The US Department of Justice clarified on August 28, 2026, that while the Chinese state-sponsored hacker group QTFY targeted multiple US government agencies, including the Senate, Federal Reserve, and NASA, only some systems were actually breached [1, 2, 3, 4]. The DOJ previously reported that several agencies had been victims of intrusions but amended the statement to specify that not all targeted entities suffered successful compromises [2].

QTFY has conducted cyber-espionage campaigns against US government agencies, defense contractors, and other sensitive targets since at least 2018 [2, 3, 4]. The FBI affidavit lists the Senate, NASA, Federal Reserve, Department of Energy (DOE), Department of Justice, Department of Health and Human Services (HHS), and National Institutes of Health (NIH) as targets of these operations [2, 3, 4].

Investigations found that QTFY’s attempts to hack NASA were unsuccessful because vulnerabilities had been patched, preventing breaches [2, 3, 4]. In September 2024, QTFY successfully infiltrated three DOE national laboratories, NIH, an HHS agency, and a US security device manufacturer, according to reports [2, 3, 4].

A joint cybersecurity advisory from the FBI, NSA, and US Cyber Command detailed additional activity by QTFY, including successful hacks of a defense contractor, a financial institution, and a university in May 2024, alongside failed attempts to breach the US Senate and a hospital in March 2026 [3, 4].

The distinction between targeting and confirmed breaches narrows the scope of agencies actually compromised. The Department of Justice emphasized that "all agencies were targeted but only some were compromised," refining previous statements [2].

The Chinese Embassy in Washington denied the allegations, accusing the US of using national security claims to unfairly restrict Chinese companies. A spokesperson said, “美国利用网络安全抹黑或诋毁中国，中国反对美国滥用国家安全概念，以此为借口对中国企业施加歧视性限制，并将坚决维护中国企业的合法权益” [1].

The DOJ’s clarification came two days after the initial announcement on August 26, 2026 [1, 2, 3, 4]. Authorities continue to monitor QTFY’s activities amid ongoing cybersecurity efforts.