A hacker claiming to have stolen personal data from hundreds of millions of Chinese citizens is now selling the information online.

A sample of 750,000 entries posted online by the hacker showed citizens' names, mobile phone numbers, national ID numbers, addresses, birthdays and police reports they had filed.

AFP and cybersecurity experts have verified some of the citizen data in the sample as authentic, but the scope of the entire database is hard to determine.

Advertised on a forum late last month but only picked up by cybersecurity experts this week, the 23-terabyte database -- which the hacker claims contains the records of a billion Chinese citizens -- is being sold for 10 bitcoin (approximately $200,000).

"It looks like it's from multiple sources. Some are facial recognition systems, others appear to be census data," said Robert Potter, co-founder of cybersecurity firm Internet 2.0.

"There is no verification of the total number of records and I'm sceptical of the one billion citizens number," he added.

China maintains an extensive nationwide surveillance infrastructure that siphons massive amounts of data from its citizens, ostensibly for security purposes.

Growing public awareness of data privacy has led to stronger data protection laws targeting individuals and private firms in recent years, although there is little citizens can do to stop the state from collecting their data.

Some of the leaked data appeared to be from express delivery user records, while other entries contained summaries of incidents reported to police in Shanghai over a span of more than a decade, with the most recent from 2019.

The incident reports ranged from traffic accidents and petty theft to rape and domestic violence.

- 'Heads will roll' -

At least four people out of over a dozen contacted by AFP confirmed their personal details, such as names and addresses, as listed in the database.

"So that's why so many people have been adding my WeChat over the past few days. Should I report this to the police?" said one woman surnamed Hao.

"I'm really confused about why my personal data has been leaked," said another woman surnamed Liu.

In replies to the original post, users speculated that the data may have been hacked from an Alibaba Cloud server where it was apparently being stored by the Shanghai police.

Potter, the cybersecurity analyst, confirmed that the files were hacked from Alibaba Cloud, which did not respond to an AFP request for comment.

If confirmed, the breach would be one of the largest in history and a major violation of the recently approved Chinese data protection laws.

"Heads will roll over this one," tweeted Kendra Schaefer, tech partner at research consultancy Trivium China.

China's cybersecurity administration did not respond to a fax requesting comment.

lxc-bur/oho/smw

Alibaba

Related Links
Cyberwar - Internet Security News - Systems and Policy Issues

Tweet

Thanks for being here; We need your help. The SpaceDaily news network continues to grow but revenues have never been harder to maintain. With the rise of Ad Blockers, and Facebook - our traditional revenue sources via quality network advertising continues to decline. And unlike so many other news sites, we don't have a paywall - with those annoying usernames and passwords. Our news coverage takes time and effort to publish 365 days a year. If you find our news sites informative and useful then please consider becoming a regular supporter or for now make a one off contribution.
SpaceDaily Contributor $5 Billed Once credit card or paypal		SpaceDaily Monthly Supporter $5 Billed Monthly paypal only

UK probes hacking of army's Twitter, YouTube accounts
London (AFP) July 3, 2022
British officials have launched an investigation after hackers took control of the armed forces Twitter and YouTube accounts, the ministry of defence announced Sunday. "We are aware of a breach of the Army's Twitter and YouTube accounts and an investigation is underway," said a ministry statement. "Apologies for the temporary interruption to our feed. We will conduct a full investigation and learn from this incident. "Thanks for following us and normal service will now resume." So long a ... read more