Hackers Claim 10 PB Data Stolen From China’s Tianjin Supercomputer Center

Key Takeaways

• A hacking group alleges a massive data theft from a major Chinese supercomputing facility, potentially the National Supercomputing Center in Tianjin.
• Over 10 petabytes of data, including sensitive defense and missile design information, is reportedly compromised.
• The incident, if confirmed, would be among China’s largest data breaches, impacting over 6,000 clients across scientific, industrial, and defense sectors.
• Attackers claim sustained access over six months, initiated via a compromised VPN, followed by botnet infiltration.

Hackers are claiming responsibility for a significant cyber intrusion at a critical Chinese computing facility, alleging the exfiltration of more than 10 petabytes of sensitive data. Cybersecurity experts believe the target is likely the National Supercomputing Center in Tianjin, a state-run environment.

Should these claims be substantiated, this incident would represent one of the most substantial data theft cases ever reported in China. Its potential impact is amplified not only by the sheer volume of data but also by the Tianjin center’s role in supporting over 6,000 clients across China’s vital scientific, industrial, and defense sectors.

Reports concerning the alleged breach indicate that the stolen data sample includes highly sensitive defense documents and proprietary missile design information. This raises immediate and serious concerns regarding the potential exposure of research directly linked to military and aerospace projects.

The Supercomputing Center at Risk

The alleged target is far from an ordinary data center. The Tianjin supercomputing facility functions as a national resource, providing high-performance computing infrastructure crucial for major research institutions and defense-affiliated organizations. Consequently, any compromise of this facility could carry significant implications for both national security and industrial secrecy.

Given that such centers consolidate workloads from numerous entities, a breach here could simultaneously expose material from a multitude of organizations, rather than being confined to a single contractor or ministry.

While cybersecurity experts who have reviewed portions of the leaked material have not yet fully confirmed the breach, they assert that the sample data aligns broadly with what would be expected from a prominent Chinese supercomputing center. This places the situation in a challenging “gray zone” for defenders and threat analysts: the complete archive remains unverified, yet the available evidence appears credible enough to warrant serious investigation.

Neither Chinese authorities nor independent observers have yet verified the full scope of the incident, leaving this a central unanswered question as the claims continue to circulate online.

Intrusion Methodology and Timeline

The attackers’ account of how the intrusion reportedly unfolded is particularly alarming. A researcher cited in reports on the incident stated that the individual claiming responsibility indicated initial access was gained through a compromised VPN domain. Subsequently, a botnet was allegedly employed to infiltrate systems, extract files, and store the stolen data over an approximate six-month period.

If this timeline is accurate, it suggests an extended period of undetected access within infrastructure that handles some of China’s most sensitive scientific and defense-related computing workloads.

These claims have also surfaced on various online channels and dark-web-style listings, intensifying concerns that the threat actor may be attempting to monetize the alleged stolen data or sell access related to the breach.

Even in the absence of full confirmation, the release of sample material aligns with a common cybercriminal tactic where partial disclosure is used to establish credibility, attract potential buyers, and exert pressure around an incident before independent verification is complete.

Broader Implications

The wider ramifications of such an incident extend far beyond a single facility. Supercomputing centers are pivotal, sitting at the nexus of academic research, aerospace development, advanced simulation, and defense modeling. This interconnectedness means that a single compromise can trigger cascading effects across an entire scientific and security ecosystem.

Should the Tianjin breach prove even partially true, it will serve as a stark warning that high-value national computing infrastructure remains an attractive and potentially vulnerable target within the global cyber conflict landscape.

What You Should Do

• Review and strengthen VPN security protocols, ensuring multi-factor authentication (MFA) is enforced for all remote access.
• Implement advanced persistent threat (APT) detection solutions to identify and alert on long-term, stealthy intrusions.
• Conduct regular, comprehensive security audits and penetration tests on critical infrastructure, including supercomputing environments.
• Enhance network segmentation to limit lateral movement potential even if an initial foothold is gained.
• Ensure robust data exfiltration monitoring is in place to detect large-scale data transfers outside the network.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.