In early July 2022, an unidentified hacker offered more than 23 terabytes of data allegedly taken from the Shanghai National Police Database for 10 bitcoins. The material reportedly contained names, addresses, birthplaces, Chinese resident ID numbers, phone numbers, photographs, and police case information concerning more than one billion people. Screenshots also showed reporting times, informants’ contact numbers, and reasons for police reports. Initial analysis indicated that the records covered residents across mainland China, not only Shanghai.
The database’s alleged origin was the Shanghai Municipal Public Security Bureau, but the source text says this was never officially confirmed. Cybersecurity researcher Vinny Troia claimed he discovered the exposed server more than a year before it was shut down. Chinese authorities did not publicly acknowledge the incident; Bloomberg News reported receiving no response from the Central Cyberspace Administration of China or Shanghai police. Discussion of the leak was reportedly censored on Weibo, intensifying concerns about inadequate breach disclosure and state control over information about police-held personal data.