United States Admits Error in Claiming Extensive Chinese Cyberattack Victims, Facts Differ
The United States government has suddenly corrected its statements regarding cyberattacks allegedly carried out by Chinese hackers. Several US government agencies previously identified as “victims” of the hacking have now been reclassified as merely “targets” of the hacking group.
The US Department of Justice (DOJ) on Friday (28/8) amended its previous statement concerning the hacking group QTFY, which is suspected of being sponsored by the Chinese government. In the statement, the DOJ noted that the US Senate, the Federal Reserve, NASA, and several other agencies were among the targets of QTFY. The group was identified by US officials on Wednesday during an internet domain seizure operation.
The DOJ’s initial statement had referred to these government agencies as victims of attacks by the Chinese hacking group. The DOJ subsequently added a note to the updated statement.
“A change has been made to ensure this press release accurately reflects the government’s allegations in the written statement supporting the domain seizure,” the DOJ wrote, as reported by Reuters on Monday (31/8/2026).
The DOJ also explained the reason for the change. The Department stated that the release on 26 August depicted all agencies as victims, whereas the government’s written statement explains that while all were targeted, only some were successfully compromised.
This distinction in terminology is significant. The correction narrows the scope of hacking confirmed by the US government in a Chinese cyber-espionage campaign that has reportedly been ongoing for years. The campaign is said to target US government networks, defence contractors, and other sensitive targets.
According to a written statement from the FBI released alongside the US government’s initial announcement, the hacking group has been targeting US federal networks since at least 2018. These include the networks of NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services (HHS), the National Institutes of Health (NIH), and the US Senate. However, not all attempts were successful.
A footnote in the FBI’s written statement mentioned that the agency had investigated hacking attempts against NASA. The results showed that the attacks failed because NASA had patched the targeted software.
On the other hand, the FBI accused the hackers of successfully infiltrating computers in September 2024 at three national laboratories under the US Department of Energy, the NIH, one HHS agency, and a US security equipment manufacturer. The FBI identified these entities as victims.
The US government also released a joint cybersecurity advisory published by the FBI, the National Security Agency (NSA), and the U.S. Cyber Command’s Cyber National Mission Force on Wednesday. The document noted successful data theft from several unnamed defence contractors, financial institutions, and universities in May 2024.
At the same time, the hacking group was also recorded making failed attempts to access the US Senate network and a US hospital in March 2026.
Reuters noted that the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) did not immediately respond to requests for clarification regarding the change in statement.