Data leak exposes China's vast surveillance stateData leak exposes China's vast surveillance state

In late June 2022, an anonymous user calling themselves ChinaDan posted on a hacker forum offering what they said was a Shanghai police database containing records on one billion Chinese residents, priced at 10 bitcoin, then roughly $200,000. The seller claimed the trove totaled more than 23 terabytes and included names, addresses, birthplaces, national ID numbers, phone numbers and billions of police case records.

Security researchers soon found the likely source. The data had been stored on infrastructure hosted by Alibaba Cloud and was accessible through a Kibana dashboard that required no password. Researchers said it appeared to have been exposed since around April 2021, meaning anyone who found it could have downloaded it. Samples reviewed by journalists at CNN, The Wall Street Journal, The New York Times and TechCrunch were verified in part by contacting people named in the records.

The case files went far beyond basic identity data. They described incidents reported to police from the late 1990s through 2019, ranging from minor disputes to fraud and domestic violence, and some entries reflected surveillance of political activity, such as a note about a citizen who used a VPN to reach Twitter. If the numbers were accurate, the leak would cover roughly 70 percent of China's population and rank among the largest data exposures ever. The exposed server reportedly also held a large table of parcel delivery records with names, phone numbers and addresses, which analysts said could be combined with the police files to build detailed profiles.

Chinese authorities did not publicly acknowledge the leak. Discussion of it was censored on Weibo and WeChat, and reports said Shanghai officials summoned Alibaba executives over the incident. The exposure came as Beijing was tightening its own data security and personal information laws, which impose heavy obligations on private companies but give the state wide latitude over the data it collects.

The incident is a stark illustration of the risks of centralized state surveillance databases. Records compiled for policing and social control became available to criminals and foreign intelligence services through a basic cloud misconfiguration. For ordinary residents, there was no notification, no remedy and no way to learn whether their records were among those taken.