Shanghai police database leak

Data breach affecting China

The Shanghai police database leak refers to the unauthorized disclosure of sensitive personal information and police case data from the Shanghai National Police Database, also known as the SHGA Database, in early July 2022. The leaked data, totaling over 23 terabytes, includes details of more than one billion Chinese residents, encompassing names, addresses, birthplaces, resident ID card numbers, phone numbers, photos, mobile phone numbers, and information on criminal cases. The data was made available for sale on the internet by an unidentified hacker, who demanded a price of 10 bitcoins.^[1]^[2]

The origin of the leaked information is believed to be the Shanghai Public Security Bureau, although this has not been officially confirmed. Screenshots shared online revealed a vast amount of intricate police information, such as the time of reporting criminals, the contact numbers of reporting individuals, and the reasons for reporting. Notably, initial analysis indicated that the personal data originated from residents all across mainland China, rather than being limited to Shanghai alone.^[3]^[4]

If the reported volume of data is accurate, the Shanghai police database leak would be regarded as the largest and most significant incident of its kind since 1949.^[5] The news of the leak faced censorship on the social platform Weibo in mainland China, potentially to impede its spread. The authorities have not yet acknowledged or publicly addressed the incident. Despite inquiries sent by Bloomberg to the Central Cyberspace Administration of China and the Shanghai Police Bureau, no responses have been received thus far. Bloomberg criticized the lack of transparency and disclosure surrounding data breaches in the People's Republic of China, citing previous incidents such as the leakage of personal information of Communist Party members in 2016, the Weibo account information leak in 2020, and the information leakage from Xinjiang re-education camps in 2022.^[3] Cybersecurity researcher Vinny Troia claimed he discovered the leak over a year before the server was eventually shut down.^[6]

Sources

^ Ni, Vincent (2022-07-04). "Hacker claims to have obtained data on 1 billion Chinese citizens". The Guardian. ISSN 0261-3077. Retrieved 2023-05-14.
^ "Hackers offer data on 1 billion Chinese after alleged leak". www.aljazeera.com. Retrieved 2023-05-14.
^ ^a ^b "Hackers Claim Theft of Police Info in China's Largest Data Leak". Bloomberg. 2022-07-04. Retrieved 2022-07-04.
^ "網傳上海公安系統遭駭 10億公民個資售20萬美元 | 兩岸 | 中央社 CNA". Central News Agency (in Chinese). 4 July 2022. Retrieved 2022-07-04.
^ "上海公安數據庫傳遭駭 10億陸民訊息20萬美元網上兜售". United Daily News (in Chinese). 2022-07-04. Retrieved 2022-07-04.
^ Hao, Karen (6 July 2022). "China Police Database Was Left Open Online for Over a Year, Enabling Leak". Wall Street Journal. Wall Street Journal. Retrieved 23 November 2022.

Hacking in the 2020s

← 2010s

Timeline

2030s →

Major incidents

2020	BlueLeaks Twitter account hijacking European Medicines Agency data breach Nintendo data leak United States federal government data breach EasyJet data breach Vastaamo data breach
2021	Microsoft Exchange Server breach Ivanti Pulse Connect Secure data breach Colonial Pipeline ransomware attack Health Service Executive ransomware attack Waikato District Health Board ransomware attack JBS S.A. ransomware attack Kaseya VSA ransomware attack Transnet ransomware attack Epik data breach FBI email hack National Rifle Association ransomware attack Banco de Oro hack
2022	Ukraine cyberattacks Red Cross data breach Anonymous and the Russian invasion of Ukraine Viasat hack DDoS attacks on Romania Costa Rican ransomware attack LastPass vault theft Shanghai police database leak Grand Theft Auto VI content leak
2023	Munster Technological University ransomware attack Evide data breach MOVEit data breach Insomniac Games data breach Polish railway cyberattack British Library cyberattack
2024	XZ Utils backdoor