Alibaba Victim of Huge Data Leak as China Tightens SecurityAlibaba Victim of Huge Data Leak as China Tightens Security

In June 2021, reports by The Wall Street Journal and Bloomberg revealed that Alibaba's Taobao, China's largest online shopping site, had been the target of a months-long data harvesting operation. A software developer employed by a marketing consultancy that served Taobao merchants built a crawler that collected user data from the platform starting in late 2019, amassing more than a billion individual data points.

The scraped information included Taobao user IDs, nicknames, mobile phone numbers and comments posted on the platform. The data was reportedly used to help merchants target customers through the consultancy's services, including by adding users to messaging groups. The operation continued for about eight months before Alibaba detected it and reported it to police.

A court in Henan province convicted the developer and his employer of illegally obtaining personal information, sentencing them to more than three years in prison and imposing fines totaling about 450,000 yuan, or roughly $70,000. Alibaba said it had discovered the scraping itself, that the data had not been sold to third parties, and that it had strengthened its anti-scraping controls. The company stressed that none of its systems had been hacked.

The case surfaced as Beijing was moving to rein in the country's big technology platforms and lay down strict rules on data handling. China passed its Data Security Law that month and its Personal Information Protection Law later in 2021, both of which increased platform responsibility for the information users generate. Alibaba was separately under regulatory pressure, having been hit with a record antitrust fine earlier that year.

The Taobao scrape is a prominent example of a data exposure that does not involve breaking into servers. Publicly accessible pages, harvested at industrial scale, can be linked with phone numbers to create profiles useful for spam, fraud and targeted marketing. For platforms, the lesson is that rate limiting, bot detection and restrictions on what data is visible matter as much as perimeter security. Taobao and its sister site Tmall serve hundreds of millions of shoppers, which gave the scraped profiles real commercial value to merchants seeking to reach customers directly. Scraping has since become a recurring enforcement priority for Chinese regulators and courts.