Hacker to Sell Shanghai COVID App’s 48.5 million Users Data

Hackers have claimed to have accessed the personal information of 48.5 million users of the Shanghai CCP virus (Covid-19) health code mobile app, the city’s second data breach in less than 2 months.

On Wednesday, the hacker “XJP” offered the data for sale price of $4,000 on the hacking forum Breach Forums.

The hacker displayed a sample of 47 people, including their telephone numbers, names, and Chinese ID numbers, as well as health code status.

In total, 11 out of 47 individuals confirmed that they were included, while two stated that their ID numbers were incorrect.

“This DB (database) contains everyone who lives in or visited Shanghai since Suishenma’s adoption,” XJP said, which dropped the price later in the day after initially asking for $4,850.

Like many Chinese cities, Shanghai developed the health code system called Suishenma in early 2022 to control COVID transmission. All residents and tourists cannot avoid using it.

It collects travel data to determine whether the user is likely to contract the virus and requires the user to display the code when entering public places.

The data is managed by the Shanghai government. Suishenma is available through the Alipay app from Ant Group, a fintech giant and Alibaba affiliate, as well as the WeChat app from Tencent Holdings.

Ant, Tencent, XJP, and Shanghai government have not yet responded to the request for comment.