A massive data breach involving approximately 4 billion records has been discovered by cybersecurity researchers. The unsecured dataset, primarily consisting of Chinese customers' information, was found without password protection. The breach includes sensitive personal information such as full names, dates of birth, phone numbers, and financial data like card numbers, debt, and saving information. The largest collection of records, over 805 million, came from WeChat, a popular Chinese messaging app. This breach could be part of a surveillance effort, potentially leading to social engineering attacks, identity theft, fraud, or blackmail.

Massive Chinese Data Leak Exposes 8.7 Billion Records in Unsecured Database A significant data leak has exposed over 8.7 billion personal and business records, primarily affecting Chinese individuals. The unsecured Elasticsearch cluster, hosted on bulletproof infrastructure, remained accessible for three weeks before being secured, giving threat actors ample time to exfiltrate the data. The exposed dataset included full names, phone numbers, national ID numbers, home addresses, email accounts, social media identifiers, and passwords many stored in plaintext or weakly protected. This sensitive information heightens risks of phishing, account takeovers, fraud, and identity theft, particularly for individuals who reuse passwords across services. Corporate data, such as company registration details and business contacts, was also compromised, enabling potential impersonation and targeted scams. Security researchers suspect the leak was deliberate, given the data’s highly organized structure and storage on bulletproof infrastructure commonly used by high-risk entities. The records included up-to-date information from 2025, suggesting long-term aggregation rather than a historical breach. While the exact number of affected individuals remains unclear due to duplicated records, estimates place the impact in the hundreds of millions. The incident underscores China’s ongoing struggle with large-scale data breaches, following previous leaks from major platforms like WeChat, Alipay, QQ, and Weibo, as well as government-linked entities. In September 2025, a separate breach exposed 500 GB of internal documents from China’s Great Firewall, while a 2022 Shanghai police leak compromised 23 terabytes of data for over a billion people. The identity of the threat actor behind this latest breach remains unknown, with no entity claiming responsibility.