Research report / Digital Risk Research
H1 2025 Data Breach Risk Report
A half-year review of data exposure, underground channel migration and the growing circulation of credit-related information.
THREAT HUNTER / RESEARCH2025
RESEARCH REPORTH1 2025 Data Breach Risk ReportDigital Risk Research
RESEARCH ARCHIVE / 01THREAT HUNTER
A half-year review of data exposure, underground channel migration and the growing circulation of credit-related information.
This report presents the approved web narrative, headings, research scope and figures. Figure labels stay aligned with the charts so their data remains verifiable. The original publication date remains unchanged.
channel migration
credit-related data
Report reading progress
Original report text
This web edition is reconstructed from the 40-page original PDF. It keeps the report's narrative, chapters and research scope, but leaves out the cover, the duplicate table of contents and purely decorative pages. Figures have been localized and placed in context, and the original PDF remains available for reference.
About Threat Hunter
Threat Hunter was founded in 2017 and helps organizations identify and respond to business fraud, external digital risk, and API security threats. Its work combines cybercrime intelligence, risk data, product platforms, and specialist services.
The company offers a broad, mature portfolio of products and services for the risks that organizations in many industries face as they digitize, including business fraud, data leakage, phishing and impersonation, and API attacks. Leading industry analysts have repeatedly named it a representative vendor in technology maturity and threat intelligence research.
Headquartered in Shenzhen, Threat Hunter also operates offices in Beijing, Shanghai, and Chongqing, with Digital Risk Response Centers in Shenzhen and Chongqing. The company supports customers in China, Europe, the United States, South America, and Southeast Asia.
Preface
As digitalization continued to advance in the first half of 2025, data remained a core business asset, and its security drew growing attention. Data breaches stayed at a high level, while attack methods and trading chains became more complex and harder to see. Together they now pose a major risk to compliant operations and business growth.
Threat Hunter's "H1 2025 Data Breach Risk Report" tracks how data-leak risk is changing. It covers incident volume, industry distribution, trading channels and typical cases, analyzes the latest moves in the criminal data-trading chain, and gives a full picture of data-leak risk in China in the first half of 2025.
Key findings:
- Data breaches stayed high and recovered quickly after a short dip.
Threat Hunter confirmed 57,092 valid data breaches in the first half of 2025, up 1.54% from the second half of 2024. In April, a group-closure campaign on a major encrypted messaging app cut incidents by almost 30% for a short time. In June, as criminal groups regrouped, the number rebounded quickly.
- High-value industries were the main targets, and cross-border e-commerce leaks rose sharply.
E-commerce, consumer finance and banking remained the hardest-hit industries. Together, these top 3 accounted for 1.32 times as many incidents as the other seven industries in the top 10.
Within e-commerce, cross-border e-commerce incidents grew more than tenfold from the previous half-year, a clear sign that the trade is going international.
- Dark-web leaks rose 35.2%, and activity on Chinese-language forums grew sharply.
Dark-web channels accounted for 18,106 leak incidents, up 35.2% from the previous half-year. Users of Chinese-language dark-web forums such as "Chang'an City" and "D*Chinese" grew quickly. Newly registered users posted more than half of these incidents, and most of the leaked data came from platforms outside China.
- "Haowang Guarantee" collapsed, "Tudou Guarantee" quickly took its place, and guarantee platforms proved easy to replace.
"Haowang Guarantee", the leading guarantee platform on encrypted messaging apps, was hit hard in May and its business stopped. By June, newer platforms such as "Tudou Guarantee" had filled the gap. Both supply and demand in the underground market remain very active, and the trading chain has a strong ability to heal itself.
- After BF shut down, several platforms took over, and threat-actor trading moved with them.
Before it went offline, BF accounted for 14.5% of dark-web leak incidents. After the shutdown, its core users moved quickly to alternatives such as X*S and D**s and kept trading data, which shows how readily threat actors adapt and migrate.
- Leaks of "multi-lending" credit data surged and now support a complete criminal supply chain.
Leaks of credit risk data, led by "multi-lending" records, rose sixfold in six months. A full criminal ecosystem has formed around them, from data theft and platform building to targeted fraud. Threat actors have used several risk-check query platforms, such as "Fuyao" and "Xinchen", as relay points for the data.
- Leaks of bank "scan-code application" data rose more than fourfold and are linked to a third-party marketing tool.
Threat Hunter found 111 leaks of "scan-code application" loan data in the first half of the year, involving more than 80 banks. The core risk lies in a fintech marketing platform used in banks' account-manager systems. An insider or a system flaw is suspected of sending data on high-intent customers to the black market.
Disclaimer: The data in this report is estimated and analyzed using large-sample collection, small-sample surveys, data-model forecasts and other research methods. Every data source and technique in statistical analysis has limits, and Threat Hunter's are no exception. The data is provided for reference only. Threat Hunter gives no warranty as to its accuracy, completeness, fitness for purpose or non-infringement, and accepts no liability for legal consequences of any action that an organization or individual takes based on it. Any resulting disputes or legal liability rest with the party that took the action.
