Hackers linked to China breached the computer network of a regional organisation in Fiji between July and August, according to the US embassy in the Pacific nation. The warning has raised concerns about cybersecurity across the Pacific Islands, where governments and telecommunications networks face growing threats as the region expands its digital infrastructure.
The US embassy in Fiji announced the reported intrusion on Tuesday, saying the attackers maintained access to the organisation's network for several days. It did not identify the organisation or disclose what information, if any, the hackers accessed or removed.
Fiji's policing and communications minister, Ioane Naivalurua, said he was reviewing the situation, while police investigated the reported attack. He urged government agencies, private businesses and other organisations to strengthen their digital defences and take steps to prevent further intrusions.
The incident comes as Fiji becomes an increasingly important telecommunications hub in the Pacific. Its capital, Suva, sits along routes connecting international subsea cables that link the United States, Guam, Australia and French Polynesia. These connections support regional communications and make the security of digital infrastructure an issue of wider international concern.
China has rejected hacking activities as a matter of principle but also warned against using cybersecurity allegations to discredit the country. The Chinese foreign ministry said it was not aware of the specific case.
US Embassy Warns of Cyberattacks Across the Pacific
In its statement on Facebook, the US embassy said hackers with links to China had gained access to a regional organisation based in Suva and retained that access over several days.
The embassy also warned that foreign governments, organisations and telecommunications networks across the Pacific Islands were being targeted by China linked hackers. It did not provide technical details about the Fiji incident or publicly identify the suspected attackers.
The warning places renewed attention on the ability of Pacific governments and institutions to protect sensitive information and essential digital services. A successful intrusion can expose confidential communications, disrupt operations or provide attackers with access that could be used in later attacks. However, the embassy's statement did not establish that any of these outcomes occurred in the Fiji case.
Naivalurua said authorities were examining the reported incident and called on organisations to act before their systems became targets.
He urged governments, organisations and private sector operators to take preventive measures and strengthen the security of their digital systems.
The investigation is expected to help authorities assess the reported intrusion. Until more technical findings become available, important questions remain unanswered, including how the attackers gained access, what systems were affected and whether any data was compromised.
The US embassy's warning also reflects broader concerns about cyber threats to telecommunications infrastructure, which carries data between governments, businesses and individuals across national borders.
Why Fiji's Subsea Cable Network Matters
Fiji occupies an important position in the Pacific's expanding telecommunications infrastructure. International subsea cables connect islands and countries that would otherwise face greater difficulties maintaining high capacity digital communications.
Google is expanding a network of subsea cables linking Guam, Australia, French Polynesia and the mainland United States through routes that include Fiji. These connections support international data traffic and help improve communications capacity across the region.
Guam is home to a major US military presence, while Australia is a close US defence partner. This geography gives Pacific telecommunications infrastructure importance beyond ordinary internet access, particularly where networks support government communications, commercial activity and services used by security organisations.
Subsea cables carry large volumes of international data, making their physical security and the protection of associated network systems important to the countries and companies that depend on them.
Cybersecurity risks are not limited to attacks that cut cables or damage equipment. Hackers may seek access to the computer systems of organisations responsible for operating, managing or using digital infrastructure. Depending on the systems compromised, an intrusion could expose information or create opportunities for further attacks.
The Fiji incident does not establish that the country's subsea cables were compromised. The embassy described a breach involving a regional organisation's network, without linking the intrusion to the physical cables themselves.
Nevertheless, the report has renewed attention on the need for strong cybersecurity practices as the Pacific's digital connections expand.
China Rejects Hacking Allegations
China's foreign ministry responded to the report by saying it was unaware of the specific case but opposed hacking activities.
Speaking at a regular press briefing, spokesperson Mao Ning said China firmly opposed hacking and acted against such activities in accordance with the law.
She also rejected what she described as attempts to use cybersecurity issues to smear China.
The response did not address the technical details of the alleged intrusion in Suva. The US embassy, meanwhile, has not publicly released evidence identifying the attackers or explaining how it attributed the incident to people linked to China.
Attribution is a significant part of cyber investigations. Security researchers and law enforcement agencies may examine network logs, malicious software, infrastructure used in attacks and other technical evidence to identify the people or groups responsible. Establishing a connection to a particular state can require additional evidence beyond identifying the suspected hackers.
The public statements available in this case do not provide enough technical information to independently verify the US embassy's attribution.
China's response and the ongoing police investigation therefore remain important parts of the story. Further evidence could clarify how the breach occurred and who was responsible.
FBI Investigation Adds to US Concerns
The US embassy also referred to action taken by the Federal Bureau of Investigation (FBI) in August against hackers accused of targeting critical infrastructure in the United States.
According to an FBI affidavit cited in the report, a hacking group known as QTFY included former members of China's military and worked for a company paid by China's Ministry of State Security. The group allegedly targeted organisations including NASA, the US Department of Energy and power companies.
The embassy said the FBI's action had direct relevance to the Pacific because similar cyber threats could affect organisations and infrastructure across the region.
However, the US investigation into alleged attacks against American targets is separate from the reported breach in Fiji. The information provided does not establish that QTFY was responsible for the Suva incident.
The reference to the FBI case illustrates the concerns US officials have expressed about suspected China linked cyber operations. It does not, by itself, prove a connection between the group identified in the affidavit and the unidentified organisation in Fiji.
For Pacific governments, the broader concern is whether their institutions have sufficient resources to detect intrusions, investigate suspicious activity and protect networks from repeated attacks.
Pacific Islands Forum Says Its Systems Were Not Affected
The Pacific Islands Forum, a regional political organisation, confirmed that its secretariat was not affected by the reported cyberattack.
A spokeswoman for the organisation told Agence France Presse that the Pacific Islands Forum Secretariat had not been compromised. Her statement addressed speculation about whether the regional body was the unidentified organisation mentioned by the US embassy.
The spokeswoman also emphasised the importance of cybersecurity for Pacific countries, linking digital security to economic resilience, national sovereignty, regional security and the wellbeing of communities.
Her comments reflect the region's reliance on digital systems for public services, communications and economic activity. A cyberattack against a government agency or regional institution could create problems beyond the organisation directly affected, particularly if compromised systems connect to other networks or handle sensitive information.
The Pacific Islands Forum's clarification also leaves the identity of the organisation involved in the reported Suva breach unresolved. Neither the US embassy's announcement nor the statements cited in the report named the victim.
What Happens Next in Fiji's Cybersecurity Investigation?
Fiji's police investigation will be important in determining the circumstances of the reported breach. Investigators will need to establish how the attackers entered the network, what they accessed and whether the organisation suffered any loss of data or disruption.
Organisations across the Pacific can reduce exposure to cyberattacks by applying security updates promptly, using multifactor authentication, restricting access to sensitive systems, monitoring network activity and preparing procedures for responding to breaches.
Government agencies and telecommunications operators may also need to review how they share information about threats and coordinate responses when attacks cross organisational or national boundaries.
The reported incident has placed Fiji's cybersecurity preparedness under renewed scrutiny at a time when its role in international telecommunications is growing. Yet the identity of the affected organisation, the extent of any data exposure and the evidence supporting the attribution to China linked hackers remain undisclosed.
Should Pacific governments increase investment in cybersecurity as international telecommunications networks expand? Share your views in the comments.