On 30 June 2022 a seller using the name ChinaDan offered around 23 terabytes of data from the Shanghai National Police database on a criminal forum, asking ten bitcoin — reported at the time as roughly $200,000. Reported contents cover more than one billion residents: names, addresses, birthplaces, national identity card numbers, telephone numbers, photographs and information on criminal cases.
The reported cause is that a dashboard sitting in front of the database was never password-protected and was reachable from the public internet for over a year. Chinese authorities did not publicly confirm the breach.
The Largest Population In This Corpus, By Far
The next largest affected populations this database holds are in the tens of millions. This one is claimed at a billion, and the claim was substantiated to the satisfaction of multiple researchers who examined the samples.
The price is the part worth sitting with. Ten bitcoin across a billion people is a fraction of a cent each. We have argued at 25-1031 and 26-0726 that remedies are poorly matched to harm; here there is no remedy, no notification regime that applies, and a market price that says what this material is worth in bulk.
Nothing Was Exploited
The reported mechanism is an administrative interface without a password, exposed to the internet. No vulnerability, no credential theft, no phishing.
We filed that category at 22-0922, where an unauthenticated API answered anyone who asked, and at 23-0808, where a spreadsheet was published with a tab nobody checked. It remains the single most consequential failure mode this database records, and it produces no artefact, no alert and no story until somebody sells the contents.
Criminal Case Records Are Not Customer Records
The reported inclusion of case information changes what this is. A police database describes people as complainants, suspects, witnesses and convicted persons, and the categorisation itself is the sensitive part.
We have recorded the same at 23-0217, where investigative records could not be disclosed to the people in them, and 23-0808, where a list of names was dangerous because of who wanted it. The affected population here cannot be notified, has no regulator to appeal to, and in many cases would face consequences for enquiring.
Compiled from contemporaneous reporting of the sale listing and of researchers who examined published samples, listed below. Every figure originates with a seller advertising their own material or with sample analysis, and the holder never publicly confirmed the breach, which is why this file is graded medium despite the consistency of the reporting. This desk has not accessed any of the data. No individual is named and no sample is reproduced or described beyond category. Corrections: corrections@forensicpost.com.