Shanghai National Police database leak

In early July 2022, an anonymous user calling themselves "ChinaDan" advertised on the Breach Forums marketplace a 23-terabyte trove of personal records on roughly one billion Chinese residents, drawn from a Shanghai National Police database. The asking price was 10 bitcoin — about $200,000 at the time. If genuine in full, it ranks among the largest data breaches ever recorded and the biggest known leak of a Chinese government system.

What happened

The data is believed to have originated from the Shanghai Public Security Bureau, hosted on a private cloud. Security researchers reported that the underlying database — built on an Elasticsearch cluster fronted by a management dashboard — had been left accessible on the open internet without a password for over a year. The credentials and access path were reportedly exposed in a technical blog post, allowing anyone who found it to query and download the contents.

The seller published a sample of 750,000 records as proof. Journalists at Reuters, the BBC and the Wall Street Journal independently called individuals listed in the sample and confirmed that names, identity numbers and case details matched real people.

Impact

The leaked fields reportedly included:

• Full names, national resident ID-card numbers, birthplaces and addresses
• Mobile phone numbers
• Police case records and complaint reports, including incident summaries naming victims and suspects

Because the data combined civil-registry information with sensitive police case files, the exposure carried unusual risk: it could enable identity theft, fraud and the targeting of crime victims, informants and dissidents.

Response

Chinese authorities never publicly acknowledged the breach. Instead, regulators moved to suppress discussion: hashtags including "#dataleak" and "#databreach" were blocked on Weibo, and related posts were deleted on WeChat. No official investigation findings, prosecutions or notifications to affected citizens were disclosed.

The incident landed at an awkward moment, just months after China's Personal Information Protection Law (PIPL) and Data Security Law took effect with promises of stronger privacy safeguards — laws that bind companies far more tightly than the state's own security organs.

Why it matters

The Shanghai leak is the defining example of state-held bulk data exposed by basic misconfiguration. A single unsecured database undid the privacy of a substantial share of the world's most populous country, demonstrating that mass surveillance archives are themselves high-value single points of failure. The official silence also highlighted a structural gap: China's privacy regime polices private firms aggressively while offering citizens little recourse when the government's own systems leak.