The US State Department is offering a reward of up to $10 million for information related to Zhang Yu, a Chinese national charged in the United States in connection with the 2021 Microsoft Exchange Server attacks commonly referred to as HAFNIUM. While the announcement is primarily a law-enforcement development, it also brings renewed attention to one of the most significant enterprise email server compromises in recent years.

For European businesses, the story matters less because of the reward itself and more because it highlights a continuing operational risk: internet-facing business systems, especially email infrastructure, remain high-value targets when patching, monitoring or migration plans fall behind.

What happened

According to the source report, the US State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu. He has been charged in the US in relation to the 2021 Microsoft Exchange Server attacks known as HAFNIUM.

The source references reporting that cites an official notice. The reward announcement does not change the underlying technical facts of the 2021 incident, but it does place the case back in focus. The HAFNIUM attacks were widely associated with the exploitation of Microsoft Exchange Server vulnerabilities affecting on-premises email environments.

Why it matters for European businesses

Many organisations across Europe have moved parts of their communications stack to cloud services, but a significant number of businesses, public bodies and regulated organisations still rely on self-managed or hybrid email infrastructure. The HAFNIUM case is a reminder that email servers are not just communications tools; they are central systems containing sensitive business data, internal discussions, customer information and authentication links.

For SMEs, the practical lesson is straightforward: older or self-hosted systems can create disproportionate cyber risk if they are not patched quickly, monitored properly or retired on time. Attackers continue to target widely deployed software because one successful exploit path can affect thousands of organisations globally.

The case also matters from a governance perspective. European companies are under growing pressure to strengthen cyber resilience through better asset visibility, incident response planning and vendor risk management. For businesses affected by GDPR, NIS2-related obligations or sector-specific security expectations, weaknesses in core messaging infrastructure can create both operational disruption and compliance exposure.

Who may be affected

• SMEs running on-premises Microsoft Exchange
  Businesses that still host their own email environment may face higher patching and monitoring burdens than they can realistically support internally.
• Hybrid IT environments
  Companies using a mix of cloud and legacy on-site systems may have overlooked internet-facing components, old admin interfaces or unsupported dependencies.
• Regulated sectors
  Organisations handling personal data, contractual records or sensitive communications may face greater consequences if email systems are compromised.
• IT service providers and digital agencies
  Providers managing infrastructure for clients may need to review whether any customer environments still contain avoidable Exchange-related exposure.

What companies should consider

• Review whether any on-premises Exchange servers are still in use
  Confirm which versions are deployed, whether they are supported and whether they remain internet-accessible.
• Check patching and hardening status
  Make sure critical security updates have been applied and that unnecessary services, ports and external access paths are restricted.
• Audit for legacy exposure
  Look for forgotten test systems, backup mail servers, outdated web interfaces or abandoned admin accounts that may still be reachable.
• Strengthen monitoring
  Ensure logging, alerting and anomaly detection cover email infrastructure, privileged access and unusual outbound activity.
• Validate incident response readiness
  Companies should know how to isolate a messaging system, investigate compromise indicators and assess whether personal or confidential data may have been affected.
• Reassess long-term architecture
  If maintaining secure self-hosted email is becoming difficult, businesses may want to compare the operational and security trade-offs of managed or cloud-based alternatives.

The new US reward notice is not, by itself, a change in cyber policy for European companies. However, it is a useful reminder that high-profile infrastructure attacks often remain relevant years later because the same underlying weaknesses, delayed patching, exposed admin systems and aging business software, continue to appear across real-world organisations.