2026 Cybernews — exposed Elasticsearch; ~8.7B Chinese citizen/business records (Jan)
Data compromised
National IDs, demographic and contact fields, passwords, social handles, and business records per Cybernews
Technical writeup
Cybernews and follow-on trade coverage described an unsecured Elasticsearch cluster discovered January 1, 2026, holding on the order of 8.73 billion records tied to Chinese individuals and businesses across more than 160 indices, including national ID–style numbers, names, addresses, mobile numbers, plaintext or weakly protected passwords, and business registration–oriented tables. Researchers framed the corpus as a deliberate multi-year aggregation likely associated with data-broker or criminal collection rather than one hacked company, hosted with a bulletproof-style provider; public access reportedly persisted for weeks before takedown around January 26, 2026. Row-to-person uniqueness is not implied.
Root cause
Publicly reachable Elasticsearch deployment holding a national-scale aggregated warehouse