Czech Republic says China behind cyberattack on ministry, embassy rejects accusations

China's embassy in Prague called on the Czech side to end its "microphone diplomacy".

The attacks started during the country's 2022 EU presidency and were perpetrated by the cyber espionage group APT31, the Czech government said in a statement. 

The Czech Republic, an EU state and NATO member, said APT31 was publicly associated with the Chinese Ministry of State Security.

Foreign Minister Jan Lipavsky said that after the attack was detected, the ministry implemented a new communications system with enhanced security in 2024.

"I summoned the Chinese ambassador to make clear that such hostile actions have serious consequences for our bilateral relations," he said.

Lipavsky said the attacks centered on email and other documents and focused on information concerning Asia.

"The Government of the Czech Republic strongly condemns this malicious cyber campaign against its critical infrastructure," the government said in its statement.

China's embassy in the Czech Republic expressed "strong concern and decisive disagreement" with the Czech accusations.

"We call on the Czech side to immediately correct its incorrect actions, (and) stop 'microphone diplomacy'," it said in a statement on the embassy website.

Regarding APT31, it said China has repeatedly conducted technical analyses showing relevant evidence is insufficient and conclusions about the actor are not professional.

NATO and the European Union said they stood in solidarity with the Czech Republic, while Britain called the activity concerning and the United States denounced the actions.

"This is another instance of harmful cyber activity originating from APT31, and we urge China to behave responsibly in cyberspace, adhering to its international commitments," the U.S. embassy in Prague said.

EU member states have increasingly been the target of cyber attacks from China in recent years and China should do more to prevent them, the European Union said on Wednesday.

"We call upon all states, including China, to refrain from such behaviour," EU foreign policy chief Kaja Kallas in a statement. "States should not allow their territory to be used for malicious cyber activities."