How China's mass collection of personal info and its new, unevenly enforced data security rules contribute to a thriving underground market for stolen data
Wall Street JournalKaren Hao
Context & Ripple Effects
This story lands weeks after experts revealed that a dashboard managing the Shanghai police database sat exposed from April 2021 to June 2022, letting a hacker walk off with data on nearly a billion people (the exposed Shanghai police database dashboard). It is also the culmination of an arc that started earlier: back in 2020, stolen biometric data was already being sold online at alarmingly low prices as facial recognition adoption soared during COVID (biometric data selling at rock-bottom prices).
What makes the WSJ piece matter is the mechanism it names: the same state that collects personal information at unmatched scale has written data security rules it enforces unevenly, so breaches carry little cost for whoever holds the data. Since the billion-person trove surfaced, researchers at Group-IB have watched smaller tranches — often pairing personal details with national ID numbers — keep appearing on forums (smaller tranches surfacing on forums), while the NYT has documented growing public unease about data security inside China's surveillance build-out.
First-order effects
Chinese citizens whose records sit in government and corporate databases bear the immediate risk: the Shanghai police trove shows that once a repository leaks, the data is resold in pieces indefinitely rather than recovered.
Companies and agencies holding personal data in China face little immediate penalty when they fail to secure it, because the new rules are enforced unevenly — the direct consequence is weak incentives to fix exposed systems like the police dashboard.
Second-order effects
Public unease documented around the surveillance apparatus puts pressure on Beijing to either enforce its own data rules seriously or watch trust in digital services erode — a choice that constrains how aggressively the state can keep expanding collection.
Buyers of stolen data gain a reliable, cheap supply chain spanning everything from biometrics to national IDs, which lowers the barrier for fraud and downstream crime targeting Chinese consumers and any service that authenticates against leaked identifiers.
Third-order effects
If the pattern holds, China's data security laws harden from consumer protection into selective enforcement tools — applied when politically convenient rather than uniformly — leaving the structural tension between mass collection and data safety unresolved.
A persistent domestic stolen-data market also complicates China's ambitions to export its governance model and its tech platforms, because every high-profile leak hands critics evidence that the surveillance-first approach fails at basic security.
The trend: China's surveillance-driven mass collection is colliding with its own data security regime, and enforcement gaps are converting state-scale databases into standing inventory for criminal markets.
@paulmozur ... “Data is like sea water, the more we drink the thirstier we are,” Chen Chao, director of Shanghai's police technology office, said in 2018. The risks of indulging this thirst for data emerged last month when Shanghai police data records turned up online. https://ww…
@paulmozur ... One, advertising the same database, put the price tag at $100,000. Another, from a user claiming to be a police officer from Henan province inspired by the Shanghai theft, offered the personal information of 90 million people for roughly $20,000. https://www.wsj.co…
@paulmozur ... A third post promoted an alleged nine million records from China's Center for Disease Control for $2,000. A few days later, a fourth popped up selling 40,000 records of Chinese citizens' names, phone numbers, addresses, and government ID numbers for $500. https://w…
@paulmozur ... Within days of the user hawking the Shanghai police database for $200,000, advertisements for all or parts of the data began proliferating. Meanwhile, several other posts sprung up in the original forum offering similar data at lower prices. https://www.wsj.com/...
A privacy activist once told me “all data is born breached.” This from @_KarenHao is Example A1. China has some of the world's strictest data-protection rules. It's also leaking sensitive data like a sieve. There's one driving factor: https://www.wsj.com/...
@paulmozur ... The U.S. is second to China with nearly 540 terabytes of data left open on the public internet. China is unique, though, for the broad and sensitive nature of its exposed data—a consequence of the way it centralizes information on state-run platforms. https://www.w…
@paulmozur @JohnLiuNN The Journal has since found dozens more Chinese databases offered for sale, and occasionally free, in online forums. Four caches contained data likely taken from government sources, while others were advertised as containing government data. @_KarenHao https…
@paulmozur ... “Tens of thousands more databases in China remain exposed on the internet with no security, totaling over 700 terabytes of data, the largest volume of any country, according to LeakIX, a service which tracks such databases.” https://www.wsj.com/...
@paulmozur ... Shanghai was among the first cities to unveil a fully integrated data platform with AI capabilities in 2019. The platform pulls data from various government bodies and private companies, according to a state-media interview with a Shanghai police director. https://…
I am very curious what the punishment will be in light of the massive fine levied against Didi... Ok, also if it will change anything in the longer run about how data is stored. There has been more of an appetite for private data being kept safe recently. https://twitter.com/...
China has built one of the world's strongest data-protection regimes. Yet the recent Shanghai police leak, which exposed nearly 1b citizens' data, shows that something isn't working. One reason is another of the gov's security projects: mass surveillance. https://www.wsj.com/...