Shanghai health code system containing personal data of 48.5 million people allegedly hacked and touted for sale

A database allegedly containing the personal information of 48.5 million citizens based on Shanghai’s health code system has been put on sale online, according to a post on a hacker community website, just one month after a previous alleged data leak involving one billion Chinese residents.

In a post on the online hacker community Breach Forum on Wednesday, a poster – using the handle name XJP – asked for US$4,000 to hand over a database based on Shanghai’s health code system containing the personal information of 48.5 million unique users, who “live in, or have visited, Shanghai” since the adoption of the QR code system.

The poster also released a sample of the database, which included names, phone numbers, ID numbers and the health code status of 47 citizens. A citizen surnamed Feng, one of those whose data appeared on the list, confirmed the authenticity of his own information and told the Post that he is upset about it being posted online. He declined to give his full name due to the sensitivity of the matter.

When asked by another user in the post whether the alleged database is related to the huge alleged leak from the Shanghai public security database last month, the poster replied: “Not directly.”

Shanghai’s health code, or Suishenma, is a programme of QR code developed by the Shanghai Big Data Centre, an agency under the Shanghai Municipal Government, in early 2020, designed to help local authorities manage the Covid-19 outbreak. It classifies a citizen’s risk of spreading the virus by labelling them with three colours of the QR code – red, yellow and green. It has now become a necessary digital tool in the daily lives of Shanghai residents, as they need to present a green code before taking public transport or entering public venues.