- A threat actor claims to be selling data linked to China’s Ministry of Public Security on an underground forum.
- The claimed files reportedly include surveillance tools, espionage records, reports, names, phone numbers and contact details.
- There is no independent proof yet that the MPS itself suffered a breach. Much of the description closely matches the 2O24 i-Soon contractor leak.
China’s Ministry of Public Security (MPS) has allegedly suffered a data breach, according to a listing on an underground forum.
The seller claims to have data connected to the ministry and is offering it for sale. The listing reportedly names mps.gov.cn, the ministry’s official domain, and describes a wide range of material.
The claimed dataset includes spyware, details about espionage work, reports, official plans, conversations, articles, names, phone numbers and other contact information. It also reportedly references a “Twitter Monitoring Platform,” suggesting that some of the material may involve surveillance of users on X, formerly known as Twitter.
There is, however, one very significant caveat here. This information has yet to be validated. Independent searches for this particular listing found no legitimate confirmation from any Chinese authorities, security companies or reputable media organizations. The forum post itself is still just an allegation, not proof of a new MPS network breach.
The Latest Claims’ Connection to the i-Soon Leak
What makes the specifics so remarkable is how much they match the 2O24 data leak from i-Soon, which also goes by the name Anxun Information Technology.
It all began in February 2O24, when a large number of files belonging to i-Soon came into the public domain. The leak exposed contracts, product documents, employee records, customer lists, even internal communications.
Investigations found that i-Soon had close links to Chinese security agencies. The leaked material showed tools designed to monitor social media, gather user information and support hacking operations.
The files also described technology aimed at overseas platforms, including X. Some tools could reportedly collect phone numbers, email addresses and other information tied to social media accounts.
The leak was significant because it offered an unusual look into China’s private cyber contractor network.
The Associated Press reported that employees of i-Soon confirmed the files had been leaked. Analysts also said the material appeared credible and showed links to China’s security services.
That history makes the latest forum claim harder to assess. It may represent genuinely new material, resale of older leaked files, or a mixture of both.
The pattern of government data appearing on underground forums is not limited to China—a separate dark web listing recently claimed to offer stolen data from Bangladesh’s government, including land registration records and pay slips from multiple ministries.
U.S. charges add weight to the contractor link
The connection between i-Soon and China’s security agencies is no longer based only on leaked documents.
In March 2O25, the U.S. Department of Justice charged 12 Chinese nationals over alleged hacking operations. The defendants included two MPS officers and eight employees of i-Soon.
According to the Justice Department, i-Soon worked with at least 43 MPS and Ministry of State Security bureaus across 31 Chinese provinces and municipalities.
Prosecutors said the company sold stolen information to Chinese security agencies and helped conduct hacking operations against foreign governments, organizations and individuals.
The charges also described a wider system in which private Chinese hackers and companies carried out operations for government customers.
That makes the alleged MPS data sale especially sensitive. If authentic, such material could provide insight into how Chinese security agencies obtain, manage and use surveillance and intelligence tools.
What could be in the alleged data?
The seller’s description points to several categories of potentially sensitive information.
Spyware and technical documents could reveal how surveillance systems work. Reports and conversations could expose internal activities or relationships. Names, phone numbers and contact details could identify officials or other people linked to government operations. References to a Twitter monitoring system are also notable.
Earlier i-Soon documents showed that Chinese security customers had a strong interest in monitoring overseas social networks. The leaked files described tools for identifying people behind social media accounts and collecting information about them.
Still, the current claim provides no reliable evidence that the listed material came directly from MPS systems.
The biggest question is authenticity
The most important issue is whether this is a fresh breach. Many listings containing exaggerated, recycled or even stolen long ago pop up every time in underground forums. Sellers sometimes even use the names of big reputable companies just to make their offer more attractive to potential buyers. That risk is particularly high here because the description overlaps with the well-documented i-Soon leak from 2O24.
Security researchers have already described underground activity involving alleged Chinese government and corporate data sales. Recent threat reports have also warned that many such claims cannot be independently confirmed. For now, the safest conclusion is that a threat actor claims to possess and sell MPS-related data, but there’s no report yet of a direct breach of the ministry.
If the files later turn out to be authenticated, the incident could become more significant. It could reveal new details about China’s surveillance system or expose sensitive information about its security operations. Until then, the claim remains an unverified underground-market allegation, with the 2024 i-Soon leak providing the most important context.
