FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails

The Integrity Technology Group conducted a years-long campaign stealing emails from high-value targets including government, law enforcement, and healthcare organizations, operating at least since January 2021 before detection. Most critically, the threat actors commoditized the stolen data by building a portal that granted paying third parties direct access to the exfiltrated communications, dramatically amplifying the harm beyond the initial breach. This case illustrates how insufficient email security controls, poor visibility into abnormal data exfiltration patterns, and delayed detection allowed a sophisticated actor to operate unimpeded for years. The existence of a commercial resale portal means downstream victims may be exposed to threats from multiple actors, not just the original attacker, compounding the long-term risk to affected organizations.