US revises statements, clarifying Chinese hackers targeted but did not breach agencies

US officials have revised earlier statements, clarifying that Chinese state-sponsored hackers targeted several government agencies but did not successfully breach them.

The US Department of Justice issued a revised statement on Friday, identifying the US Senate, the Federal Reserve, NASA, and other agencies as "among the targets of QTFY," a Chinese state-sponsored hacking group. This correction distinguishes from a previous version that stated these agencies were among the hackers' victims.

A note appended to the revised statement explained that edits were made to "accurately reflect the government’s allegations in the affidavit in support of the domain seizures." The Justice Department further elaborated that the initial August 26 release "described all agencies as victims whereas the government’s affidavit made clear that all were targeted but only some were compromised."

This clarification is crucial as it narrows the scope of confirmed breaches. The Justice Department has accused Chinese actors of a lengthy cyber-espionage campaign targeting US government agencies, defense contractors, and other sensitive entities. An FBI affidavit revealed that hackers had targeted US federal networks since at least 2018, with NASA, the Federal Reserve, and the US Senate among those listed as targets. The affidavit noted that an attempted breach of NASA was unsuccessful due to the agency patching targeted software.

However, the affidavit also alleged that in September 2024, hackers carried out "computer intrusions" at three "DOE National Laboratories, NIH, an HHS agency, and a US security device manufacturer," referring to these entities as "victims." A separate advisory from the FBI, NSA, and Cyber Command noted successful data thefts from unnamed defense contractors, financial institutions, and universities in May 2024, alongside unsuccessful attempts to access networks for the US Senate and a hospital in March 2026.