USA indicts the Chinese hacker who breached Anthem’s website

A 36-year old Chinese national from Shanghai has been indicted by a federal court in California for transmitting malicious software tools to companies located in the United States.

Yu Pingan was arrested on August 27, 2017 when he arrived in the United States to attend a conference.  Pingan used the online pseudonym GoldSun to install malware and viruses on company computers.  In addition, the United States government has alleged that GoldSun delivered zero-day exploits and caused denial of service (DOS) attacks on major corporate and government computer networks.  GoldSun’s computer code makes networks and websites vulnerable to being controlled and taken over remotely and susceptible to being hacked. The government charged GoldSun with one count of violating the Computer Fraud and Abuse Act and conspiracy to defraud the United States.  The United States government claims that Pingan has caused far-reaching damage to the nation’s security infrastructure and economy.

 Among GoldSun’s technical “accomplishments” was the successful data breach of Anthem’s healthcare network and release of personal health information (PHI) about 80 million of its customers in 2015. The released data included  home addresses, dates of birth, Social Security numbers, email addresses and  income data belonging to both current and former customers and employees, including Anthem’s chief executive.

In addition to the Anthem attack, in 2015 GoldSun broke into United States government computer systems in the Office of Personnel Management (OPM) and improperly obtained sensitive personal information including background checks and  financial information involving about 4 million government workers dating back for 30 years.

In support of the government’s request to arrest and indict GoldSun, FBI Special Agent Adam James told the federal court judge that:

“Based on the evidence described above showing that [Pingan] provided malware … to maliciously target a discrete group of U.S. companies’ computer networks, including the novel and rarely-used Sakula malware, I submit there is probable cause to arrest YU for conspiring to commit fraud in connection with computers, in violation of 18 U.S.C. §§ 371 and 1030(a)(5)(A).”

Is the People’s Republic of China the driving force behind GoldSun’s attacks on the American economy and government, or did GoldSun act purely for his own economic gain? In either case, American citizens have been harmed by these and other assaults on our way of life. It is essential for all of us to deploy best practices to secure our personal and corporate information.  Cyber liability insurance and good legal and IT advice are good ways to begin.