Hacker Claims to Have Data on 1 Billion Chinese Citizens From Police Files

Chinese paramilitary policemen watch as people visit a promenade on the Bund along the Huangpu River in Shanghai on May 1, 2021. (Hector Retamal/AFP via Getty Images)

A trove of data of more than 1 billion Chinese residents, allegedly hacked from the Shanghai police database, has been listed for sale on the dark web. If verified, it could amount to the biggest data leak in the country’s history.

“In 2022, the Shanghai National Police (SHGA) database was leaked,” reads a post dated June 30 on Breach Forums, a popular hacker community. “Databases contain information on 1 billion Chinese national residents and several billion case records, including name, address, birthplace, national ID number, mobile number, all crime/case details.”

An anonymous hacker or group claiming to be behind the attack wrote the post under the name of “ChinaDan” and offered to sell the database for 10 bitcoins, or roughly $200,000.

The Epoch Times was unable to reach the individual or group claiming the attack, ChinaDan, or confirm the post’s authenticity.

Sample Data

The hacker or group provided a sample of the more than 23-terabyte (TB) database, which is claimed to contain 750,000 records in three separate assets.

One set includes personal information, such as individual names, ethnicities, genders, heights, phone numbers, addresses, education backgrounds, and in some cases, photo links and labels of “key person” by the public security bureau. The addresses listed in the sample were from across the country, ranging from the far-western Xinjiang region to eastern Jiangsu Province.

Another data dump contains case records that appeared to be reported to the police, including personal information, case descriptions, and filing dates. The latest was dated 2019.

A third data set contained phone numbers and addresses, which were labeled for delivery.

A Chinese traffic policeman walks past the installed facial recognition screen at a road intersection in Shanghai on Aug. 9, 2017. (Chandan Khanna/AFP via Getty Images)

A Shanghai municipal government official directed The Epoch Times to the city’s police bureau, while the latter declined to comment on the database report.

Censorship

While Chinese authorities remain silent over the reported database hack, the alleged data leak sparked a wide discussion over the weekend on Weibo and WeChat, the country’s popular social media platforms.

By July 3, several related hashtags, such as “data leak,” had already been blocked by the microblogging platform Weibo. The Quora-like Zhihu also appeared to censor the news: A post detailing the alleged data leak wasn’t accessible on July 5.

But Chinese netizens continued to share news on it with vague references, such as a data leak in “an eastern Chinese city,” on July 5. Many warned about a potential wave of phone fraud if it’s real, while some worried about their privacy, saying authorities had stepped up information collection in the name of COVID-19 precautions.

A police officer checks a delivery worker on a street in the Xuhui district of Shanghai on May 29, 2022. (Hector Retamal/AFP via Getty Images)

The purported data leak also prompted discussions among cybersecurity experts.

Zhao Changpeng, CEO of cryptocurrency exchange Binance, said the company detected 1 billion resident records from “one Asian country” being sold on the dark web, without naming the country, according to a July 4 post on Twitter.

Kendra Schaefer, head of tech policy research at Beijing-based consultancy Trivium China, said on July 4 that it could be among the “biggest and worst breaches in history” if it’s confirmed to be leaked from the Ministry of Public Security.

Luo Ya contributed to the report.