Hackers linked to Chinese government STOLE at least $20 million in Covid relief benefits - including small business grants and unemployment benefits - from at least a dozen states

  • A hacking group called APT41 stole at least $20 million in Covid relief benefits from a dozen states, the Secret Service revealed 
  • The fraud began in mid-2020 and continued for a year; it involved 2,000 accounts and more than 40,000 financial transactions
  • A Justice Department official told NBC News it was 'dangerous' and the Secret Service said there are more than 1,000 ongoing investigations of similar fraud
  • It's unclear whether the Chinese government specifically directed the hacks or just allowed them to take place without interfering

By Christopher Carbone U.S. Science And Technology Editor For Dailymail.Com

Published: | Updated:

Hackers linked to China's government stole at least $20 million in U.S. Covid relief benefits, including small business loans and unemployment funds, across over a dozen states. 

The cyber crime was the work of a hacking group called APT41 based in Chengdu, according to the Secret Service.

Those officials and experts told the outlet that other federal probes of pandemic fraud also seem to point back to foreign-state hackers. It wouldn't be the first time that hackers linked to China's government have caused security headaches in other countries. 

The fraud linked to APT41 being in mid-2020 and spanned 2,000 accounts with more than 40,000 financial transactions - and the agency has been able to recover about half of the stolen funds, according to NBC News. Officials could not confirm whether the hackers still had access to state government networks after being discovered. 

Hackers linked to China's government stole at least $20 million in U.S. Covid relief benefits, including small business loans and unemployment funds, across over a dozen states

Hackers linked to China's government stole at least $20 million in U.S. Covid relief benefits, including small business loans and unemployment funds, across over a dozen states

Although it's unclear whether the Chinese government specifically directed the hacks or just allowed them to take place, American security officials the theft is a serious development with national security implications.

'It would be crazy to think this group didn’t target all 50 states,' Roy Dotson, national pandemic fraud recovery coordinator for the Secret Service, who also acts as a liaison to other federal agencies probing Covid fraud, told NBC News. 

One high-level Justice Department official told NBC News it was 'dangerous' and the Secret Service said there are more than 1,000 ongoing investigations that involve criminals defrauding public benefits programs.

'Once you are in these systems with intent to promulgate theft' of personally identifying information,' William Evanina, the former director of the National Counterintelligence and Security Center, part of the Office of the Director of National Intelligence, said, 'you’re in forever,' noting that there are many different systems sharing interconnected domain names at the state or local level. 

'Unless,' he added, 'you tear down the systems and replace everything.' 

A Heritage Foundation analysis estimated that there were excess unemployment benefits totaling $350 billion between April 2020 and May 2021. 

'My analysis of the Department of Labor’s data shows that UI programs sent out 1.365 billion weekly benefit checks between April 2020 and May 2021 when covering 100% of all unemployed workers—an optimistic goal of the UI expansions—would have required only 807 million benefit checks,' Rachel Greszler, a Heritage Foundation research fellow, told the Senate during her testimony last year. 

'So that’s an excess of 557 million UI checks and $357 billion of taxpayers’ money sent to people—likely criminals—who weren’t unemployed.' 

The cyber crime was the work of a hacking group called APT41 based in Chengdu, according to the Secret Service

The cyber crime was the work of a hacking group called APT41 based in Chengdu, according to the Secret Service

Unfortunately, by the time the Covid relief funds were being disbursed, APT41 had become a prominent part of cyberespionage operations benefiting the Chinese government, experts said.

ATP41 is also known to cyber security groups by the names Wicked Panda, Barium and Winnti. 

'By putting an unprecedentedly high dollar value on unemployment insurance benefits, making them available for three times as long as usual, widening eligibility, and reducing verification requirements, unemployment insurance benefits were not only abused by some individuals, but they became a high value, easily accessible target for criminals,' Greszler said.

U.S. officials warned at the pandemic's beginning that hackers would use various phishing schemes to gather personal and financial data from unsuspecting victims.

HOW TO CHECK IF YOUR EMAIL ADDRESS IS COMPROMISED

Have I Been Pwned?

Cybersecurity expert and Microsoft regional director Tory Hunt runs 'Have I Been Pwned'.

The website lets you check whether your email has been compromised as part of any of the data breaches that have happened. 

If your email address pops up you should change your password.

Pwned Passwords

To check if your password may have been exposed in a previous data breach, go to the site's homepage and enter your email address.

The search tool will check it against the details of historical data breaches that made this information publicly visible. 

If your password does pop up, you're likely at a greater risk of being exposed to hack attacks, fraud and other cybercrimes.

Mr Hunt built the site to help people check whether or not the password they'd like to use was on a list of known breached passwords. 

The site does not store your password next to any personally identifiable data and every password is encrypted

Other Safety Tips

Hunt provides three easy-to-follow steps for better online security. First, he recommends using a password manager, such as 1Password, to create and save unique passwords for each service you use. 

Next, enable two-factor authentication. Lastly, keep abreast of any breaches

ChinaCrime

Most watched News videos