Macau hackers charged with trading on stolen law firm data

An aerial view of Manhattan, where top law firms were hacked

Three Chinese hackers made more than USD4 million in illicit profits after breaking into the servers of top corporate law firms in New York, the U.S. said in announcing charges and the arrest of one of the men.

The three targeted at least seven major international law firms that had been retained by companies to advise on deals and successfully got into the e-mail accounts of senior lawyers at two of the firms, according to the indictment unsealed yesterday.

They profited on deals and speculation involving the drug maker Intermune, chipmaker Intel Corp. and business services company Pitney Bowes Inc., the U.S. said. The U.S. Securities and Exchange Commission also sued and is seeking an asset freeze.

The case places law firms among the widening group of targets for cybercriminals seeking to profit from insider information. Last year, the U.S. broke up an international ring of hackers who allegedly infiltrated the computer servers of PRNewswire Association LLC, Marketwired and Business Wire and stole market-moving press releases before they were published. According to the SEC, the group, which included Ukrainians and a Georgian, made more than $100 million from trading on the information.

“This case of cyber meets securities fraud should serve as a wake-up call for law firms around the world,” Manhattan U.S. Attorney Preet Bharara said in the statement.

The three men – Iat Hong and Chin Hung, 50, of Macau, and Bo Zheng, 30, of China – worked at a robotics company that was started by Zheng, according to the government. Hong, 26, was arrested in Hong Kong on Christmas Day and is awaiting extradition. The SEC is also seeking to freeze an account registered in Hong’s mother’s name.

In addition to the law firms, they also hacked other robotics companies, the U.S. said. They allegedly stole schematic designs of a robot vacuum cleaner made by a U.S. company.

The three generally used the same tactics to get the information, according to the U.S. They would get the log-in credentials of an employee and place malware on a server that allowed them to access the e-mails of key people at the firms and companies, according to the indictment. In a one-day period in 2014, they took 10 gigabytes of confidential data from one law firm’s server, the U.S. said.

They weren’t always successful, the U.S. said. During one six-month period in 2015, the three men allegedly tried on more than 100,000 occasions to break into the networks of five law firms.

The law firms weren’t identified in the complaints. The Wall Street Journal reported in March that Cravath Swaine & Moore LLP and Weil Gotshal & Manges LLP were among the targeted law firms. Amy Fantini, a Weil, Gotshal & Manges spokeswoman, declined to comment on the charges. Cravath Swaine & Moore didn’t respond to a request for comment.

The three men allegedly bought shares of Intermune based on the information gleaned from the hacked data. Though the deal didn’t close, they still made money as shares rose on media reports that the company was seeking a tie-up, the U.S. said. Intermune was ultimately purchased by Roche AG. Cravath advised Intermune on the deal.

In another deal, the group allegedly bought shares in chipmaker Altera Corp. after Intel had retained one of the law firms to advise on an acquisition. They scored $1.4 million in profits on the trade amid media reports of the pending deal, and sold their shares before it was publicly announced, according to the indictment. Weil Gotshal was one of the law firms advising Intel on the deal.

Using information gleaned from a second law firm, the trio also bought shares of Borderfree, an online commerce site that was an acquisition target of Pitney Bowes, the U.S. said. They made a profit of $841,000 on the trades after the deal was announced on May 18, 2015, according to the indictment.

Prior to the Borderfree takeover, Hong and Chin bought so much of the company’s stock that on certain days the two accounted for 25 percent or more of the company’s trading volume, according to the SEC complaint. Christian Berthelsen, Bloomberg