Hacker claims to have stolen 1 B records of Chinese citizens, demands 10 BTC

[btc_angela]

A supposedly hacker stated that he/ has stolen at least a billion of Chinese citizens record. The Shanghai National Police (SHGA) data was leaked with those information like: name, address, birthplace, national ID number, mobile number, all crime/case details.”

https://www.reuters.com/article/china-data-hack-idTRNIKBN2OF0I1

As for the veracity of the news, CZ has this to do say:



https://twitter.com/cz_binance/status/1543700689611792386

Just baffling though that the hackers is asking for just 10 BTC? Maybe he thinks that asking for me, the Chinese government or whoever agency is not going to pay him?

And let's say he did received his ransom, how can he hide it?

[1714318127]

1714318127

[1714318127]

1714318127

[1714318127]

1714318127

[1714318127]

1714318127

[1714318127]

1714318127

[1714318127]

1714318127

[bitmover]

A supposedly hacker stated that he/ has stolen at least a billion of Chinese citizens record. The Shanghai National Police (SHGA) data was leaked with those information like: name, address, birthplace, national ID number, mobile number, all crime/case details.”

This is the ultimate problem we face when sending our data online, to anyone (government or private companies).

Those companies might not be willing to sell your data. But they might get hacked and the hacker will sell our data in the deep web...

Just baffling though that the hackers is asking for just 10 BTC? Maybe he thinks that asking for me, the Chinese government or whoever agency is not going to pay him?

And let's say he did received his ransom, how can he hide it?

It is not a ransom.

He is selling the data to third party. The buyer will sell to other companies.
Many companies are interesting in buying this kind of data (name, profession, phone number, email, etc), so they can spam our email/phone advertising their products, and stuff like that.

A small company may be interested in selling a new type of financing for a specific group of people (a specific profession, for example), with high incomes and residents of a specific neighborhood. They can just buy this kind of data from this buyer and spam peoples email, phones, etc.

[Lucius]

The fact that someone is asking for a ransom in BTC is the least important in this case - because this is the problem of those who were supposed to protect personal data, and if this is true, they obviously failed.

In addition, although the article claims that it is about the data of Chinese residents, CZ claims that it is about an Asian country, so it is not entirely clear who exactly it is about. Also are the Chinese even allowed to trade on Binance considering CZ claims they are taking measures to protect their customers?

If nothing else, this is good PR for the company, at least judging by the comments I read from delighted users who expressed their satisfaction because they are safe

[dragonvslinux]

A supposedly hacker stated that he/ has stolen at least a billion of Chinese citizens record. The Shanghai National Police (SHGA) data was leaked with those information like: name, address, birthplace, national ID number, mobile number, all crime/case details.”

Just baffling though that the hackers is asking for just 10 BTC? Maybe he thinks that asking for me, the Chinese government or whoever agency is not going to pay him?

And let's say he did received his ransom, how can he hide it?

He is selling the data to third party. The buyer will sell to other companies.
Many companies are interesting in buying this kind of data (name, profession, phone number, email, etc), so they can spam our email/phone advertising their products, and stuff like that.

Only one third party you think? The buyer won't be the only one selling to others, they'll be selling numerous copies I imagine. Much more money in selling to 10 different third parties for 10 BTC, then trying to get 50 BTC from 1, probably a bit easier as well. Then buyers who bought for 10 BTC can try "launder the data" and quickly sell to 50 companies for 1 BTC.

There's so much money in data these days it's insane. If sold, which it probably will be if legit, it'll get repackaged and resold a hundred times over until it becomes public information.

[avikz]

Just baffling though that the hackers is asking for just 10 BTC? Maybe he thinks that asking for me, the Chinese government or whoever agency is not going to pay him?

And let's say he did received his ransom, how can he hide it?

Lol! It seems that the details of Chinese people has no value! Jokes apart, this is some nonsense ongoing and people with multiple apps on their phone, are more prone to such things. Especially beware from some apps that promises you to give you money on ad clicks. Probably that's how the hacker has done it but it's upto the investigation authorities to find it out.

If the hackers receives the ranson, he can simple push the coins through some mixers or from some coinjoin services to hide the trail. It's easy!

[tomahawk9]

did someone say a "hacker"??



no but seriously, it was ONE person who "accidentally" leaked his police network user/pw, someone saw it, grabbed the database and bailed... no hacking

I suppose CZ's team were able to match some of the database credentials [from the db sample provided by hackerman] to Binance db and after they confirmed binance users they told CZ to tweet something about the data leak (or maybe CZ is just being a good guy, idk)

And let's say he did received his ransom, how can he hide it?

that's the easiest part of this whole thing for hackerman. There are tons of reliable btc mixers

The anonymous internet user, identified as “ChinaDan”, posted on hacker forum Breach Forums last week offering to sell the more than 23 terabytes (TB) of data for 10 bitcoin, equivalent to about $200,000.

