Zhao Hejuan, an investigative reporter at Caixin Media, found that her Gmail account had been logged into from IP address 220.170.192.25, which traced back to Longhui County in Hunan Province.

Zhao learned of the attacks July 21 after receiving a Gmail security alert. Caixin's IT department later uncovered evidence that the hacks into Zhao's account went as far back as July 19. Based on Gmail's IP history, the hackers had logged on to Zhao's Gmail account everyday since July 19. Zhao and Caixin's legal affairs consultant reported the incident to district police in Beijing on July 22.