Preface: Internet surfing in 2026.

In late June 2022, a user calling himself ChinaDan listed a database for sale on an overseas hacker forum, asking 10 bitcoin. He claimed it was Shanghai police data — 23 terabytes, covering roughly a billion people: names, home addresses, birthplaces, national ID numbers, phone numbers, and even police reports. Several foreign media outlets called phone numbers from the sample data, and the people who picked up confirmed the information was theirs. According to security researchers, the database had been sitting open on the public internet for over a year, with no password. If true, this was one of the largest personal data leaks in human history. It never appeared in any of the usual rounds of published "typical cases." Related topics on Weibo soon became unsearchable, and the authorities have never responded to it directly. So what exactly sits at the very top of the supply chain feeding the databases used for doxxing?

I kept digging, and found that the most common type of database is called the "shegongku" — the social engineering database — which holds basic information on nearly everyone. "Shegong" is short for "social engineering." The term originally referred, in hacker circles, to getting information through deception rather than technical exploits — impersonating customer service to phish passwords, for example. Later, "shegongku" came to mean something specific: data leaked over the past decade-plus, collected, cleaned, and deduplicated, then stitched together using phone numbers, QQ numbers, email addresses, and national ID numbers as keys, linking everything the same person left behind in different places. Give it one clue, and it gives you back a person. Doxxing is taking such a database, looking up a specific person, and posting the results. The mid-March 2025 incident involving the daughter of a Baidu vice president drew the attention of several news organizations: where would a middle schooler have gotten this information? Within days, several outlets sent reporters to find the answer the same way — by buying it themselves.

Southern Metropolis Daily (March 19–20, front page). Reporters first searched Xiaohongshu and Weibo for censored keywords like "开X" and "人X," and found posts written in coded slang hinting that they could look up the "three elements of personal information" (name, phone number, national ID number), household registration records, and hotel check-in records. All the posts pointed to a group on an overseas platform. The report didn't name the platform — generally understood to be Telegram. The groups operate on two levels. Basic information, like QQ numbers and phone IMEIs, is answered automatically by bots; for more sensitive data, the bots direct you to a "customer service" contact. One group the reporter saw had as many as 280,000 members, with several hundred new doxxing requests submitted within an hour.

With a colleague's authorization, the reporter used her as a test subject. Customer service quoted: give a name and phone number, get the national ID number — 80 yuan; a screenshot of the household registration record — 240 yuan. The reporter paid via Alipay, and the ID number arrived in under a minute; four hours later the household registration screenshot came through. The screenshot showed the colleague's ID photo taken in Zhanjiang when she was in middle school, along with her education level; another version listed two addresses, precise down to the building: one was her employer-provided dormitory in Foshan, the other was home. The colleague checked and confirmed everything was accurate. Customer service said: "Most databases are inaccurate — ours is real-time." They claimed the 240 yuan was the fee for a "household registration screenshot from the public security website." The Beijing News followed with an editorial saying this claim could be true or could be a sales pitch, but given how fresh and accurate the information was, there was reason to suspect an insider, and it should be investigated on the presumption that it was true. The reporter called the police, whose reply was that "this method involves technical issues, and the situation will be reported to higher-level departments."

The most valuable items on the doxxing price list are full-family household registration records, marriage records, hotel check-in records, movement trajectories, phone location tracking, and property under one's name. Hotel records cost upwards of ten thousand yuan; WeChat chat histories, three thousand. The people behind the social engineering databases themselves claim to have "insiders in public security, banking, and other sectors assisting with queries." Looking into related cases, examples do turn up: a first-grade police officer in Dayi County, Sichuan, used his department-issued digital certificate and mobile policing terminal to look up household registration and vehicle registration information for sale between 2019 and 2020, making over 550,000 yuan in illicit gains, and was sentenced to three years and eight months. There have also been cases involving bank presidents, account managers, real estate platforms, and courier employees.

What is striking is the structure of the price list itself. Full-family household registration records come from the public security population information system. Hotel check-in records exist because hotels are required to upload every guest's ID to the public security hotel-industry security management system in real time. Movement trajectories come from real-name train and flight ticket purchases; phone location tracking comes from carriers' real-name registration. In other words, the most expensive items are all things collected by force under real-name registration rules and stored centrally. What the black market sells is query access — and that access can be sold precisely because there is a single, unified database to query.

As major privacy breach cases continued to unfold, China's privacy-related regulations gradually became more complete.

On the individual side, the 2009 Criminal Law Amendment (VII) first wrote the sale of personal information into the criminal code, with a maximum sentence of three years. The provision initially applied narrowly — only to specific people: state organs, or staff of units in finance, telecommunications, transportation, education, healthcare, and the like. The 2015 Criminal Law Amendment (IX) opened it up to anyone, raising the maximum to seven years, with heavier punishment for insiders. A 2017 judicial interpretation then halved the threshold for insiders: it takes 5,000 records to convict an ordinary person, but only 2,500 for an insider.

