Chinese hackers stole Van Rompuy e-mails

Bloomberg’s Michael Riley and Dune Lawrence report:  The hackers clocked in at precisely 9:23 a.m. Brussels time on July 18 last year, and set to their task. In just 14 minutes of quick keyboard work, they scooped up the e-mails of the president of the European Union Council, Herman Van Rompuy, Europe’s point man for ...

By , a former associate editor at Foreign Policy.

Bloomberg's Michael Riley and Dune Lawrence report

Bloomberg’s Michael Riley and Dune Lawrence report

The hackers clocked in at precisely 9:23 a.m. Brussels time on July 18 last year, and set to their task. In just 14 minutes of quick keyboard work, they scooped up the e-mails of the president of the European Union Council, Herman Van Rompuy, Europe’s point man for shepherding the delicate politics of the bailout for Greece, according to a computer record of the hackers’ activity.

Over 10 days last July, the hackers returned to the council’s computers four times, accessing the internal communications of 11 of the EU’s economic, security and foreign affairs officials. The breach, unreported until now, potentially gave the intruders an unvarnished view of the financial crisis gripping Europe.

And the spies were themselves being watched. Working together in secret, some 30 North American private security researchers were tracking one of the biggest and busiest hacking groups in China.

Observed for years by U.S. intelligence, which dubbed it Byzantine Candor, the team of hackers also is known in security circles as the Comment group for its trademark of infiltrating computers using hidden webpage computer code known as “comments.”

The group’s targets included everyone from British Tobacco companies, to human rights NGOs to — bizarrely — an Italian restaurant in midtown Manhattan. According to a 2008 WikiLeaks cable, U.S. officials belief Byzantine Candor is linked to the Chinese military.

In Brussels, the group also stole e-mails from senior trade, foreign policy, and counterterrorism officials. At the time of the breach, the EU was involved in talks on the second Greek bailout. 

Joshua Keating was an associate editor at Foreign Policy. Twitter: @joshuakeating

More from Foreign Policy

Newspapers in Tehran feature on their front page news about the China-brokered deal between Iran and Saudi Arabia to restore ties, signed in Beijing the previous day, on March, 11 2023.
Newspapers in Tehran feature on their front page news about the China-brokered deal between Iran and Saudi Arabia to restore ties, signed in Beijing the previous day, on March, 11 2023.

Saudi-Iranian Détente Is a Wake-Up Call for America

The peace plan is a big deal—and it’s no accident that China brokered it.

Austin and Gallant stand at podiums side by side next to each others' national flags.
Austin and Gallant stand at podiums side by side next to each others' national flags.

The U.S.-Israel Relationship No Longer Makes Sense

If Israel and its supporters want the country to continue receiving U.S. largesse, they will need to come up with a new narrative.

Russian President Vladimir Putin lays flowers at the Moscow Kremlin Wall in the Alexander Garden during an event marking Defender of the Fatherland Day in Moscow.
Russian President Vladimir Putin lays flowers at the Moscow Kremlin Wall in the Alexander Garden during an event marking Defender of the Fatherland Day in Moscow.

Putin Is Trapped in the Sunk-Cost Fallacy of War

Moscow is grasping for meaning in a meaningless invasion.

An Iranian man holds a newspaper reporting the China-brokered deal between Iran and Saudi Arabia to restore ties, in Tehran on March 11.
An Iranian man holds a newspaper reporting the China-brokered deal between Iran and Saudi Arabia to restore ties, in Tehran on March 11.

How China’s Saudi-Iran Deal Can Serve U.S. Interests

And why there’s less to Beijing’s diplomatic breakthrough than meets the eye.