A giant database from Chinese electronics manufacturer Xinai Electronics was identified as being publicly available, exposing millions of faces and vehicle license plates. The exposed database held over 800 million records, which is the second largest known data security breach of the year. Xinai Electronics creates systems for “controlling access for people and vehicles to workplaces, schools, construction sites and parking garages across China.” The company utilizes facial recognition for “a range of purposes beyond building access, including personnel management, like payroll, [and] monitoring employee attendance and performance”, and it also uses a cloud-based vehicle license plate recognition system to allow drivers to pay for parking in unattended garages. According to the company’s website, all data collected was supposedly stored securely on the company’s servers, but security researcher Anurag Sen identified an Alibaba-hosted server containing the unsecured database. Sen reported that the database included “hundreds of millions of records and full web addresses to image files hosted on several domains owned by Xinai” and emphasized that “neither the database nor the hosted image files were protected by passwords.” Specifically, the database included information about Chinese citizens, including links to high-resolution photos of faces, each person’s name, age, sex, and resident ID numbers, as well as vehicle license plates in parking garages, driveways, and other office entry points. As of mid-August, the database was no longer publicly accessible. Prior to this, however, an undated and unclaimed ransom note was left that claimed the database contents had been stolen and demanded “a few hundred dollars worth of cryptocurrency” in order to return the data. TechCrunch noted that the blockchain address left in the note does not have any evidence of receiving funds from Xinai. In China, facial recognition technology is routine and state surveillance is hyper present. Ensuring that this personally identifiable information (PII) is stored securely is of high priority. CTIX analysts will provide any updates regarding this breach as it becomes available.