Cyber Threat Actor: ChinaDan

ChinaDan is a threat actor known by the alias TA416 and is located in China. The actor gained public attention through a claim posted on a hacker forum offering to sell data allegedly obtained from a government database. ChinaDan is recognized by these two names in open source reporting and threat intelligence references. No further personal details or organizational structure about the actor are provided in the available sources.

The actor claimed to have exfiltrated personal information belonging to approximately one billion Chinese national residents from the Shanghai National Police (SHGA) database. According to the claim, the dataset includes names, addresses, national ID numbers, mobile contact information, and extensive criminal records. ChinaDan stated that the data was taken from a local private cloud operated by Aliyun, which is part of the Chinese police network. The actor offered to sell the entire dataset for ten bitcoins, valued at roughly $195,000 at the time of the announcement, and provided a sample of 750,000 records to potential buyers for verification purposes.

The alleged breach was attributed to an accidentally exposed ElasticSearch database deployment by a government agency, as noted by Binance CEO Zhao Changpeng after his company’s threat intelligence team observed the claims. Zhao indicated that the exposure likely resulted from a developer inadvertently including credentials in a public tech blog post on CSDN. Wall Street Journal reporter Karen Hao corroborated elements of the leaked sample by contacting individuals whose data appeared in the records, with several confirming specific case details that would be difficult to obtain from other sources. While the full scale of the leak remains unverified, the incident represents one of the largest alleged data exposures involving Chinese citizens’ personal information. No definitive attribution to state sponsorship or criminal consortium is stated in the source material beyond the actor’s self‑described origin and the nature of the claimed target.