Loading story…
Intel has filed a $250,000 lawsuit against a former software engineer, Jinfeng Luo, who allegedly stole approximately 18,000 confidential files, including data labeled as 'Intel Top Secret,' before disappearing. Luo, who had been with Intel since 2014, reportedly began attempting to transfer files from his company-issued laptop to external storage about a week before his termination, initially failing due to security controls but later succeeding by transferring data to a NAS device. After his departure, Intel was unable to contact Luo despite multiple attempts via phone, email, and postal mail, prompting the company to pursue legal action to recover the stolen information.
The incident occurred amid a significant reduction in Intel's workforce, with the company cutting 35,000 jobs over the past two years due to financial challenges. Intel's internal investigation quickly identified the unauthorized data transfers, and the company has a history of pursuing legal action against former employees for similar breaches. The case highlights ongoing risks of insider threats, particularly during periods of organizational upheaval, and underscores the importance of robust data loss prevention and monitoring mechanisms for sensitive intellectual property.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Intel initiated legal action against the former employee, accusing him of stealing thousands of confidential files. The lawsuit became the basis for subsequent media reporting across multiple outlets.
Reports said the ex-employee went missing or could not be located after the alleged mass download of Intel files. Coverage characterized him as having gone on the run or vanished following the incident.
Intel alleged that the former engineer downloaded about 18,000 company files, including material described as confidential or top secret. The reported files were said to contain sensitive internal information belonging to Intel.
A former Intel engineer was terminated from his position, setting the stage for the later dispute over alleged theft of confidential company data. Multiple reports describe the individual as a laid-off or ex-employee at the time of the alleged activity.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
securityboulevard.com
Open sourcesecurityonline.info
Open sourcehackread.com
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities and researchers are highlighting **China-linked espionage** that increasingly leverages online recruitment and employment channels to access sensitive information. Reporting on recent federal cases describes foreign intelligence services posing as consulting firms, research groups, or recruiters to approach current and former U.S. government personnel—often starting via email or job platforms and escalating through staged interviews, fake websites, and payment offers—to solicit **classified or sensitive information**; multiple Justice Department actions in 2025 reportedly involved such virtual-first recruitment approaches. Separately, a former Google engineer, **Linwei Ding**, was found guilty of **economic espionage and trade secret theft** after prosecutors said he exfiltrated over 2,000 pages of confidential AI supercomputing documents (including TPU/GPU architecture details, orchestration software, SmartNIC networking designs, and internal system configurations) and uploaded them to a personal cloud account while maintaining undisclosed ties to China-based companies and engaging with a Shanghai-sponsored talent program. Broader context from CSIS’ long-running survey of Chinese espionage cases underscores that these incidents fit a sustained pattern since 2000 spanning both **human intelligence** and **cyber-enabled theft** targeting U.S. government and commercial technologies, while noting open-source case lists likely undercount the true scope.
Jun 29, 2026
A U.S. federal jury convicted former Google engineer **Linwei Ding** (aka **Leon Ding**) on **14 counts** spanning **economic espionage** and **theft of trade secrets** after prosecutors said he stole thousands of confidential Google documents tied to the company’s artificial intelligence technology for the benefit of a China-based startup. The U.S. Department of Justice framed the case as protection of U.S. intellectual property and national security, alleging the theft was intended to advantage the **People’s Republic of China (PRC)**. Reporting indicates Ding began exfiltrating internal materials as early as **May 2022**, including by copying content into the **Apple Notes** app, converting it to PDFs, and uploading it to a personal cloud account. The stolen information reportedly covered sensitive AI infrastructure and chip-related technology, including details associated with Google’s AI supercomputing environment (e.g., data center/cluster management components) and hardware/software used to run AI workloads (including **TPU/GPU systems** and related networking components). Ding was initially indicted in **March 2024**, with subsequent superseding indictments expanding the alleged timeframe and charges; the case is cited as *USA v. Ding*, N.D. Cal., No. `3:24-cr-00141`.
Jun 29, 2026
AMD said it is investigating claims that its internal network was breached after the threat actor **IntelBroker** advertised a large cache of alleged company data for sale on a cybercrime forum. Reported samples indicate the material may include **future product details, source code, firmware, internal communications, financial records, customer databases, and employee information**, raising concerns over intellectual property exposure, corporate espionage, and privacy risks. AMD said it is working with **law enforcement** and a third-party hosting partner to determine whether the data is authentic and to assess the scope and impact of the incident. The AMD claims fit a broader pattern of high-profile extortion and data-theft allegations tied to forum-based actors, including earlier reports in which attackers claimed to possess sensitive files from major organizations such as **GE** and even purported **DARPA**-related material, though some of those assertions remained unconfirmed. In AMD's case, public reporting indicates the stolen dataset was promoted on the dark web and may contain strategically valuable engineering and business information, making the incident significant even before full verification is complete.
Jun 29, 2026