Taiwanese authorities charge executives who helped China’s cyber spies target ICIJ network
A unit of Taiwan’s Investigation Bureau has charged two executives of a company that allegedly helped China’s cyber spies target Taiwanese officials and scholars, impersonating reporters affiliated with the International Consortium of Investigative Journalists.
After searching the offices of local firm Abigail and other locations, the Taipei City Investigation Office issued deferred prosecution orders against Li Hualun and Chen Mengsen for violating the personal data protection act and other crimes, according to a statementreleased by the bureau today.
The two obtained accounts for the messaging app LINE and leased them to Xiamen Empress Information Technology Co. Ltd.,
a firm allegedly linked to China’s cyber army, for about $161 per account. This enabled Chinese government-backed hackers to launch “social engineering attacks” against Taiwanese officials, as well as scholars and NGO workers, by impersonating journalists, the investigators found.
The suspects “acted under the direction of the Chinese Communist Party’s cyber army unit,” the bureau said.
The Taiwanese authorities’ operation follows an investigationby ICIJ and cybersecurity analysts at Toronto University’s Citizen Lab, which investigates digital threats against civil society. It identified suspicious emails by ICIJ impersonators and phony Chinese whistleblowers sent to ICIJ reporters as part of a sophisticated offensive strategy aimed at stealing private information from entities of interest to the Chinese government. The targets included Uyghur, Tibetan, Taiwanese, and Hong Kong diaspora activists, as well as journalists from ICIJ and elsewhere who report on activities related to these groups.
The attacks against the ICIJ network followed the 2025 publication of China Targets, which exposed Beijing’s tactics to silence dissidents overseas.
Citizen Lab found several errors in the suspicious emails, suggesting that the attackers may have been involved in a “high volume” of attacks and used artificial intelligence to automate them, identify targets and generate messages without much oversight.
Recommended reading TRANSNATIONAL REPRESSION Phony whistleblowers, fake journalists and cyber spies: ICIJ network targeted after China Targets probe Apr 27, 2026 Digital repression Cyberattack against Uyghur rights activists shows hallmarks of Chinese repression tactics, researchers say Apr 28, 2025 OVERVIEW Inside China’s machinery of repression — and how it crushes dissent around the world Apr 28, 2025
