Loading story…
A U.S. federal jury convicted former Google engineer Linwei Ding (aka Leon Ding) on 14 counts spanning economic espionage and theft of trade secrets after prosecutors said he stole thousands of confidential Google documents tied to the company’s artificial intelligence technology for the benefit of a China-based startup. The U.S. Department of Justice framed the case as protection of U.S. intellectual property and national security, alleging the theft was intended to advantage the People’s Republic of China (PRC).
Reporting indicates Ding began exfiltrating internal materials as early as May 2022, including by copying content into the Apple Notes app, converting it to PDFs, and uploading it to a personal cloud account. The stolen information reportedly covered sensitive AI infrastructure and chip-related technology, including details associated with Google’s AI supercomputing environment (e.g., data center/cluster management components) and hardware/software used to run AI workloads (including TPU/GPU systems and related networking components). Ding was initially indicted in March 2024, with subsequent superseding indictments expanding the alleged timeframe and charges; the case is cited as USA v. Ding, N.D. Cal., No. 3:24-cr-00141.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Following the guilty verdict, the court scheduled a status conference for Ding as the case moved toward sentencing.
A federal jury in the Northern District of California found Ding guilty after an 11-day trial on seven counts of economic espionage and seven counts of theft of trade secrets related to Google's AI technology.
In February 2025, prosecutors filed a superseding indictment expanding the alleged offense period and adding economic espionage charges, including allegations the theft was intended to benefit the People's Republic of China.
In March 2024, federal authorities indicted and arrested Ding in California on initial theft-of-trade-secrets charges tied to the alleged transfer of Google's proprietary AI technology.
Court records cited in coverage say Ding downloaded confidential Google information from his personal cloud account to a personal computer in December 2023, shortly before resigning.
In late 2023, Google discovered that Ding had publicly presented in China to potential investors about a China-based startup he founded while still employed by Google, helping bring the scheme to light.
Between May 2022 and April 2023, Ding allegedly transferred more than 1,000 to 2,000 confidential Google files or pages covering TPU, GPU, SmartNIC, data center, and cluster-management technology to personal accounts.
Prosecutors said Linwei Ding started exfiltrating confidential Google AI and supercomputing documents in May 2022, using methods such as copying material into Apple Notes, converting it to PDFs, and uploading it to personal cloud storage.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetomshardware.com
Open sourcebleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcethehackernews.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities and researchers are highlighting **China-linked espionage** that increasingly leverages online recruitment and employment channels to access sensitive information. Reporting on recent federal cases describes foreign intelligence services posing as consulting firms, research groups, or recruiters to approach current and former U.S. government personnel—often starting via email or job platforms and escalating through staged interviews, fake websites, and payment offers—to solicit **classified or sensitive information**; multiple Justice Department actions in 2025 reportedly involved such virtual-first recruitment approaches. Separately, a former Google engineer, **Linwei Ding**, was found guilty of **economic espionage and trade secret theft** after prosecutors said he exfiltrated over 2,000 pages of confidential AI supercomputing documents (including TPU/GPU architecture details, orchestration software, SmartNIC networking designs, and internal system configurations) and uploaded them to a personal cloud account while maintaining undisclosed ties to China-based companies and engaging with a Shanghai-sponsored talent program. Broader context from CSIS’ long-running survey of Chinese espionage cases underscores that these incidents fit a sustained pattern since 2000 spanning both **human intelligence** and **cyber-enabled theft** targeting U.S. government and commercial technologies, while noting open-source case lists likely undercount the true scope.
Jun 29, 2026
US federal prosecutors indicted **Samaneh Ghandali** and **Soroor Ghandali** (former Google engineers) and **Mohammadjavad Khosravi** (Samaneh’s husband, employed at another unnamed tech firm) for alleged **trade secret theft**, **conspiracy**, and **obstruction of justice** tied to the exfiltration of sensitive processor-related information. The Department of Justice alleges the trio used their roles at multiple Silicon Valley companies to access and steal confidential documents covering **processor security** and **cryptography**, and moved the material to unauthorized third-party and personal locations, including destinations linked to **Iran**. Investigators allege the activity included transferring large volumes of internal files to external communications platforms and sharing them in channels associated with the defendants, with additional copies later found on personal devices and systems connected to the group. Prosecutors also claim the defendants attempted to conceal the scheme through actions such as destroying records, making false statements, and photographing screens to avoid direct document transfers. Google said it enhanced safeguards and alerted law enforcement after discovering the incident; the alleged stolen trade secrets reportedly included information related to Google’s **Tensor** processor used in *Pixel* phones.
Jun 29, 2026
Apple filed a federal lawsuit in the Northern District of California accusing OpenAI, its hardware subsidiary **io Products**, and former Apple employees of systematically misappropriating trade secrets tied to unreleased hardware designs, manufacturing processes, and supplier relationships. The complaint names OpenAI hardware chief **Tang Yew Tan** and former Apple engineer **Chang Liu**, and alleges OpenAI recruiters asked Apple candidates to bring confidential prototypes, CAD files, design artifacts, and physical parts to interviews while using internal Apple project codenames to probe knowledge of unreleased products. Apple also alleges former employees retained company equipment, accessed internal systems after departure, downloaded confidential engineering and manufacturing files, and shared guidance on bypassing Apple security and offboarding controls. The suit further claims OpenAI used insider knowledge to approach Apple suppliers and sought unauthorized use of a proprietary metal-finishing technique, as Apple pursues damages, return of materials, preservation of evidence, and court orders blocking any further use of its trade secrets despite the companies' ongoing partnership around ChatGPT integration in Apple Intelligence.
Jul 16, 2026