The US State Department is offering up to $10 million for information on the whereabouts of Zhang Yu, a Chinese national accused of being a key figure in the Hafnium hacking campaign, according to The Record. US officials say Zhang, director of Shanghai Firetech Information Science and Technology, worked on behalf of the Chinese government in an effort that breached thousands of computers and stole documents and emails. The State Department says he violated the Computer Fraud and Abuse Act in attacks that targeted at least one university and a law firm.
Zhang is accused of working with another Chinese official, Xu Zewei, to steal COVID-19 research from US-based universities, immunologists and virologists. Xu was arrested in Milan, Italy, in July 2025 and extradited to the US in April. A nine-count indictment unveiled last year alleges that the pair carried out computer intrusions between February 2020 and June 2021, including the indiscriminate Hafnium campaign, at the direction of China’s Ministry of State Security and the Shanghai State Security Bureau. Prosecutors say Xu reported back to supervising officers, including once confirming he had compromised a research university’s network in the Southern District of Texas. The FBI said last year that the campaign targeted over 60,000 US entities and successfully victimized more than 12,700. Zhang remains at large, and the allegations have not been tested in court.