On the corporate side, the unit of fines kept growing. The 2013 revision of the Consumer Rights Protection Law began fining businesses that leaked consumer information — up to 500,000 yuan where there were no illegal gains. The Cybersecurity Law, effective 2017, mentioned one million yuan. The 2021 Personal Information Protection Law changed the formula: no longer a fixed number, but 50 million yuan or five percent of the previous year's revenue, plus fines of up to one million yuan on the directly responsible persons in charge. The October 2025 amendment to the Cybersecurity Law raised fine brackets for network operators across the board — for example, failure to fulfill security protection obligations went from 10,000–50,000 yuan to 50,000–500,000 yuan.

On June 30, 2021, Didi listed on the New York Stock Exchange, raising about $4.4 billion — the largest U.S. IPO by a Chinese company in those years. According to multiple later reports, regulators had advised Didi to delay the listing; Didi didn't wait. Two days after the listing, on July 2, the Cybersecurity Review Office announced a cybersecurity review of Didi, citing the National Security Law and the Cybersecurity Law, on the grounds of "preventing national data security risks." On July 4, the Cyberspace Administration of China (CAC) reported that the "Didi Chuxing" app had serious violations in collecting and using personal information, ordered app stores to delist it, and Didi halted new user registration. On July 16, seven departments — cyberspace, public security, national security, natural resources, transportation, taxation, and market regulation — jointly moved into Didi to conduct the review. That December, Didi announced it would delist from the NYSE, completing the process in June 2022 — listed for less than a year.

On July 21, 2022, the CAC announced its penalty decision: Didi Global Inc. was fined 8.026 billion yuan, and chairman and CEO Cheng Wei and president Jean Liu were each fined 1 million yuan. The decision invoked four laws together: the Cybersecurity Law, the Data Security Law, the Personal Information Protection Law, and the Administrative Penalty Law. On January 16, 2023, Didi resumed new user registration — 563 days from the start of the review.

In its Q&A with reporters, the CAC grouped the 16 illegal acts into 8 categories:

1. Illegally collecting screenshots from users' phone photo albums — 11.9639 million entries.

2. Excessively collecting clipboard information and lists of installed apps — 8.323 billion entries.

3. Excessively collecting passengers' facial recognition data (107 million entries), age brackets (53.5092 million), occupations (16.3356 million), family relationships (1.3829 million), and "home" and "work" ride addresses (153 million).

4. Excessively collecting precise location (latitude and longitude) — 167 million entries — when passengers rated designated-driver services, when the app ran in the background, and when phones connected to Orange Vision dashcams.

5. Excessively collecting drivers' education information (142,900 entries), and storing 57.8026 million drivers' national ID numbers in plaintext.

6. Analyzing passengers' travel intent (53.976 billion entries), cities of residence (1.538 billion), and out-of-town business or leisure travel (304 million) without clearly informing passengers.

7. Repeatedly requesting "phone permission" unrelated to the service when passengers used Hitch.

8. Failing to accurately and clearly explain the purposes of processing 19 categories of personal information.

Altogether, 64.709 billion entries of personal information were illegally processed. The violations began as early as June 2015 and lasted seven years. "Plaintext storage" means no encryption — anyone who could get into the database could read the ID numbers of more than 50 million drivers directly. "Analyzing travel intent" means Didi inferred from your ride history whether you were traveling for business, leisure, or heading home — inferring it more than 50 billion times, without you knowing. In the Q&A, the CAC said Didi also "engaged in data processing activities seriously affecting national security," but that "as it involves national security, it is not disclosed in accordance with the law."

In other words, all 16 items the public saw were personal information issues — but those were not what triggered the review. What triggered it was another part, whose contents have never been made public. The widespread outside speculation is that Didi's data on the national road network, ride heat maps, and the surroundings of sensitive locations could have been subject to U.S. disclosure rules after the U.S. listing — but that is only speculation, with no official account. The official characterization of the matter also used the language of national security: the violations "disregarded national cybersecurity and data security," were "extremely egregious in nature," and "should be punished severely."

As for the fine, all the money went to the state treasury — users got nothing. The 64.7 billion illegally processed entries belonged to hundreds of millions of real people, but administrative fines include no compensation, and there was no accompanying class action. China has no U.S.-style class action system, and the procuratorate's public interest litigation never appeared in this case. This fine was not really a privacy case. As a commentary in the cybersecurity outlet Anquan Neican put it, the "maximum penalty" reflected the risks Didi posed to the security of national critical information infrastructure and to data security. Had Didi not listed in New York, these problems would likely never have been surfaced in this way, at this moment. The same commentary also acknowledged that these 8 categories of violations were "by no means unique to Didi." Photo albums, clipboards, app lists, background location tracking — these were industry-wide practices across Chinese apps at the time. That only Didi was punished, and punished to the maximum, itself reveals what the trigger for enforcement was. The company wasn't shut down, and business resumed. Didi's license was never revoked. After a year and a half of rectification, the app was relisted, and today it remains China's largest ride-hailing platform.📖