A recently-stolen database holding personally identifiable information on a billion Chinese citizens had been sitting online, unprotected by any credentials (opens in new tab), and available for anyone who knew where to look, reports have claimed.
The Wall Street Journal has said an investigation is currently underway to determine the circumstances leading up to the breach. Allegedly, the Alibaba cloud platform used by the Shanghai police department was outdated in such a manner that even setting up a password (opens in new tab) for the database wasn’t an option.
These findings would be in line with what the media initially reported, when cybersecurity researchers pointed the finger at third-party cloud infrastructure partners such as Alibaba, Huawei, or Tencent.
Database for sale
The WSJ also stated that the representatives of the Chinese cloud giant were called in for talks with the investigators, including the company’s Vice President, Chen Xuesong. Both parties are yet to comment.
Unknown cybercriminals had sought to sell the huge database, which allegedly contained people’s names, government ID numbers, as well as phone numbers, on the dark web. Furthermore, the database held records of crimes reported to the police department, with some of the data even belonging to minors.
The criminals advertising the database were asking for 10 bitcoin, or roughly $200,000, in return for the data.
This type of data is in high demand among cybercriminals, as it allows them to engage in all kinds of fraudulent activities, from identity theft, to phishing, to payment fraud, and many, many more.
After news of the theft broke out, Alibaba disabled all access to the database, the publication added, further stating that its engineers started inspecting the related code, but could not conclusively say how the breach happened.
