Chinese Hackers Breach Google Workspace, Target Medical Entities

WHO:

TechRadar - A Chinese-linked hacking group is involved in the data theft campaign.

Techmeme - The targeted entities include U.S. and Canadian academic, medical, and military research institutions.

WHAT:

TechRadar - Google reported that the hackers breached Workspace security to target a diverse set of national, state, and private medical entities.

Techmeme - The hacking group spent more than a year secretly stealing data from the targeted institutions.

WHERE:

Techmeme - The targeted institutions are located in the United States and Canada.

WHEN:

Techmeme - The data theft campaign occurred from September 2023 to November 2025.

WHY:

TechRadar - The ongoing data theft campaign is attributed to a Chinese nation-state attacker.

HOW:

TechRadar - The hackers exploited vulnerabilities in Google Workspace security to carry out their attacks.

(UPDATED June 16, 2026 16:31 UTC)

A Chinese-linked hacking group has been identified as the culprit behind a significant data theft campaign targeting U.S. and Canadian academic, medical, and military research institutions. Google reported that the hackers breached Workspace security, allowing them to secretly steal data from these entities over a period extending from September 2023 to November 2025. The attacks were attributed to a Chinese nation-state actor who exploited vulnerabilities in Google Workspace to carry out their operations.