Hacker group “FlamingChina” allegedly stole more than 10 petabytes (PB) of military data from China’s National Supercomputing Center (NSCC) in Tianjin.

The attackers are attempting to sell the stolen data, including classified defense documents and missile information from one of the supercomputers, in what could be China’s biggest known data breach to date.

A FlamingChina-named account posted a sample of the alleged dataset on an anonymous Telegram channel on February 6, saying it includes “research across various fields including aerospace engineering, military research, bioinformatics, fusion simulation, and more.”

The hackers are offering the dataset for hundreds-of-thousands-of-dollars in cryptocurrency.

The breach remains unverified, but analysis performed by experts and shared by CNN suggests that the data may be genuine.

Cybersecurity experts who have been in contact with the alleged hackers and reviewed samples of the stolen data say they were able to extract large amounts of information over multiple months without being detected.

'It’s strange but not totally unrealistic'

Jeff Wichman, director of incident response at cybersecurity company Semperis, commented: “Overall, the scale of this breach has not been seen before in any shape or form.

“To put it in context, the U.S. Library of Congress, if it were completely digitalized (videos, images, books, manuscripts, audio), would have several petabytes, only about a third of what the FlamingChina stole and is now trying to resell," Wichman explained, adding the incident represents a significant escalation in global cybersecurity espionage activity.

The NSCC, where the data was reportedly stolen from, is known to provide infrastructure services for more than 6,000 clients in China, including science and defense agencies.

The hacker group said the information is linked to “top organizations” including the Aviation Industry Corporation of China, the Commercial Aircraft Corporation of China, and the National University of Defense Technology.

Marc Hofer, cybersecurity researcher and author of the blog NetAskari, said in a post on X: “It’s strange but not totally unrealistic. Also, a lot that is happening on the Chinese ecosystem [was] pretty much ignored by many Western cybersecurity experts, until recently.”

Hofer pointed out in another post that “the admin manual of the HPC3 supercomputer cluster is actually online, accessible to everyone. It is maybe an outdated 2020 version, but according to FlamingChina, it helped a lot to navigate the infrastructure and VPN setup.”

A South China Morning Post report suggest that the alleged breach may be linked to several senior experts in aviation, nuclear weapons, radar, and missile systems being removed from the Chinese Academy of Engineering (CAE), as deleted from the website at some point in March.