Israeli cybersecurity team, Cybersixgill, is investigating a massive ransom on Chinese information and believes they found links to a similar event happening last year.
Earlier in August, Cybersixgill found that underground hacker forums suddenly became very active. Multiple criminals began posting ransoms for Chinese government data, including over a full terabyte of data that supposedly contained classified secrets of China’s mysterious Ministry of State.
This most recent information for sale was around $235,000 USD — to prove his point, the hacker released the information of 750,000 Chinese citizens, claiming to have information on 500+ million.
While researchers haven’t found any evidence of any strictly classified data, quite a bit of civilian personal data has been put up for sale. This information includes full names, addresses, phone numbers, email addresses, criminal records, national IDs dates of birth, and more. While this information is still dangerous, nothing proves that it was classified information.
With this level of information, hackers could launch social engineering scams or phishing scams, commit identify fraud by posing as them, attempt to brute-force their way into finding your financial information, and a lot worse.
Cybersixgill was left to piece strings together in hopes of learning more about the hackers. Essentially, they found that one actor used the same signature while selling information on Chinese citizens and government agencies through forums. The tactics used for these two attacks closely emulate another attack carried out last year.
These previous attacks involved exposing the networks that were compromised by the Shanghai National Police (SHGA) and revealing China’s ethnic persecution of the Uyghur people — the news of both revelations rippled around the world when they were discovered.
While China’s Ministry of State still touts its cybersecurity practices, the recent hacks of government data may have exposed the information of 500+ million Chinese citizens and could have implications for the harm that may be caused by future cyber attacks.