The US, the EU and the UK have accused China of carrying out a major cyber-attack earlier this year which targeted Microsoft Exchange servers, affecting over a quarter of a million servers around the world.

The EU said the attack came from “the territory of China”, while the UK said Chinese state-backed actors were responsible.

“The United States and countries around the world are holding the People’s Republic of China accountable for its pattern of irresponsible, disruptive, and destabilizing behavior in cyberspace, which poses a major threat to our economic and national security,” US Secretary of State Anthony Blinken said in a statement.

Intrusions exploiting vulnerabilities in the Microsoft Exchange Server that were disclosed in March have been attributed to “cyber actors affiliated with” China’s Ministry of State Security, Blinken said.

Chinese officials have previously said China is also a victim of hacking and opposes all forms of cyber-attacks.

US officials said the scope and scale of hacking attributed to China has surprised them, along with China’s use of “criminal contract hackers.”

“The PRC’s Ministry of State Security (MSS) has fostered an ecosystem of criminal contract hackers who carry out both state-sponsored activities and cybercrime for their own financial gain,” Blinken said.

“The cyber-attack on Microsoft Exchange Servers by Chinese state-backed groups was a reckless but familiar pattern of behaviour,” UK Foreign Secretary Dominic Raab said. “The Chinese government must end this systematic cyber-sabotage and can expect to be held to account if it does not.”

Meanwhile, the EU statement also said it had seen other Chinese behaviour that caused concern:

“We have also detected malicious cyber activities with significant effects that targeted government institutions and political organisations in the EU and member states, as well as key European industries.”

Microsoft announced details of the hack back in March and said a group called Hafnium, linked to China, was responsible. China has denied those accusations.

Follow us on twitter: @RisksEmerging