...

Reuters was unable to verify the authenticity of the post.

I have some doubt, unless there's news the seller share sample of hacked records.

hackerman ChinaDan actually shared a sample of 750k. You can go that forum and read the OP, all the info is there, even the link to the government agency

[Upgrade00]

These sort of reports or rumours only accentuates a problem which has been existing for quite a long time.

Data is on high demand globally, not just in the darkweb. Businesses, government, brokers, intelligence agencies, politicians etc. Everyone is trying to get their hands on as much data as possible.
Governments, especially dictatorial ones like China holding personal data of citizens does not instill confidence at all, and those data getting leaked to the dark web creates more problems.

Asking bitcoin from a country, that actually banned it.

No ransom was requested. The hacker is allegedly putting it up for sale in the darkweb.

[NeuroticFish]

I also expect some government also interested with this kind of data.

Some government agencies may have been already accessing them from whatever cloud services.

This is the ultimate problem we face when sending our data online, to anyone (government or private companies).

Exactly. The irony is in the fact that no matter how good we protect our KYC information, that also resides in govt databases. And who is the most careless in handling people's goods, including their data? Yep, the governments.

[LoyceMobile]

That makes 1 satoshi per person. Lol.

A supposedly hacker stated that he/ has stolen at least a billion of Chinese citizens record. The Shanghai National Police (SHGA) data was leaked with those information like: name, address, birthplace, national ID number, mobile number, all crime/case details.”

How convenient for the police to keep records on every citizen in one system.

[Falconer]

Just baffling though that the hackers is asking for just 10 BTC? Maybe he thinks that asking for me, the Chinese government or whoever agency is not going to pay him?

Imo, The hacker isn't asking for a ransom, but it looks like he wants to get 10 bitcoin by selling that data to whoever will. Cases like this just remind me of the poor choice of users to store their data online regardless of the platform, so it should be a lesson too even though it is a very common topic to discuss.

And let's say he did received his ransom, how can he hide it?

Hackers might know about mixers, so that's what made him ask for btc as payment, imo. Of course if he was smart enough to hide with her.

[Mr.right85]

A supposedly hacker stated that he/ has stolen at least a billion of Chinese citizens record. The Shanghai National Police (SHGA) data was leaked with those information like: name, address, birthplace, national ID number, mobile number, all crime/case details.”

This is the ultimate problem we face when sending our data online, to anyone (government or private companies).

Those companies might not be willing to sell your data. But they might get hacked and the hacker will sell our data in the deep web...

Just baffling though that the hackers is asking for just 10 BTC? Maybe he thinks that asking for me, the Chinese government or whoever agency is not going to pay him?

And let's say he did received his ransom, how can he hide it?

It is not a ransom.

He is selling the data to third party. The buyer will sell to other companies.
Many companies are interesting in buying this kind of data (name, profession, phone number, email, etc), so they can spam our email/phone advertising their products, and stuff like that.

A small company may be interested in selling a new type of financing for a specific group of people (a specific profession, for example), with high incomes and residents of a specific neighborhood. They can just buy this kind of data from this buyer and spam peoples email, phones, etc.

As disturbing as it is not to key in your privacy details, some policy formulations have made it so difficult to be so private. Like in my country, there are certain transactions and registrations you can’t go through with less you present some ID. Mostly bank related transactions and enrolling in some government spearheaded parastatals. Eventually, there could be leaks such as in this case and your compromised already.
What is more disturbing about this for those of us that aren’t Asians is the choice of payment being cryptocurrency as this would reflect negatively and the Chinese government is likely to react in ways that would spread FUD coupled with the fact that, we are in a bear market session. What should we be expecting I wonder!

[ChrisPop]

If he is smart about it he can get away with the ransom. He could use sophisticated Bitcoin mixing methods and/or sell his Bitcoin anonymously underground. I'm not sure how efficient are the mixing services. Governments can have access to powerful blockchain analysis tools.

I am deeply concerned about the ability of our governments and publc institutions to keep our data safe, not even talking about individual companies. I think there should be certain policies implemented to enforce companies to respect certain safety standards and constantly invest in upgrading their cybersecurity.

[abel1337]

In my own opinion, 10btc is small compared to the number of compromised data. The hacker can use mixing tools around the internet to launder all of that and spread it out to different addresses. I don't know if there's a analytic technology that can counter the mixing tool. There would be a change that the hacker would be caught before the Chinese government pay that hacker. The country where am I living experienced such situation that the registered voters information is leaked, Thankfully the hacker was caught before asking for any ransom or reward, we do have much smaller technology offerings compared to china that's why I think Chinese government will resolve this without paying the demand of the hacker. One awful thing that could possibly happen is if the hacker leaked the database to deepweb, It could greatly affects the victims and the government integrity.

[OgNasty]

Just baffling though that the hackers is asking for just 10 BTC? Maybe he thinks that asking for me, the Chinese government or whoever agency is not going to pay him?

