Massive amounts of user data allegedly hacked three years ago from JD.com, China's largest business-to-consumer e-commerce platform, have been traded on the black market, putting the company's data security under the spotlight.
The company admits some customer information was stolen through a security loophole in 2013 but cannot verify the extent of the breach.
JD.com claims that security vulnerabilities were promptly fixed three years ago, and exposed users were given "strong recommendations" to change their passwords the next time they logged on to JD.com's system. "However, a small number of users failed to upgrade their accounts passwords, making them susceptible to risk," JD.com said.
A 12-gigabyte package of JD.com user data with complete sets of personal information was stolen. The lists include user names, citizen ID numbers, passwords, e-mail addresses and cellphone numbers.
JD.com is still verifying whether all of the alleged 12GB of data was leaked through the company. However, it acknowledges that batches of information shown in screenshots from the report were hacked from the platform three years ago using a security loophole. JD.com said it has reported the case to Beijing police.
"The question now is whether JD.com actively took sufficient measures to notify users of their risk," said Goodwell, one of the earliest cybersecurity experts in China. "Security issues are hard to avoid today. A company must ensure loopholes get closed, no exceptions.
"It's possible that JD.com downplayed the severity of the matter at the time to avoid panic."
Massive amounts of user data allegedly hacked three years ago from JD.com, China's largest business-to-consumer e-commerce platform, have been traded on the black market, putting the company's data security under the spotlight.
