The Shanghai National Police (SHGA) has its database of more than one billion people seized by a hacker.
" [...] This database contains many TB of data and information on Billions of Chinese citizen," the post said, posted by an anonymous user, who goes by the name ChinaDan.
It was later realized that the person managed to steal the database because the database has been left online, unsecured, for months.
Two cybersecurity researchers who first realized this, had separately verified that the anonymous user’s claims that the database included over 23 terabytes of data. While they did not rule out the possibility of duplicate entries, one of the two researchers, Vinny Troia, founder of Shadowbyte, confirmed that one of the leaked files appeared to contain nearly 970 million records.
According to him, the leak was first found on Leak IX, an online platform that trawls the internet for exposed databases, and said that the server was accessible as early as April 2021.
The other security researcher, Bob Diachenko, owner of SecurityDiscovery.com, a cybersecurity consultancy, said that the Shanghai data had been stored securely on a closed-off network.
Binance CEO Zhao Changpeng added that the database was secure, until someone was writing a blog on CSDN (China’s Software Developer Network), but messed up when the writing included login credentials to the database.
Troia said that he had first come across the unsecured trove of files in December or January, and said that it stood out due to its massive size.
Troia said that he had downloaded the database and reviewed a small sample of it at the time.
As for Diachenko, he and his team determined the the database was accessible until June, just when someone copied and destroyed the data, and left a ransom note demanding 10 Bitcoins.
The New York Times that was given a sample of the records from the ChinaDan, managed to prove the authenticity of the data.
In addition to names, date of birth, addresses, national ID numbers, mobile phone numbers, and medical records, the leaked data also included police reports, as well as information on "key persons" identified by the police as requiring heightened surveillance.
In one case, for example, a man was reported to the police for raping his 3-year-old granddaughter. In another, a person was investigated for petitioning on Tiananmen Square in Beijing. Then, there is the data of one man, who had a record of a complaint to the police that his daughter had been raped by her employer.
Others include records about various complaints and criminal allegations, from serious to petty crimes, detailing reports from credit card fraud, internet scams and gambling, which is illegal in China.
There were also records about police reports cracking down on the use of VPNs, or virtual private networks, which citizens use to access websites blocked by China's censorship.
The sample the agency had also included the names and passport numbers of American citizens who violated the terms of their visas while visiting China.
Some also contain information on children, based on their dates of birth and ages listed in the data.
Nine people who were contacted by the agency by telephone confirmed their names and details, and none of them said they had previously heard about the data leak.
While large data leaks are not uncommon, the Chinese government holds data that stands out both for its scale and its sensitive nature.
What's more, it also exposes the privacy risks of the Chinese government’s vast surveillance and security apparatus.
It's already publicly known that the authorities in China collect massive amounts of data from Chinese citizens by tracking their movements, scouring their social media posts and recording their DNA and biometric data.
And this incident alone is regarded as one of the largest data breach in China, and also in the world.
With the data falling to the wrong hands, the leaked Shanghai database could put the individuals whose data was exposed at risk of extortion, blackmail or fraud.
"The more complete profile you have of a person, the more dangerous it is," explained Diachenko.
"The possibilities are endless."
The Chinese government initially refused to comment about the incident. The Cybersecurity Administration of China for example, did not respond for comment. Shanghai’s public security bureau declined also kept silent.
Chinese citizens have been expressing growing demands for personal privacy and data protections, this leak could have fueled public resistance, if the government had not swiftly censored and removed mentions of them from the Chinese internet and Chinese social media platforms.
The Chinese government, despite remaining quiet, does show activities that suggest they acknowledge the fact.
For example, hashtags like "Shanghai data leak," "data leak of one billion citizens" and "data leak" have been blocked on Sina Weibo, a popular Chinese microblogging service.
Shortly after the Shanghai database was advertised, another anonymous user posted in an online forum offering to sell a separate police database from the central Chinese province of Henan, claiming to have information on 90 million citizens.
This incident happened at a time when China is stepping up protection for personal data.
Back in September 2021, China passed the Personal Information Protection Law, its first comprehensive privacy and data protection legislation, seen widely as China’s equivalent of Europe’s GDPR privacy rules.
The law restricts how businesses can collect personal data, but somehow allows some government agencies and departments that make up China’s vast surveillance capabilities.
