U.S. Issues $10 Million Bounty for Chinese National Linked to Hafnium Cyberattacks

The U.S. Department of State has issued a $10 million reward for information leading to the apprehension of Zhang Yu, a Chinese national accused of orchestrating the Hafnium hacking campaign. Zhang, currently the director of Shanghai Firetech Information Science and Technology, is alleged to have conducted state-sponsored cyber intrusions targeting U.S. universities, law firms, and research institutions.

Indictments allege that Zhang and co-conspirator Xu Zewei operated under the direction of the Chinese Ministry of State Security and the Shanghai State Security Bureau. The campaign, active between 2020 and 2021, reportedly compromised over 12,700 U.S. entities to facilitate the theft of sensitive data, including COVID-19 research.

While Zhang remains at large, Xu Zewei was arrested in Italy in 2025 and subsequently extradited to the United States. This bounty underscores ongoing U.S. efforts to hold foreign nationals accountable for state-sanctioned intellectual property theft and large-scale computer fraud. The case highlights persistent risks to institutional data security posed by state-aligned cyber actors.