The Great Hack of China refers to the 2022 Shanghai police database leak, where hacker ChinaDan claimed to have accessed around 23 terabytes of data linked to up to one billion Chinese citizens. The leaked information reportedly included names, national ID numbers, phone numbers, addresses, and police records. The incident became one of the largest reported data breaches, highlighting risks from exposed databases, weak security controls, and large-scale identity theft.
The hack on the Shanghai Police database is reportedly one of the largest data breaches in history, with the data of more than 1 billion Chinese citizens now in the wrong hands.
This is a stark reminder of the need for cybersecurity defenses that are proactive, intelligent and holistic.
Read the full article and see what our CEO @Camellia Chan had to say about this alarming incident...
What Happened: Breaking Down the China Data Breach
The incident first surfaced in June 2022, when a threat actor known as ChinaDan claimed to have extracted 23 terabytes of data from a Shanghai police database. The dataset allegedly contained:
- Full names
- National ID numbers
- Phone numbers
- Addresses
- Police case records
The hacker offered the entire dataset for 10 Bitcoin, making it one of the most serious data exposure claims ever recorded.
What made this breach alarming was not just the scale, but the depth of sensitive data. Unlike typical leaks, this dataset combined identity data with law enforcement records, which significantly increases risk.
Was It Really 1 Billion Records? The Truth Behind the Numbers
Later investigations by cybersecurity researchers revealed a more realistic picture. The dataset had around 960 million rows. After removing duplicates, only about 104 million unique identities remained. Many entries were repeated or incomplete.
This does not reduce the seriousness of the breach. Instead, it highlights a deeper issue.
Poor data management and excessive data collection can amplify risk even further.
Even with duplication, this remains one of the largest structured identity datasets ever exposed.
Root Cause: Not a Hack, But a Security Failure
Contrary to early claims, this was likely not a highly advanced cyberattack.
The real issue came from:
- An exposed Elasticsearch database
- No authentication protection
- Public access for an extended period
- Credentials accidentally shared in a developer blog
This is a clear example of how misconfiguration leads to exposure, and exposure leads to exploitation.
Why This Breach Is More Dangerous Than Others
This breach is not just about leaked data. It changes how cyber risk works at scale.
Chinese national ID numbers contain key personal details such as date of birth, location, and gender. This allows attackers to reconstruct full identity profiles.
The inclusion of police records adds another layer of risk. It opens the door to targeted fraud, blackmail, and profiling.
Large datasets also enable automated attacks. Attackers can run credential stuffing campaigns and use AI tools to test login combinations across multiple platforms.
2025–2026 Update: Why This Story Is Still Relevant
This incident is not limited to 2022. The impact continues today.
In 2025, the dataset reappeared on underground forums. Criminal groups reused it for fraud and identity-based attacks. This shows that once data is leaked, it continues to circulate.
In early 2026, a new leak exposed 8.7 billion Chinese records. This dataset included plain-text passwords, social media identifiers, and identity data.
This confirms a growing pattern. Data breaches are no longer isolated events. They are part of an ongoing ecosystem.
What This Means for Enterprises and Governments
This breach exposed several systemic weaknesses.
Large centralised databases create single points of failure. Without proper access control, they become easy targets.
The absence of real-time monitoring allowed the issue to go unnoticed for a long time.
Weak authentication practices increased exposure risk.
There was also no clear pathway for security researchers to report vulnerabilities safely.
The Cybersecurity Shift: From Reactive to Proactive
Cybersecurity is moving toward prevention rather than reaction.
Older approaches focused on protecting the perimeter. Modern strategies focus on securing every access point.
Zero trust models are replacing traditional systems.
Organisations are combining hardware and AI-based security to detect and stop threats earlier.
How X-PHY Addresses These Risks
At X-PHY, cybersecurity focuses on prevention, not just response.
Hardware-based security ensures protection at the device level. This reduces reliance on software alone.
AI-powered systems monitor behaviour and detect unusual activity in real time.
Data Loss Prevention controls how sensitive data moves within systems.
Endpoint security protects every device connected to the network.
Deepfake detection helps reduce identity-based threats, which are becoming more common in large data leaks.
Key Takeaways for Organisations
Organisations should avoid storing unnecessary data. Every piece of stored data increases risk.
Databases must always be protected with proper authentication.
Continuous monitoring is essential to detect issues early.
Security should include multiple layers, including hardware protection.
Preparation is key. Systems should be designed assuming that threats will occur.
Key Takeaways for Individuals
Use different passwords for every account.
Enable multi-factor authentication wherever possible.
Stay alert for unusual activity.
Avoid sharing sensitive personal information unnecessarily.
Final Thought: The Real Lesson Behind the China Hack
This was not just a data breach. It was a large-scale system failure.
It shows that even major infrastructures can fail due to simple mistakes.
The future of cybersecurity depends on reducing exposure, improving configuration, and building systems that assume threats are constant.
