The UK, US and EU have accused China of carrying out a major cyber-attack earlier this year.
The attack targeted Microsoft Exchange servers, affecting at least 30,000 organisations globally.
The UK said Chinese state-backed actors were responsible, while the EU said the attack came from “the territory of China”.
The Chinese Ministry of State Security (MSS) was also accused of wider espionage activity and a broader pattern of “reckless” behaviour.
China has previously denied allegations of hacking and says it opposes all forms of cyber-crime.
The unified call-out of Beijing signals the gravity with which this case has been taken. Western intelligence officials say aspects of this case are markedly more serious than anything they have seen before.
In a statement, the White House said it was “deeply concerned” that China had “fostered an intelligence enterprise that includes contract hackers who also conduct unsanctioned cyber-operations worldwide, including for their own personal profit”.
The EU, meanwhile, said the hack had “resulted in security risks and significant economic loss for our government institutions and private companies”.
Its statement, like that of the UK, also said it had seen other Chinese behaviour that it was calling-out at the same time. It linked it to two groups known as APT 40 and APT 31 which are believed to be linked to the MSS.
Despite the strong statements, there are no signs of sanctions against China. In contrast, new sanctions were placed on Russia for the recent SolarWinds campaign which many experts believe was less serious than the Microsoft Exchange campaign linked to China.
Microsoft announced details of the hack back in March, and said a China-linked group called Hafnium was responsible. China denied those accusations.
The widespread use of Microsoft Exchange left many businesses and organisations vulnerable, with a huge effort to try to mitigate the potential risks.
