Security alert after the sale of stolen Chinese data

After a hacker offered to steal data from one billion Chinese citizens, President Xi Jinping urged the public to "defend information safety.

Security alert after the sale of stolen Chinese data

After a hacker offered to steal data from one billion Chinese citizens, President Xi Jinping urged the public to "defend information safety."

An advert posted on a criminal forum was later removed. The user claimed that the data had been stolen from Shanghai National Police.

According to the hacker, the data includes names, addresses and National ID numbers as well as mobile phone numbers.

Cyber-security experts have confirmed that at most a small portion of the data provided is true.

23 Terabytes of data was thought to be the largest data sale ever recorded and was being offered at $200,000 (PS166,000) before it was removed Friday.

The news was not reported by any Chinese officials, and President Xi didn't directly mention the data sale.

According to the South China Morning Post the president asked Chinese public agencies to "defend Information Security... to protect personal, privacy, and confidential corporate information" in order to make sure people feel safe when they submit data to public services.

Friday saw ChinaDan, a user, post a notice that read: "Dear Chinese users. Welcome to our forum. Most likely, you came to this forum because of the Shanghai police data leak. This data has been removed from the internet and all posts related to it have been deleted.

Website administrators added that they also have high-quality databases similar to those in China for sale.

DarkTracer, which monitors cybercriminal activity, reports that another hacker, perhaps inspired by ChinaDan's publicity, posted an ad on Tuesday for 90,000,000 Chinese citizen records. The hacker claims to have stolen Henan National Police from HNGA. None of this data has been verified.

Toby Lewis, global head for threat analysis at Darktrace, stated that it is not clear why the data was withdrawn.

"The original offer suggests that the hacker wanted to sell data to multiple buyers without exclusivity rather than one.

"So, one theory is that exclusivity could be bought for a high enough amount of money. This could have been possible to have been purchased by the Chinese government."

Lewis believes that the leakage of information could have been a concern for Chinese authorities, who reportedly stopped discussions on the sale via Chinese social media networks within a few hours.

Forensic Pathways CEO Deb Leary also believes that the data was sold to a high-bidder. However, she adds, "It's intriguing, and not surprising, that the hacker forums used the incident to promote themselves as the best place to steal data."

"They don’t seem to be concerned about irritating the Chinese authorities."

A popular hacking site called Raid Forums was taken and shut down by an international operation of police led by the FBI in April.

The site's Portuguese founder and a British man who was based in Croydon were both arrested.

Hackers can use large data sets, such as the Chinese cache, to send impersonation email and other malicious attacks to trick people to hand over cash to criminals.

However, it is possible that the data may have vanished and it will be impossible to verify.

Another possibility is that data and ChinaDan were faked by website administrators.

Louise Ferrett is a Threat Analyst at Searchlight Security and believes that the data may be authentic.

There are signs that the data being sold was genuine. She stated that security teams have reported the source of data as human error by a government developer.

"Secondly, multiple sources confirmed that the sample data provided by ChinaDan was genuine.

"This does not necessarily mean that the whole database is real, but these two elements together make it more probable," stated Mrs Ferrett.