Monday, May 27, 2024

Online store exposed millions of Chinese citizen IDs

Imagine the shock of discovering that an online store has left a database exposed to the internet, revealing millions of Chinese citizen identity numbers. This alarming security breach was found by Viktor Markopoulos, a security researcher working for The database belonged to Zhefengle, a China-based e-commerce store specializing in imported goods. Within the database were over 3.3 million orders from 2015 to 2020, containing personal information such as customer shipping addresses, phone numbers, and government-issued resident identity card numbers. Incredibly, many orders even included uploaded copies of the customers’ identity cards. The potential consequences of this breach are significant, as it highlights the need for increased security measures to protect our personal information online.

Online store exposed millions of Chinese citizen IDs

This image is property of

Background Information

TechCrunch Article Summary

In a recent article published by TechCrunch, it was reported that a security researcher discovered millions of Chinese citizen identity numbers exposed online. The researcher, Viktor Markopoulos, found the unprotected database belonging to Zhefengle, a China-based e-commerce store that specializes in importing goods from overseas. The database contained over 3.3 million orders from 2015 to 2020, and it had not been password-protected.

Database Exposure and Vulnerability

The exposed database belonging to Zhefengle highlights a critical vulnerability in the security measures of the online store. By leaving the database unprotected and accessible to anyone with the IP address, sensitive customer information, including identity numbers and uploaded copies of identity cards, were at risk of being accessed by unauthorized individuals. This raises concerns about the overall security practices of the store and its protection of customer data.

Zhefengle Online Store

Zhefengle is an e-commerce store based in China that focuses on importing goods from overseas. With millions of orders processed between 2015 and 2020, the store has built a substantial customer base. However, the recent exposure of their unprotected database has called into question their commitment to safeguarding customer information and ensuring the privacy of their users.

Discovery of the Exposed Database

Security Researcher’s Findings

Viktor Markopoulos, a security researcher working for, made the alarming discovery of the exposed database belonging to Zhefengle. His investigation revealed that the database contained over 3.3 million orders spanning a five-year period. This finding highlights the magnitude of the potential data breach and the significance of the security lapse on the part of the online store.

Zhefengle’s Unprotected Database

One of the most striking aspects of this discovery is that the Zhefengle database was left completely unprotected. This means that anyone with knowledge of the IP address could access the database simply by using a web browser. Without the basic safeguard of password protection, sensitive customer information was left vulnerable to unauthorized access and exploitation.

Contents of the Database

The exposed database contained a significant amount of customer information. Aside from the millions of orders, it also included customer shipping addresses, phone numbers, and government-issued resident identity card numbers. Additionally, many of the orders featured uploaded copies of the customer’s identity card, which further compounds the potential risks associated with the exposure of this data.

Online store exposed millions of Chinese citizen IDs

This image is property of

Implications of the Exposed Data

Chinese Citizen Identity Numbers

The exposure of millions of Chinese citizen identity numbers is a cause for concern. With access to such sensitive information, malicious actors could potentially engage in identity theft, fraud, or other illicit activities. This puts the affected individuals at risk of financial loss, reputational damage, and other harmful consequences.

Corresponding Customer Information

Alongside the identity numbers, the exposed database included corresponding customer information, such as shipping addresses and phone numbers. This combination of data presents a potential goldmine for cybercriminals looking to exploit personal information for illegal purposes. The affected customers may experience unwanted solicitations, targeted scams, or even physical risks if their personal addresses are accessed and misused.

Uploaded Copies of Identity Cards

The inclusion of uploaded copies of customers’ identity cards in the exposed database is particularly concerning. These documents are crucial verification tools for individuals conducting transactions with the store. However, their exposure could lead to identity fraud and unauthorized use, with potential repercussions extending beyond financial loss to include legal and reputational consequences for the affected individuals.

Security Concerns and Privacy Issues

Lack of Password Protection

The lack of password protection for the Zhefengle database raises significant security concerns. Passwords serve as a fundamental safeguard against unauthorized access, and their absence leaves customer data exposed to potential misuse. This incident highlights the importance of implementing robust security measures, such as encryption and multi-factor authentication, to protect sensitive information from unauthorized access.

