Chinese hackers have repeatedly penetrated the New York Times’ computer systems over the past four months, stealing reporters’ passwords and hunting for files on an investigation into the huge wealth amassed by the family of premier Wen Jiabao.
Security experts hired to investigate and plug the breach found that the attacks used tactics similar to ones used in previous hacking incidents traced to China, the newspaper said yesterday.
It said the hackers routed the attacks through computers at US universities, installed a strain of malicious software, or “malware”, associated with Chinese hackers and initiated the attacks from Chinese university computers previously used by the Chinese military to attack US military contractors.
The attacks, which began in mid-September, coincided with a New York Times investigation into how the relatives of Mr Wen built a fortune worth more than $2 billion (£1.3bn).
The report, which was published on 25 October, embarrassed Communist Party chiefs, ahead of a fraught transition to new leaders and exposing deep-seated nepotism at a time when many Chinese are upset about a wealth gap.
Over the months of cyber incursions, the hackers eventually found the computer passwords of all New York Times employees and used them to get into the personal computers of 53 employees.
The report said none of the paper’s customer data was compromised and information about the investigation into the Wen family remained protected, though it left unclear what data or communications the infiltrators accessed.
“Computer security experts found no evidence that sensitive e-mails or files from the reporting of our articles about the Wen family were accessed, downloaded or copied,” executive editor Jill Abramson said.
The Chinese foreign and defence ministries called the allegations baseless, and the defence ministry denied any involvement by the military.
“Chinese law forbids hacking and any other actions that damage internet security,” the defence ministry said in a statement.
“The Chinese military has never supported any hacking activities. Cyber attacks are characterised by being cross-national and anonymous. To accuse the Chinese military of launching cyber attacks without firm evidence is not professional and also groundless.”
China has been accused by the US, other foreign governments and computer security experts of mounting a widespread, aggressive cyber spying campaign for several years, trying to steal classified information and corporate secrets and to intimidate critics.
Foreign reporters and news media have been among the targets of attacks intended to uncover the identities of sources for news stories and to stifle critical reports about the Chinese government.
“Attacks on journalists based in China are increasingly aggressive, disruptive and sophisticated,” said Greg Walton, a cyber security researcher who has tracked Chinese hacking campaigns.
“China’s cyber spying efforts have excelled in part because of the government’s willingness to ignore international norms relating to civil society and media organisations,” he added.
The New York Times reported that executives became concerned just before the publication of the Wen investigation after learning that Chinese officials had warned of unspecified consequences.