This post was originally published on Security Affairs. It can be found here.

Over 4 billion user records were found exposed online in a massive breach, possibly linked to the surveillance of Chinese citizens.

Cybersecurity researcher Bob Dyachenko and the Cybernews team discovered a massive data leak in China that exposed billions of documents, including financial, WeChat, and Alipay data, likely affecting hundreds of millions. Researchers speculate data was collected to build detailed profiles of Chinese citizens, with little that users can do to protect their privacy.

The researchers discovered a massive 631GB unsecured database containing around 4 billion records, mainly involving Chinese users.

“The supermassive data leak likely exposed hundreds of millions of users, primarily from China, the Cybernews research team’s latest findings reveal.” reads the post published by CyberNews. “A humungous, 631 gigabytes-strong database was left without a password, publicizing mind-boggling 4 billion records.”

They suggest the scale and variety of the information point to a centralized system, possibly used for surveillance, profiling, or enriching existing data. The researchers warn that the potential implications are serious, threat actors could exploit such a massive trove to carry out phishing, attacks fraud, blackmail, or even state-backed intelligence and disinformation campaigns.

The researchers briefly accessed the massive leaked database before it was taken down, preventing identification of its owners. The data, likely compiled for profiling or surveillance, was divided into 16 collections. The largest, “wechatid_db,” held over 805 million records, while others included residential, financial, and ID data. In total, the leak exposed over 4 billion records, including Alipay, WeChat, and Taiwan-related information.

“The largest collection, with over 805 million records, was named “wechatid_db,” which most likely points to the data coming from the Baidu-owned super-app WeChat.” reads the post. “The second largest collection, “address_db,” had over 780 million records containing residential data with geographic identifiers. The third largest collection, simply named “bank,” had over 630 million records of financial data, including payment card numbers, dates of birth, names, and phone numbers. Possessing only these three collections would enable skilled attackers to correlate different data points to find out where certain users live and what their spending habits, debts, and savings are.”

The team couldn’t trace the leaked data to any organization, as no identifiers were found and the server was quickly taken offline. Affected individuals have no clear way to respond. While China has seen major leaks before, like those involving Weibo and DiDi, none match this in scale. With over 4 billion records exposed, this appears to be the largest known leak of Chinese personal data from a single source.

“we could not identify any data leak that surpasses four billion records. That would make this data leak the largest single-source leak of Chinese personal data ever identified.” concludes the post.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, 4 billion user records)

This post was originally published on this site