Access to Data Using IP Address

By allowing access to the exposed database via the IP address alone, Zhefengle inadvertently created a loophole through which unauthorized individuals could retrieve customer data. This demonstrates a lack of adequate access controls and underlines the need for stringent security protocols to prevent unauthorized access to sensitive databases.

Importance of Identity Verification

The requirement for identity verification is a common practice in e-commerce, particularly when importing goods to China. While it serves as a means of ensuring the legitimacy of customers, the exposure of identity card information underscores the risks associated with reliance solely on this method. Stricter measures, such as implementing secure document submission platforms and advanced verification techniques, should be considered to minimize the potential for misuse of customer data.

Online store exposed millions of Chinese citizen IDs

This image is property of

Duration of Database Exposure

Unknown Length of Exposure

The exact duration of time for which the Zhefengle database was exposed remains unknown. This uncertainty further compounds the potential risks for the affected individuals, as unauthorized access could have occurred over an extended period. The lack of awareness regarding the exposure timeframe necessitates vigilance and cautious monitoring of personal information for the impacted customers.

Accessing Data Through Web Browser

The fact that the exposed data could be accessed simply through a web browser signifies the ease with which unauthorized individuals could have potentially retrieved customer information. This highlights the pressing need for robust security practices, including stringent access controls and encryption, to protect sensitive data from being exploited through easily accessible entry points.

Notification and Response

Contacting the Online Store Owners

TechCrunch promptly contacted the owners of the Zhefengle online store, notifying them of the exposed database and its potential impact on customer data privacy. The swift response from TechCrunch was instrumental in bringing attention to the vulnerability and initiating necessary actions to address the issue.

Database Inaccessibility

Following TechCrunch’s notification, the database belonging to Zhefengle became inaccessible. This suggests that the online store owners took immediate steps to mitigate the vulnerability and protect customer data from further unauthorized access. While the exact measures taken to secure the database remain undisclosed, the swift action demonstrates the store owners’ recognition of and commitment to addressing the issue promptly.

Store Owners’ Prompt Addressing of Vulnerability

In their response to TechCrunch, the Zhefengle store owners acknowledged the vulnerability and the need for prompt action. They expressed their commitment to investigating the cause internally, highlighting their dedication to rectifying the security issue. This acknowledgement and proactive approach toward resolving the matter are encouraging signs that Zhefengle is taking customer data privacy seriously.

Online store exposed millions of Chinese citizen IDs

Investigation and Internal Review

Cause of the Vulnerability

The exact cause of the vulnerability that led to the exposure of the Zhefengle database remains under investigation. Internal efforts are being made to identify the specific factors and processes that contributed to the security lapse. This investigation is crucial in ensuring that similar incidents are prevented in the future and that appropriate security measures are put in place to protect customer data adequately.

Current Internal Investigation

Zhefengle has initiated an internal investigation to uncover the root cause of the vulnerability and examine their existing security protocols. This commitment to reviewing their infrastructure and practices demonstrates a willingness to learn from the incident and address any weaknesses in their security framework. By implementing necessary improvements, they aim to rebuild trust with their customers and ensure the privacy and protection of customer data moving forward.

Contributing Reporter

TechCrunch’s Rita Liao has been instrumental in reporting and shedding light on the exposure of the Zhefengle database. Her contribution to this issue underscores the vital role that journalists and tech reporters play in uncovering security vulnerabilities and raising awareness about the potential risks to individuals and organizations alike. Through their reporting, they facilitate prompt action and encourage accountability in the safeguarding of sensitive data.

In conclusion, the exposure of millions of Chinese citizen identity numbers through the Zhefengle online store serves as a stark reminder of the importance of robust security measures. The incident highlights the need for password protection, proper access controls, and stringent identity verification protocols. It also emphasizes the significance of timely notification, prompt response, and responsible handling of security vulnerabilities by organizations. By implementing these necessary precautions and continuously improving their security practices, online stores can safeguard customer data and protect individuals from potential harm.

Online store exposed millions of Chinese citizen IDs