U.S. Offered $10 Million Reward for Wanted Cyber Hacker
The State Department seeks information on Zhang Yu, who is accused of stealing sensitive research from U.S. universities.
Updated on Oct. 7, 2026 in Cybersecurity
Live Poll
Do you believe multi-million dollar rewards for individual hackers help reduce state-sponsored cyber attacks?
The U.S. State Department has announced a $10 million reward for information leading to the apprehension of Zhang Yu. Zhang is accused of leading a hacking campaign that targeted U.S. universities and virologists to steal sensitive COVID-19 research.
Why it matters
The investigation highlights ongoing efforts to combat state-sponsored cyber espionage aimed at sensitive domestic intellectual property. Federal authorities allege the activities were conducted at the behest of intelligence bureaus to compromise U.S. infrastructure.
The Hafnium campaign utilized unauthorized network intrusions to breach computers between February 2020 and June 2021. Prosecutors filed a nine-count indictment detailing the systematic theft of documents and emails.
The players
Zhang Yu
He is the director of Shanghai Firetech Information Science and Technology who allegedly orchestrated cyberattacks on behalf of state security bureaus.
Xu Zewei
He is a co-defendant in the nine-count indictment who was apprehended in Italy and subsequently extradited to the U.S. to face criminal charges.
Shanghai State Security Bureau
This Chinese intelligence agency is identified in court filings as the entity that directed the hacking operations against U.S. organizations.
The details
Zhang Yu, the director of Shanghai Firetech Information Science and Technology, is accused of operating under the direction of the Shanghai State Security Bureau. He is charged alongside Xu Zewei, who was extradited to the United States in April 2026 following an arrest in Milan.
Timeline
The alleged computer intrusions occurred between February 2020 and June 2021.
Xu Zewei was arrested by authorities in Milan in July 2025.
Xu Zewei was extradited to the United States in April 2026.
The State Department announced the reward offer on October 7, 2026.
The Tech Race
The prosecution signals a shift toward aggressive international legal pursuit of actors linked to large-scale cyber espionage campaigns. It challenges the ability of state-affiliated hackers to operate with perceived anonymity while targeting foreign research infrastructure.
The ongoing investigation into the Hafnium campaign underscores the vulnerability of research institutions to data theft. Readers may see increased institutional security protocols intended to protect sensitive data from future state-sponsored intrusions.
The takeaway
This case illustrates the complex intersection of global intelligence operations and domestic criminal law. Law enforcement agencies continue to rely on international cooperation to apprehend suspects accused of violating national digital security standards.
Further reading
For more information on ongoing efforts to protect critical information systems, visit Cybersecurity.
Source note: This article includes information reported by Therecord.
Live Poll
Do you believe multi-million dollar rewards for individual hackers help reduce state-sponsored cyber attacks?
