Full Breakdown
Italy Extradites Chinese Hacker Xu Zewei to U.S. Over COVID-19 Research Theft
4/28/2026, 10:12:12 AM
Extradition Overview
Italian police transferred Xu Zewei, a 34-year-old Chinese national, to U.S. authorities on 27 April 2026. Xu was arrested in Milan in July 2025 at the request of the United States and now faces a nine-count federal indictment that includes wire fraud, aggravated identity theft, criminal conspiracy, unauthorized computer access and computer fraud. U.S. prosecutors allege he participated in a state-backed hacking campaign targeting U.S. universities and researchers working on COVID-19 vaccines, treatments and testing.
Context of HAFNIUM and State-Backed Cyber Operations
The indictment ties Xu to the HAFNIUM campaign, which exploited Microsoft Exchange vulnerabilities in 2021 and compromised thousands of organizations worldwide, including roughly 13,000 in the United States. U.S. officials say the campaign was directed by China’s Ministry of State Security and carried out by contract hackers through Shanghai-based “enabling” firms. The alleged theft of COVID-19 research underscores concerns about Chinese cyber-espionage of biomedical data.
Timeline
- July 2025 – Xu arrested in Milan at U.S. request.
- Early April 2026 – Italian court authorizes extradition.
- 27 April 2026 – Italy hands Xu over; DOJ announces extradition; Xu appears in federal court in Houston.
Legal Charges and Data
The nine-count indictment charges Xu with wire fraud, aggravated identity theft and unauthorized computer access. Court filings cite HAFNIUM’s compromise of “more than 12,700 U.S. organizations” and estimate 13,000 U.S. entities were affected. The intrusions spanned February 2020 to June 2021.
Official Statements & Responses
The Department of Justice says Xu “hacked U.S. universities and researchers focused on COVID-19 vaccines, treatments and testing.” Italian police described him as a dangerous foreign hacker. The Chinese Foreign Ministry condemned the charges, accusing the United States of fabricating them through political manipulation, and urged Italy to respect facts and law, correct its mistake. The FBI said the extradition shows its investigative reach.
Criticism & Opposition
China’s diplomatic protest frames the case as a motivated accusation. Xu’s lawyer, Enrico Giarda, maintains his client is a “victim of mistaken identity” and has received no formal communication about the extradition.
Conflicting Reports & Gaps
Sources differ on whether Xu was already in the United States before the formal handover or was flown after the court ruling. The precise number of compromised U.S. organizations varies between “roughly 13,000” and “more than 12,700.” No public details have emerged about co-conspirator Zhang Yu, who remains at large.
Verbatim Quotes
- “Today, Xu Zewei will stand in a federal courtroom to answer for crimes that struck at the heart of American science and security.” — John Marck, Acting U.S. Attorney
- “fabricating charges through political manipulation” — Chinese Foreign Ministry spokesperson
- “The extradition of Xu Zewei demonstrates the FBI’s reach extends well beyond U.S. borders,” — Brett Leatherman, FBI Cyber Division assistant director
- “a dangerous foreign hacker” — Italian police
Outlook
Xu will remain in custody pending a trial in Houston, where conviction on all counts could carry decades of imprisonment. U.S. investigators continue to seek co-conspirator Zhang Yu and signal intent to pursue extraditions of alleged state-backed cyber operatives.
