Researchers uncover 8.7 billion Chinese data records exposed online

Wednesday 04 - 09:20

By: Dakir Madiha

Researchers uncover 8.7 billion Chinese data records exposed online

Cybersecurity researchers have exposed one of history's largest data breaches, discovering 8.73 billion unprotected Chinese records in a publicly accessible Elasticsearch database. This trove of sensitive information remained open to the internet for over three weeks until shutdown on January 26, posing what experts call a systemic privacy risk to potentially hundreds of millions of people.

Bob Diachenko, cybersecurity researcher and Cybernews contributor, found the exposed cluster on January 1, 2026. It held 163 distinct indexes with citizens' national ID numbers, personal addresses, mobile phone numbers, plaintext passwords, email addresses, and social media identifiers.

The exposed data's structure points to deliberate curation, not accidental misconfiguration. Researchers noted highly organized, segmented clusters with thematic indexes for phones, IDs, and accounts. "The infrastructure was hosted by a bulletproof hosting provider, commonly linked to high-risk or non-compliant data operations," Cybernews stated. Metadata showed imports as recent as late 2025, suggesting ongoing aggregation rather than a one-off historical breach. No banners, organization names, or ownership claims appeared.

Those affected face severe risks. Plaintext and weakly protected passwords enable credential stuffing attacks, where criminals reuse stolen logins across accounts. Exposed national IDs, embedding birthplaces, dates, and genders, heighten identity theft dangers and access to government services. "Despite the brief exposure window, the dataset's scale means automated scraping could have led to widespread secondary distribution," researchers warned.

This incident fits a pattern of massive Chinese data exposures. Cybernews found a 631-gigabyte database in May 2025 with over 4 billion records including WeChat and Alipay payment info. Shanghai police data from 2022 reportedly covered one billion citizens. "This exposure shows how large-scale personal data aggregation can persist beyond regulatory oversight in permissive hosting environments," the research team concluded.