Hacker Wants 10 Bitcoin for Stolen Data of 1 Billion Chinese Citizens

In what could be one of the biggest data breaches in history, a hacker who claims to have stolen the personal details of 1 billion Chinese citizens from a Shanghai police database is offering to sell the information for a mere 10 bitcoin – worth about US$200,000.

The anonymous hacker, identified only as “ChinaDan”, posted the following message on hacker site Breach Forums last week:

“In 2022, the Shanghai National Police (SHGA) database was leaked. This database contains many TB [terabytes] of data and information on billions of Chinese citizens. [These include] several billion case records including names, addresses, birthplaces, national ID numbers, mobile numbers, [plus] all crime/case details.”

‘CZ’ Corroborates Intelligence Threat

In a July 4 tweet, Binance CEO Changpeng ‘CZ’ Zhao said the exchange had stepped up its user-verification processes after Binance’s threat intelligence detected the sale of records belonging to “one billion residents of an Asian country” on the dark web:

CZ blamed the leak on “a bug in an Elastic search deployment by a [government] agency”, without specifically mentioning the Shanghai police case.

Implications for Greater Crypto Industry

Kenny Li, co-founder of Web3 privacy project Manta Network – in which Binance Labs is an investor – warned the breach might have widespread implications for the crypto industry:

The stolen data could be used to exploit users and do things like [launch] phishing attacks to steal keys or [gain] unauthorised access to applications like centralised exchanges.

Kenny Li, co-founder, Manta Network

The Shanghai Police data hack claim comes as China has vowed to tighten protection of online user data privacy, instructing its tech giants to ensure safer storage after multiple public complaints about mismanagement and misuse.

China has recorded a number of data leak incidents in recent years. In 2016, sensitive information about powerful Chinese individuals, including Alibaba founder Jack Ma, was posted on Twitter.

Ransomware War Continues

In November last year, US$6 million in crypto was seized from the REvil ransomware group, and three months later the US Federal Bureau of Intelligence announced the formation of a specific crypto crime division to tackle ongoing ransomware attacks.