Gigantic civilian data leak if confirmed: A hacker is selling an alleged Shanghai police data leak containing 1 billion Chinese nationals’ names, home addresses, ID #, phone #, criminal records, etc. Hacker says it’s from an Aliyun (Alibaba) private cloud server.
CNN reports that the data has been online for more than a year: a backdoor link to the database was indexed by a search engine in April 2021. @vinnytroia detected the database in January 2022. In April 2022 @MayhemDayOne detected the database. In a later scan, mid-June, he found the data gone. Instead, there were ransom notes asking for 10BTC. The police solved the ransom problem, but the access was still possible. On 2022-06-29 someone on a hacker forum offered to sell 23.88TB of data for 1 billion Chinese residents for 10BTC. LeakIX traced the exposure to an unprotected Kibana 5.5.3 instance on Alibaba Cloud, a legacy version without authentication out of the box; Alibaba pulled those servers on 1 July. The WSJ found the police database left open online for over a year, and while the scale is still unconfirmed, five people it reached confirmed the case details listed next to their names. The Chinese government has yet to publicly acknowledge the breach.