The State Department has put up $10 million for tips on where Zhang Yu is, The Record reported on 7 October 2026. Zhang is a Chinese citizen who directs Shanghai Firetech Information Science and Technology. US officials say he worked for the Chinese government in the Hafnium hacking campaign. The Record says that campaign broke into thousands of computers and took documents and emails. The State Department says his targets included at least one university and a law firm.
A nine-count Justice Department indictment, made public last year, names Zhang and a second man, Xu Zewei. It covers break-ins between February 2020 and June 2021. Prosecutors allege both acted on orders from Chinese intelligence services. The Record says they allegedly stole COVID-19 research from US universities, immunologists and virologists. Italian authorities arrested Xu in Milan in July 2025, and he was extradited to the US in April. Zhang remains at large. These are accusations, not court findings.
The FBI's Brett Leatherman said last year that Hafnium targeted over 60,000 US entities and succeeded against more than 12,700. The Record does not say how the attackers got in, so no specific system can be named as the weak point.