Chinese state-linked hackers stole sensitive data from more than 300 organizations, including U.S. defense contractors, financial institutions and universities, and breached three Energy Department laboratories, the NIH and an HHS agency before the FBI knocked their hacking platforms offline this week, according to newly unsealed court records.

The group, known as QTFY, operated through a China-based company that the FBI says sold hacking services to clients including China's Ministry of State Security and People's Liberation Army. Former PLA members worked for the company and used military relationships to secure contracts for offensive cyber operations, the affidavit states.

What the Left Is Saying

Democratic lawmakers focused on the broader implications for national cybersecurity infrastructure following the breach. Senate Intelligence Committee Chairman Mark Warner said in a statement that the scale of the operation demonstrates the need for continued investment in defensive capabilities. "These actors are patient, sophisticated, and well-funded," Warner said. "Our defenses must evolve accordingly."

Rep. Raja Krishnamoorthi, the ranking Democrat on the House Select Committee on the Strategic Competition Between the United States and the Chinese Communist Party, called for enhanced information sharing between government agencies and private sector partners. "When you have a breach of this magnitude affecting critical infrastructure, it's clear that public-private partnerships in cybersecurity need to be strengthened," he said.

Civil liberties groups emphasized concerns about surveillance scope. The Electronic Frontier Foundation noted that while the FBI takedown is warranted, the scale of compromised IoT devices used in these operations raises questions about broader network security vulnerabilities facing American consumers and businesses.

What the Right Is Saying

Republican legislators pointed to the breaches as evidence of persistent threats from Beijing and called for tougher responses. Senate Armed Services Committee Chairman Roger Wicker said the intrusions into defense contractor networks represent a serious national security failure that demands accountability. "China's cyber campaigns against American infrastructure cannot be tolerated," Wicker said in a post on social media.

Rep. Mike Gallagher, who chairs the House select committee on China, called for accelerating development of offensive cyber capabilities and reducing dependency on vulnerable Chinese-manufactured technology components. "Every intrusion like this is a reminder that we remain dangerously exposed in cyberspace," Gallagher said in an interview with Fox News.

Former National Security Agency Director Paul Nakasone, speaking at a cybersecurity conference, argued that the FBI's disruption operation represents progress but cautioned that deterrence in cyberspace requires sustained pressure. "Takedowns are necessary tools, but they must be part of a larger strategy that includes both defensive resilience and credible threat of consequences," Nakisone said.

What the Numbers Show

The scope of QTFY's operations was significant by any measure. On a single day in 2024, according to FBI records, the group's QScan platform processed more than 2 million scanning and penetration-testing tasks. The platform contained more than 200 proof-of-concept exploits designed to target vulnerable software.

Federal investigators identified breaches at three Department of Energy national laboratories, the National Institutes of Health, and the Health Resources and Services Administration in September 2024 alone. In May 2024, hackers exploited a vulnerability in Check Point security software to access networks at power companies and telecommunications providers, stealing data from more than 300 organizations across the United States and internationally.

The FBI seized three domains powering QTFY's two primary platforms—QScan for system identification and QTRouter for traffic anonymization. The operation follows previous disruptions of Chinese-linked infrastructure: Volt Typhoon botnet in 2023, Flax Typhoon botnet in 2024, and removal of PlugX malware from over 4,000 U.S. computers infected by Mustang Panda.

Not all attacks succeeded. In 2019, QTFY attempted to breach NASA using a known VPN vulnerability but failed because the agency had already patched the flaw. The group also scanned Senate networks in March and election infrastructure systems in June without gaining access, according to joint FBI-NSA-Cyber National Mission Force advisories.

The Bottom Line

The case illustrates how China's cyber ecosystem has integrated commercial hacking services with state operations, a dynamic that U.S. officials say complicates traditional distinctions between government and private-sector threats. Attorney General Todd Blanche stated that "state-sponsored malicious hackers preying on America's critical infrastructure will be stopped and prosecuted."

What remains unclear is what specific data was accessed during the breaches at Energy Department laboratories, NIH, and HRSA. Federal advisories did not disclose whether the intrusions disrupted operations or how long hackers maintained access to those networks.

The FBI takedown severed domains used for core communications and authentication, which officials say crippled both QScan and QTRouter platforms. However, security researchers note that such disruptions typically force groups to rebuild infrastructure rather than eliminate capabilities permanently.

Congress is expected to examine the breaches in upcoming hearings on Chinese cyber operations. Watch for additional details on what information was compromised at DOE facilities and whether any classified systems were accessed.