According to a security researcher, millions of Chinese citizen identifying numbers were leaked online after an e-commerce business left its database open to the internet.
According to Viktor Markopoulos, a security researcher with CloudDefense.ai, he discovered the database belonging to Zhefengle, a China-based e-commerce company for importing items from other countries.
According to Markopoulos, the database held more than 3.3 million orders from 2015 to 2020 but was not password protected.
The order database included customer shipping addresses, phone numbers, and the customer’s government-issued resident identity card number. According to TechCrunch, many of the orders include uploaded copies of the customer’s identity card.
Customers who import items into China must have their identities checked, and it is fairly commonplace for retailers to request a copy of their identity card.
It is unknown how long the database was accessible. Anyone with the database’s IP address could access the data using simply a web browser.
TechCrunch contacted the online store’s owners about the leaked database. The database became unreachable a short time later. “The vulnerability has been addressed promptly,” the store owners stated. We are currently conducting an internal investigation on the cause.”
