Threat Intelligence
US Offers $10 Million Reward for Information on Alleged Hafnium Hacker
The US is offering $10 million for information leading to the arrest of Zhang Yu, accused of helping run the Hafnium cyberattacks that targeted thousands of organisations worldwide.
Ross GrantUpdated 3 min read
The short version
The US government is offering $10 million for information about Zhang Yu, who is accused of helping run a major hacking campaign called Hafnium. This group allegedly broke into thousands of computers, including those at universities and law firms, to steal sensitive information. The attacks targeted flaws in Microsoft Exchange email servers. Zhang's alleged partner has been arrested, but Zhang is still at large.
By the numbers
- $10 millionreward offered for information on Zhang YuSecurity Affairs
- 12,700+US organisations compromised in Hafnium campaign (FBI estimate)Recorded Future News
- 60,000+US entities targeted by Hafnium group (FBI estimate)Recorded Future News
- $250 million+total paid by Rewards for Justice programme since 1984Security Affairs
What happened?
The US State Department has offered a $10 million reward for information leading to the arrest of Zhang Yu, accused of being a key figure in the Hafnium cyberattacks. US officials allege Zhang worked for Chinese intelligence and helped breach thousands of computers worldwide, targeting sensitive research and emails. Zhang's alleged partner, Xu Zewei, was arrested in Italy in 2025 and extradited to the US in 2026. Zhang remains at large.
The $10 Million Reward and Who Is Zhang Yu
The US State Department has announced a $10 million reward for information leading to the arrest of Zhang Yu, a Chinese national accused of playing a key role in the Hafnium hacking campaign. Zhang is said to be a director at Shanghai Firetech Information Science and Technology. According to US officials, he worked on behalf of Chinese intelligence services and supervised cyberattacks that targeted thousands of computers globally, including in the US. The reward is offered through the Rewards for Justice programme, which has paid out over $250 million since 1984 for information that helps protect US national security, originally against terrorism but now also cybercrime.Recorded Future News (opens in a new tab) Security Affairs (opens in a new tab) SecurityWeek (opens in a new tab)
What Was the Hafnium Campaign?
The Hafnium campaign refers to a series of cyberattacks that began in early 2020. According to US prosecutors, Zhang and his alleged partner Xu Zewei targeted US universities, immunologists, and virologists to steal COVID-19 research. In 2021, the group exploited vulnerabilities in Microsoft Exchange Server, a widely used email system, to compromise thousands of computers worldwide. The FBI estimates that more than 12,700 US organisations were affected, with over 60,000 targeted overall. Victims included universities and law firms, and the attackers reportedly stole sensitive documents and emails.
How the Attacks Were Organised
US authorities allege that Zhang and Xu acted under the direction of the Shanghai State Security Bureau, part of China’s Ministry of State Security. The indictment claims Zhang supervised Firetech employees in these operations, and that Xu reported directly to Zhang after breaking into a Texas university’s network. This structure, with private companies acting as intermediaries for state intelligence, makes attribution more complex and gives the state plausible deniability.
The Legal Case and Arrests
A nine-count indictment was unsealed in July 2025, naming both Zhang and Xu. Xu was arrested by Italian police in Milan in July 2025 and extradited to the US in April 2026, where he now faces federal charges. Zhang remains at large. The charges include violations of the Computer Fraud and Abuse Act, a US law that criminalises unauthorised access to computers.
What Happens Next?
The $10 million reward is intended to encourage anyone with information about Zhang’s whereabouts to come forward. Whether this will succeed is uncertain, especially as Zhang is believed to be in China. The US has used similar rewards in the past for cyber and terrorism cases, but the outcome often depends on international cooperation. The charges against Zhang have not yet been tested in court.
What You Should Know
For organisations, the Hafnium case highlights the risks of supply chain attacks and the importance of patching software vulnerabilities quickly. The Microsoft Exchange flaws used in the campaign were publicly disclosed in March 2021, and many organisations were compromised before patches were applied. Regular software updates and monitoring for unauthorised access remain key defences against similar attacks.
Claimed vs confirmed
- Unconfirmed
Zhang Yu was a key figure in the Hafnium campaign, working for Chinese intelligence.
US officials allege this, but Zhang has not been arrested or tried.
- Confirmed
Hafnium compromised more than 12,700 US organisations and targeted over 60,000 entities.
FBI and US officials have stated these figures.
- Confirmed
Zhang's partner, Xu Zewei, was arrested and extradited to the US.
Italian police arrested Xu in July 2025; he was extradited in April 2026.
The impact
- Money
- The Hafnium campaign caused widespread disruption and potential financial loss for thousands of organisations. Under US law, companies affected by breaches may face regulatory scrutiny and possible fines if they failed to protect sensitive data.
- Reputation
- The scale of the attacks and the involvement of state-sponsored actors have damaged trust in targeted organisations and highlighted the risks of software vulnerabilities. The high-profile nature of the case keeps it in the public eye.
- Customers
- Customers and users of affected organisations may have had their data stolen. Anyone affected should monitor for signs of identity theft or fraud, and organisations should notify those impacted as required by law.
Why it matters
Thousands of organisations, including universities and law firms, were affected by the Hafnium attacks. Sensitive research and personal data were stolen. The case shows how large-scale cyberattacks can impact critical infrastructure and highlights the challenges of tracking and prosecuting those responsible.
How does it work?
The Hafnium campaign exploited vulnerabilities in Microsoft Exchange Server, allowing attackers to gain unauthorised access to email accounts and sensitive documents. Attackers used these flaws to compromise thousands of systems before patches were applied.
Key points
- US offers $10 million reward for information on Zhang Yu, accused Hafnium hacker.
- Hafnium campaign targeted Microsoft Exchange servers, affecting thousands worldwide.
- Sensitive COVID-19 research and legal documents were among the stolen data.
- Zhang's alleged partner was arrested and extradited to the US; Zhang remains at large.
- The case highlights the importance of patching and monitoring for cyber threats.
Sources
Recorded Future News
Reference
Security Affairs
Reference
SecurityWeek
Reference
