Hack: Allegedly stole billions of Shanghai police data

A person named ChinaDan offers on the Internet a dataset of 23 terabytes, which is supposed to contain personal data and originate from the Shanghai police. The authenticity of the data has not yet been verified.

Data from criminals?

According to ChinaDan, the dataset contains the names, addresses, cell phone numbers, places of birth, national ID numbers and other information of criminals from the Shanghai metropolis. The dataset has been for sale on the breached.to platform since late June. The alleged hacker ChinaDan is asking ten bitcoins for the data. China is considered a surveillance state and collects almost all available data of its inhabitants. Large-scale video surveillance in public spaces, personalized access codes to important Internet platforms, random checks, punishment camps where minorities are indoctrinated, etc. generate a whole lot of data. In principle, therefore, it seems plausible that the Shanghai police have such a massive trove of data at their disposal – especially given the very lax labeling as criminal in the Chinese dictatorship.

Access via Elasticsearch

Bleepingcomputer reports that Binance’s CEO confirmed that the security vulnerabilities claimed by ChinaDan existed. He further said “the leak is likely due to an ElasticSearch database that a Chinese government agency accidentally posted online.” As expected, Shanghai police have not commented on the incident. Whether it is known in China is unknown. In any case, it is remarkable that the data is offered in Clearnet and with a visible contact address.
It has been known for a long time that open Elasticsearch databases are a gateway for hacks. For example, a terror watchlist of the FBI became public via such a gap.