diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index e59b4fa9..268d6f52 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -381,7 +381,7 @@
           "Private sector",
           "Government"
         ],
-        "cfr-type-of-incident": "China",
+        "cfr-type-of-incident": "Espionage",
         "country": "CN",
         "refs": [
           "http://www.crowdstrike.com/blog/whois-numbered-panda/",