24×7

Hacker offers to sell Chinese police information in significant potential breach

A hacker has offered to sell a Shanghai police database that may contain information on as many as 1 billion Chinese residents in what may be one of the biggest documented breaches of personal data involving Chinese nationals.

The hacker, who goes by ChinaDan, said last week in an online forum that the database for sale had terabytes of data on 1 billion Chinese people. It was impossible to determine how big the leak was. Parts of a sample of 750,000 records that the hacker released to demonstrate the veracity of the data were corroborated by The New York Times.

The hacker, who just last month joined the internet forum, is asking 10 bitcoin, or roughly $200,000, for the data. The person or group didn’t go into specifics about how the data was collected. The Times attempted to contact the hacker by email on the post, but it was unable because the address appeared to be insufficient.

The hacker’s offer of the database for the Shanghai police reveals a contradiction in China: Although the nation was at the forefront of gathering vast amounts of data on its residents, it has struggled to secure and protect that data.

Authorities in China have mastered the art of gathering digital and biological data on people’s habits and social relationships over time. They analyze social media posts, gather biometric information, follow phones, record video using police cameras, and go over the footage they gather to look for trends and anomalies. According to a Times investigation published last month, Chinese authorities have become increasingly interested in the personal information of everyday residents.

Beijing’s hunger for monitoring has increased, yet officials seem to have left the ensuing databases unprotected with just minimal security, or they appear to have left them available to the public. The Times has examined other databases used by Chinese police in recent years.