Zhao Changpeng, CEO of the cryptocurrency exchange Binance, announced Monday that human error is likely the cause of a twenty-three (23) terabyte leak from a Shanghai police database which stored the personal information of Chinese citizens. The Binance CEO stated that a government developer wrote a blog post on the China Software Developer Network (CSDN) that accidentally included credentials to the system where the data was being stored. Previously, Changpeng had stated that his threat intelligence team had detected 1 billion Chinese residents’ records for sale on the dark web. The initial thought was that the leak was caused by, “a bug in an Elastic Search deployment by a gov agency.” On Tuesday, numerous groups reported that an anonymous hacker or hacking group under the username “ChinaDan” had posted the data for sale on the dark web. The data includes names, addresses, birthplaces, national IDs, phone numbers, and criminal case information of Chinese citizens. The actors are demanding a ten (10) bitcoin ransom in exchange for the data. The silver lining to this incident is that the leak is now known to be caused by credential oversight and not a vulnerability exploit or malware strain. In fact, the 2022 Data Breach Investigations Report (DBIR) cited the “human element” as responsible for eighty-two (82) percent of the breaches analyzed by researchers. Since the human factor remains the greatest weakness in security systems, researchers are urging companies to continue to add more defense-in-depth measures to their systems rather than simple password protection. At this time, Shanghai authorities have not publicly responded to the latest data breach, nor are they responding to requests for comments. CTIX analysts will continue to monitor the fallout of this leak, and relevant updates may be posted in future issues.