I think it shows that the hacker is not a sophisticated attacker who planned to do this to get rich.  More likely it is someone living in a poor country that saw an opportunity and wants to get 10 BTC, which for them is likely a massive amount of life changing money. 

For me though, the real story here is the danger of KYC and how it can be used to compromise people's lives in ways that will have fallout for years.  At a time when the government is forcing people to KYC in order to spend their BTC on a burrito, this makes a pretty big statement about how they are putting legal users of BTC in jeopardy for their own control issues.  The hacker may only want 10 BTC, but let's be honest.  This data is out there and no amount of money will put the cat back in the bag.  10 BTC is also the tip of the iceberg for how much financial damage will be caused as a result of this thoughtless handling of user data.

[The Cryptovator]

No way to trust hackers, they will have a copy always and could sell dark Web. Paying hackers is now useless. Rather Police should fix the security issue of how hackers access the database. It's a shame how data has been stolen from the security department. The sad thing is hackers asking for BTC, haters will create another FUD against Bitcoin. Although 10 Bitcoin isn't a big amount, I don't think the government will agree to pay.

[Fortify]

A supposedly hacker stated that he/ has stolen at least a billion of Chinese citizens record. The Shanghai National Police (SHGA) data was leaked with those information like: name, address, birthplace, national ID number, mobile number, all crime/case details.”

https://www.reuters.com/article/china-data-hack-idTRNIKBN2OF0I1

As for the veracity of the news, CZ has this to do say:

Just baffling though that the hackers is asking for just 10 BTC? Maybe he thinks that asking for me, the Chinese government or whoever agency is not going to pay him?

And let's say he did received his ransom, how can he hide it?

He's not considering whether the Chinese government would be willing to pay him - they'd receive no benefit as he'd still have a copy of their data. They are likely looking for any other country who might want access to this data, if it exists, which might be very beneficial to certain intelligence agencies in piecing together information in future. To the average person or company, this information is mostly worthless anyway because it's very hard to make money out of this enclosed ecosystem. If it's real, this person likely has a target on their back from every Chinese police service and will be highly vulnerable to backlash if they are ever identified in future.

[Fivestar4everMVP]

The sad thing is hackers asking for BTC, haters will create another FUD against Bitcoin. Although 10 Bitcoin isn't a big amount, I don't think the government will agree to pay.

Exactly my thought while reading the op, those who have been FUDing against Bitcoin will definitely use this incident as another thing to base their Fud on, but my joy is that this is not the first, Bitcoin have survived every fud that came its way in the past since its inception, if this turns out to be a source of fud against bitcoin for some persons, Bitcoins will still continue to survive.

And for the hacker, I honestly don't think its a good idea if the government decides to pay the hacker 10 bitcoins, like you said, hackers can not be trusted, there is no guarantee anywhere that the hacker would hand over all the record to the government without keeping a copy, if the government goes ahead to pay for it, I think the government should rather look for a way to catch this hacker than succumbing to his or her demands.

[darkv0rt3x]

Funny is that a guy that implicetely helps those events comes out to tell the world that 1B chinese information might be leaked in the dark web. This is just another example of how important is the custody of your assets, their being Bitcoin, personal information, gold or any other. It is a fact that with custody comes responsability that many of us are not willing to cary. Commodity feels better. It's easier to let others to take on the opsec for our assests/goods!

[Oilacris]

Just baffling though that the hackers is asking for just 10 BTC? Maybe he thinks that asking for me, the Chinese government or whoever agency is not going to pay him?

And let's say he did received his ransom, how can he hide it?

For sure it would really be pertaining into its government which do really ask out 10 BTC in exchange with those leaked information.
Currently 10 BTC = $204,400  which i could say that not really that big i must say. Its not surprising about exploits and loopholes made
out by these hackers as long they could able to have those ransom or make money.

How they would received it out? Via their own wallet.. How he would hide it? We know that mixing and transferring funds
is something that could be done if you do really tend to lose your tracks.

[Hispo]

A supposedly hacker stated that he/ has stolen at least a billion of Chinese citizens record. The Shanghai National Police (SHGA) data was leaked with those information like: name, address, birthplace, national ID number, mobile number, all crime/case details.”
...
And let's say he did received his ransom, how can he hide it?

Perhaps the fact the hacker is asking for such relatively low price has to do with the fact that most of the data involves normal citizens and even though it is highly sensitive information, it has no inmediate effective use for rival intelligence agencies, but I dont know I am just a normal with no ties to agencies so I could be completely wrong.

Or maybe the hacker only wants to get a buyer as quick as possible before disappearing?

Also, it is interesting he/she  did not ask a coin like Monero as payment, keeping in mind she/he will likely be hunted down by Chinese authorities, one could have guessed opacity would have been a priority. This must be a Bitcoin maximalist hacker.