Chinese cyber attackers target 20m Alibaba accounts

Cyber criminals in China attempted to access more than 20m active accounts on e-commerce company Alibaba’s Taobao website. The attackers used Alibaba’s own cloud-based service. A spokesman for the company said that the attack was detected “in the first instance” following which the company called on users to change their passwords and worked closely with the police. The cyber attackers obtained a database of 99m usernames and passwords from several websites, which they then used in Alibaba’s platform. Of the 99m usernames, just over 20m were also used for Taobao accounts. The attackers began their work in October 2015 and were discovered the following month. Alibaba reportedly discovered and blocked most of the log-in attempts. The attackers used compromised attacks to fake orders on Taobao (which raises the sellers’ rankings), and sold accounts to be used for fraud.

Hackers in China attempted to access more than 20m active accounts on Alibaba Group Holding Ltd’s Taobao e-commerce website using Alibaba’s own cloud computing service, according to a state media report posted on the internet regulator’s website.



Analysts said the report from the Paper led to the price of Alibaba’s US-listed shares falling as much as 3.7% in late Wednesday trade.

An Alibaba spokesman on Thursday said the company detected the attack in “the first instance”, reminded users to change passwords, and worked closely with the police investigation.

Chinese companies are grappling with a sharp rise in the number of cyber-attacks, and cybersecurity experts say firms have a long way to go before defences catch up to US counterparts.

In the latest case, hackers obtained a database of 99m usernames and passwords from a number of websites, according to a separate report on a website managed by the ministry of public security.

The hackers then used Alibaba’s cloud computing platform to input the details into Taobao. Of the 99m usernames, they found 20.59m were also being used for Taobao accounts, the ministry website said.

The hackers started inputting the details into Taobao in mid-October and were discovered in November, at which time Alibaba immediately reported the case to police, the ministry website said. The hackers have since been caught, it said.

Alibaba’s systems discovered and blocked the vast majority of log-in attempts, according to the ministry website.

The hackers used compromised accounts to fake orders on Taobao, a practice known as “brushing” in China and used to raise sellers’ rankings, the newspaper said. The hackers also sold accounts to be used for fraud, it said.

Alibaba’s spokesman said the hackers rented the cloud computing service but declined to comment on security measures designed to stop the system being used for the attack. He said they could have used any such service, and that the attack was not aided by any possible loopholes in Alibaba’s platform.

“Alibaba’s system was never breached,” the spokesman said.

The number of accounts, 20.59m, represents about 1 out of every 20 annual active buyers on Alibaba’s China retail marketplaces.