Kamal Ghorui
China may have suffered its largest data breach ever after a cyberattack recently targeted one of the country’s supercomputers. According to a CNN report, a hacker has allegedly accessed and stolen more than 10 petabytes of sensitive data from a state-run system, including what are said to be classified defence documents, missile schematics, and research files.The dataset is believed to have been taken from the National Supercomputing Centre (NSCC) in Tianjin, which provides infrastructure services to more than 6,000 clients, including scientific and defence-related institutions. An account calling itself FlamingChina shared samples of the alleged data on Telegram on February 6, claiming it includes “research across various fields including aerospace engineering, military research, bioinformatics, fusion simulation and more,” the report noted.Cybersecurity experts who reviewed portions of the data said it appeared consistent with material typically handled by such facilities. Some files were reportedly marked “secret” in Chinese and included technical documents, simulations, and renderings of defence equipment.“They’re exactly what I would expect to see from the supercomputing center. You would use supercomputer centers for large computational tasks. The swath of samples that the sellers put out kind of really speaks to the breadth of customers that this supercomputing center had,” said Dakota Cary, a consultant at cybersecurity company SentinelOne told CNN.However, the publication said it could not independently verify the dataset’s authenticity or the group’s claims, but multiple experts indicated the leak could be genuine. The group is reportedly offering limited previews for thousands of dollars, with full access priced at hundreds of thousands of dollars, payable in cryptocurrency.
How the hacker may have breached Chinese supercomputer data
According to Marc Hofer, a cybersecurity researcher who reviewed the samples, the attacker claimed to have gained access through a compromised VPN domain. Once inside, the hacker allegedly deployed a “botnet” to extract and distribute the data across multiple systems over several months.Cary said the method relied more on system architecture than advanced techniques. “You can think of it as having a bunch of different servers that you have access to and you’re pulling data through this hole in the security of the NSCC — pulling some down to one server, some down to the next,” he said.By spreading the extraction process, the attacker may have avoided detection. “It wasn’t, at least my read on it, anything particularly incredible in the way that they pulled out this information,” Cary added.Experts say the scale of the alleged breach could make the data valuable for intelligence purposes. “Only they probably have the capacity to work through all this data and come back with something useful,” Hofer said, referring to state-backed actors.The Tianjin facility is one of several supercomputing centres in China, alongside hubs in cities such as Guangzhou, Shenzhen and Chengdu. These centres support large-scale computational work for government, academic and industrial users.The incident also raises concerns about cybersecurity practices. Previous cases have highlighted gaps, including a 2021 database leak that exposed personal information of up to one billion Chinese citizens.“They’ve really had poor cybersecurity for a very long time across a wide number of industries and organisations. If you look at what Chinese policymakers say themselves, cybersecurity in China has not been good. They would say it’s still improving at this point in time,” Cary added.China has acknowledged these challenges. In its 2025 National Security White Paper, the government said building “robust security barriers for the network, data, and AI sectors” remains a priority, while continuing efforts to strengthen cybersecurity mechanisms and protect key infrastructure.
