Two people briefed on the preliminary investigation told the New York Times the hackers are believed to have been working on behalf of the Ministry of State Security. And while U.S. intelligence agencies have not officially determined who performed the hack — one of the largest data breaches ever — a group of firms brought in to asses the damage immediately spotted code and pattern similar to those used in previous operations by Chinese actors.