U.S. federal prosecutors charged three Chinese nationals with hacking the networks of U.S.-based international law firms and using information from those firms to conduct insider trading, making more than $4 million from the scheme, according to a statement by the U.S. Attorney’s Office.
The three men targeted at least seven firms which advised companies involved in acquiring, or being acquired by, other companies, according to a statement released by Preet Bharara, the U.S. Attorney for the Southern District of New York.
After successfully compromising two law firms, the group then allegedly bought shares in companies that were about to be acquired or which planned to acquire the other firms. They then sold the shares after the M&A deals were announced.
“This case of cyber meets securities fraud should serve as a wake-up call for law firms around the world: you are and will be targets of cyber hacking, because you have information valuable to would-be criminals,” he said in the statement.
The FBI and the U.S. Attorney’s office worked with the Securities and Exchange Commission, the Office of International Affairs and Hong Kong law enforcement to investigate the group. One of the accused, Iat Hong, a resident of Macau, was arrested by local authorities on Dec. 25 and is awaiting extradition proceedings.
The attacks, which occurred in 2014 and 2015, targeted the email accounts and data of law-firm partners, aiming to gain sensitive information about the acquisitions.
In one case, the group allegedly compromised a law firm that was advising a company contemplating purchasing Intermune, a U.S.-based drug maker. After stealing 40 gigabytes of data from the law firm, the three men began purchasing Intermune shares. After the company announced it would be purchased by Roche AG on Aug. 25, 2014, the men sold the 18,000 shares for a profit of $380,000, according to the U.S. Attorney’s statement.
In a similar attack, the men also allegedly learned of Intel’s intent to acquire Altera, making a profit of $1.4 million on the resulting stock transaction. The trio also made $841,000 after learning that Pitney Bowes intended to buy BorderFree, an e-commerce company.
The attackers took similar measures in two other transactions, prosecutors claim. In addition, they targeted at least five other law firms and two robotics companies—in the latter case, stealing confidential and proprietary information.
The two other accused men, Chin Hung and Bo Zheng, are residents of Macau and Changsha, China, respectively.