencies reported that Chinese-based hackers, known as Salt Typhoon, had breached American telecommunications companies and stolen data about US calls.

According to a Reuters report, the complex cyberattack began in 2022 with Reuters reporting that a large number of Americans’ metadata had been stolen in the sweeping cyber espionage campaign, adding dozens of companies across the world had been hit by the hackers, including ‘at least’ eight telecommunications and telecom infrastructure firms in the United States.

At the time, chairman of the Senate Intelligence Committee, Senator Mark Warner called it the “worst telecom hack in our nation’s history” and noted that it makes prior cyberattacks by Russian operatives look like “child’s play” by comparison.

Editor’s Picks

1

Phantom crash: How Chinese hackers covertly targeted smartphones of US officials and journalists 2

Did China-linked hackers access US nuclear secrets through Microsoft?

How dangerous was the hack?

In short, the hack has been extremely dangerous and now puts information of almost every American at peril.

After months of investigations, the authorities from the US, the UK, Germany, Italy, Finland and Spain as well as others found that the cyber criminals “targeted networks globally, including, but not limited to, telecommunications, government, transportation, lodging, and military infrastructure networks.”

British and American officials, as per the New York Times, have described the attack as “unrestrained” and “indiscriminate” with Cynthia Kaiser, a former top official in the FBI’s cyber division, who oversaw investigations into the hacking, being quoted as telling the American news outlet, “I can’t imagine any American was spared given the breadth of the campaign.”

The investigators have noted that the hack was intended to provide the Chinese with the “capability to identify and track their targets’ communications and movements around the world.”

Among the many targets of this complex cyberattack was none other President Trump and Vice President JD Vance, during their campaign last year.

The British authorities investigation this breach added that the attackers stole data from telecom and internet service companies, breaching over a half dozen in the US alone, exploiting old vulnerabilities in the networks. They further added that Beijing was able to listen to phone calls, read text messages, and access locally stored files on the devices of those who were targeted.

And it’s not just America that has been targeted in this cyber breach. According to the US and its allies, the cyber campaign undermined at least 80 countries.

Speaking on the cyberattack, one senior intelligence official involved in the investigation was quoted as telling Forbes, “This is not just a cyber intrusion. This is the weaponisation of our communications infrastructure.”

Even Brett Leatherman, the FBI’s top cyber official echoed similar remarks. He was quoted as saying, “This is one of the more consequential cyber espionage breaches we have seen here in the United States.”

In fact, the US and international agencies declared the threat posed by Salt Typhoon hackers as a national defence crisis, impacting core infrastructure that carries global web traffic.

What makes this cyberattack even more notable is that three private Chinese companies assisted in this complex operation. According to the report published by the US and its allies, the three companies are Beijing Huanyu Tianqiong Information Technology, Sichuan Zhixin Ruijie Network Technology and Sichuan Juxinhe Network Technology.

While the Treasury Department sanctioned the Sichuan-based Sichuan Juxinhe Network Technology over Salt Typhoon activity in January, the other two had not been named so far.

But who was behind this cyberattack?

According to the investigators, the hack is the work of Chinese-based group Salt Typhoon. It also goes by other names such as Ghost Emperor or FamousSparrow.

According to the New York Times, the name Salt Typhoon is based on Microsoft’s practice of naming hacking groups after types of weather — “typhoon” for hackers based in China, “sandstorm” for efforts by Iran and “blizzard” for operations mounted by Russia. A second term, in this case “salt,” is used to denote the type of hacking. Experts say Salt Typhoon seems to be focused primarily on counterintelligence targets, unlike other hacking groups that may try to steal corporate data, money or other secrets.

Officials note that there is sufficient evidence that Salt Typhoon is allegedly backed by China’s Ministry of State Security (MSS).

Notably, the group has likely existed for some time and carried out multiple breaches in the past.

Experts also note that this breach by Salt Typhoon ushers in a new era of Chinese cyber capabilities. It highlights China’s ambitions for global influence. “In many ways, Salt Typhoon marks a new chapter,” Jennifer Ewbank, the former CIA. deputy director for digital innovation, told the New York Times. A decade ago, she noted, Western allies worried about China’s thefts of trade secrets, personal information and government data, which used more rudimentary techniques. “Today, we see patient, state-backed campaigns burrowed deep into the infrastructure of more than 80 countries, characterised by a high level of technical sophistication, patience and persistence,” she added.

With inputs from agencies