Misconfiguration exposes billions of Chinese records

Cybernews reports that more than 8.7 billion Chinese records have been spilled by an unprotected Elasticsearch cluster in what is among the largest exposures in the open-source distributed search and analytics engine.

Apart from leaking personally identifiable information, including names, birthdates, home addresses, and national ID numbers, the misconfigured database whose ownership remains uncertain also exposed social media identifiers, usernames, and other account and platform details, as well as plaintext credentials and corporate and business records that may have been obtained as part of a long-term data aggregation initiative, according to Cybernews researchers.

"This exposure demonstrates how large-scale personal data aggregation can persist outside regulatory oversight when hosted in permissive environments. Even without a confirmed owner, the dataset represents a systemic privacy risk affecting potentially hundreds of millions of individuals," said researchers, who noted that the database has since been secured. Such a discovery comes months after more than 500 GB of Great Firewall of China-related documents were exposed by an anonymous threat actor.