If verified, the purported theft of 23 terabytes of personal information on as many as a billion Chinese citizens from a Shanghai police database would rank as the country’s largest ever known data breach, if not one of the biggest leaks the world has seen. The allegations that emerged over the weekend have set tech circles buzzing and prompted rare public comment from high-profile industry figures such as Binance co-founder Zhao Changpeng.
“It is necessary to safeguard the country’s data security, protect personal information and business secrets, and promote the efficient circulation and use of data so as to empower the real economy,” Xi stressed in a meeting with a top government body less than two weeks ago, according to a readout from the official Xinhua News Agency.
Representatives for the city’s police and Cyberspace Administration of China, the country’s Internet overseer, also haven’t responded to faxed requests for comment. A Foreign Ministry spokesman said only that he was not aware of the report Monday, in an exchange that was left off the official transcript for the agency’s daily briefing.
Others argued it’s more likely a cloud service provider, which hosted backups or synchronisation for the police database, was somehow compromised. Alibaba Group Holding Ltd, Tencent Holdings Ltd and Huawei Technologies Co are among the country’s biggest external cloud services. Representatives for the three firms didn’t have immediate comment on the episode.
It’s common to see personal data offered for sale on Chinese cybercriminal forums but the “scale and amount of personal data being offered here is unheard-of”, said Budi Arief, who researches cybercrime at the University of Kent’s Institute for Cyber Security for Society.