The United States Embassy in Suva has told the Fijian Government and an unnamed Suva-based regional organisation that hackers linked to China are suspected of having compromised that organisation’s computer network between July and August 2026, with access held over several days, according to the Fiji Times and Reuters.
Key facts
- The embassy’s statement, as carried by the Fiji Times, described the compromise as “suspected” and dated the US identification of it to the July–August 2026 window.
- The embassy notified both the Fijian Government and the affected entity and provided technical recommendations on protecting their networks, Reuters reported.
- Suva is the headquarters city for several regional institutions, among them the Pacific Islands Forum Secretariat, the Pacific Community and the University of the South Pacific. None of the three source reports links the breach to any of them.
- Reuters said the Government of Fiji did not immediately respond to its request for comment.
Why it matters
The embassy framed the Suva case as part of a wider pattern. In a second post, it said hackers tied to the Chinese state are targeting three categories of Pacific Islands target — governments, international bodies and telecommunications networks — and that the activity fits the US assessment that China is a constant threat online, The Next Web reported.
The embassy’s stated rationale for going after a regional body, according to the same report, is that stolen data gives Chinese spy agencies and others a view into private talks between Pacific Island countries. Beyond those three categories, the embassy did not identify any specific network, operator or member country, and none of the three reports names an affected telecommunications provider or puts a figure on how many Pacific entities have been targeted.
What the embassy will not say
The statement did not say what material the hackers may have seen, whether any sensitive data was stolen, or what has since been done to the affected network, the Fiji Times reported. The Next Web added that the embassy did not name the hacking group. Fiji News is not naming any organisation in the absence of sourced information.
The three reports otherwise diverge only in emphasis, and all agree on the Suva location, the July–August 2026 window and the several days of access.
Related context cited by the sources
The sources place the disclosure among other recent China-linked cases, none of which they connect to the Suva intrusion: Reuters reported that the cybersecurity company Proofpoint said this month that Chinese hackers have been impersonating AI experts to steal passwords from think tanks, universities and law firms since at least 2025, and that the US Department of Justice seized seven internet domains used to scan and hack critical infrastructure; The Next Web reported a June case in which a China-linked botnet took over 1,500 routers and devices, and said the embassy’s statement also announced that the United States and Palau will co-chair a new meeting of Pacific police ministers covering cybercrime, maritime security, drug trafficking and illegal finance. For readers in Fiji, the warning lands in a run of US actions here touching on China: Washington has already barred a Suva hotelier over alleged corruption links to China, and Suva has asked Washington for the evidence behind the Zhao Fugang sanctions.
Frequently Asked Questions
When did the US Embassy make the disclosure public?
Reuters, published via Yahoo, reported that the embassy made the statement on Monday. The Fiji Times carried the embassy’s statement in a report dated 13 October 2026.
Which countries does the US Embassy in Suva cover?
Reuters reported that the embassy’s remit extends beyond Fiji to Kiribati, Nauru and Tuvalu. The embassy did not say whether entities in those three countries were affected by the intrusion it disclosed.
Is there any suggestion Fijian government systems were breached?
No. None of the three source reports alleges that Fijian government systems were themselves accessed; the embassy described a suspected compromise of a regional organisation’s network.
Have the embassy’s specific security recommendations been published?
No. The embassy said it provided technical recommendations, but neither the Fiji Times nor Reuters lists them, and no source publishes the measures.