Part 1 reviews the volume, industry spread and channels of data breaches in the first half of 2025.
1. Overview of data breach risks in the first half of 2025
1.1 Data breaches in the first half of 2025 totaled 57,092, up 1.54% from the second half of 2024
Between January and June 2025, Threat Hunter's data-leak risk monitoring platform collected 180 million intelligence leads across the internet. After checks by the authenticity verification engine and manual analysis by the Digital Risk Response Center (DRRC), 57,092 of them were confirmed as valid data breaches.
From January to March 2025, the number of breaches rose steadily. In April, however, it fell 29.93% from March, a drop of 3,882 incidents. It hit its low point in May at 7,609 and began to recover in June.
Threat Hunter traced this swing mainly to a group-closure campaign that a major encrypted messaging app launched against illegal groups in April 2025. The campaign banned a large number of group chats used for illegal data trading (see section 2.1). A closer look at the sources of the leaks showed the following.
In April 2025, Threat Hunter recorded 9,085 data breaches, 29.93% fewer than in March (12,967). Over the same period, the number of active illegal data-trading groups fell from 1,943 to 1,477, a drop of 23.98%.
Of the illegal data-trading groups that were active in March, 33.71% were banned in April.
As a result, the number of data breaches fell sharply.
However, the app could not ban these groups completely, and the gangs proved very good at regenerating. Many new or replacement groups became active again within a short time, and the number of data breaches rose again in June 2025.
1.2 In the first half of 2025, the top 3 industries saw 1.32 times as many data breaches as the rest of the top 10
Attack groups prefer data targets with high value and high activity. Data breaches across the internet in the first half of 2025 involved 76 industries in total, and the top 3 were e-commerce, consumer finance and banking.
E-commerce and finance, where data is highly sensitive and easy to turn into money, remain the hardest-hit sectors.
The chart below shows how the top 10 industries moved in the rankings in the first half of 2025.
1.3 E-commerce became the industry with the most data breaches, at 3,465 incidents, and cross-border e-commerce leaks grew more than tenfold
Threat Hunter's data-leak risk monitoring platform recorded 3,465 data breaches in e-commerce in the first half of 2025. That is 184 more than in the second half of 2024, an increase of 5.60%.
Cross-border e-commerce stood out. Its incidents rose by 394 compared with the second half of 2024, an increase of more than tenfold. The leaks involved many countries and regions, mostly in Southeast Asia. The top three countries were Vietnam, the United States and Thailand.
1.3.1 Case study: a security weakness at a third-party logistics company exposed shopper data from several cross-border e-commerce platforms
Threat Hunter recently found a threat-actor group on the dark web selling online shopping data from users of a cross-border e-commerce platform. The seller posted data samples and claimed the data covered Southeast Asia, North America and other countries and regions.
Threat Hunter researchers studied fields such as the shipping label and the product label in the leaked data and concluded that the data probably came from a single international express logistics company. Earlier leaks linked to the same company on Chinese-language dark-web forums confirmed that its systems had a security weakness, which an outside threat-actor group exploited to steal user information.
1.4 Dark-web data-leak activity kept rising in the first half of 2025, with incidents up 35.2% from the previous half-year
Threat Hunter's statistics show that anonymous group chats and the dark web remained the main channels for data leaks in the first half of 2025.
Dark-web channels accounted for 18,106 data breaches, an increase of 35.2% over the 13,389 incidents recorded in the second half of 2024.
1.4.1 Activity on Chinese-language dark-web forums surged, and most leaks involved user data from outside China
Further analysis showed that the "Chang'an City" forum had the largest rise in data-leak incidents of any dark-web channel. Its incidents in the first half of 2025 rose 81.7% from the second half of 2024, to 1,493. Another Chinese-language forum, "D*Chinese", went from 272 incidents in 2024 to 560, an increase of 105.9%.
In 2025, 271 users posted data-trading threads on these two forums. Of these, 166 (61.3%) were newly registered users, and their posts covered 1,961 data-leak incidents, more than half of all incidents on the two forums.
Most of these new incidents involved data from platforms or users outside China. "Chang'an** City" alone carried user data from more than 20 countries and regions.
Part 2 looks at how the data-trading market changed in the first half of 2025.
2. Analysis of data trading market trends in the first half of 2025
The illegal data-trading chain is shown below.
Data brokers in the middle of the chain operate on the dark web, threat-actor forums and encrypted messaging apps. They clean, sort and package leaked data and match buyers with sellers, which makes them the key hub of the whole trading chain.
Regulatory pressure keeps rising, but fraud gangs, gray-market e-commerce sellers and other buyers downstream still want high-quality data, and this demand keeps the market active.
2.1 The leading guarantee platform was hit hard, and new guarantee services quickly took its place
"Haowang Guarantee" (formerly "Huiwang Guarantee") operated for a long time on anonymous social platforms, mainly a major encrypted messaging app. By acting as a third-party trust intermediary, it became the main guarantee platform for criminal activity such as data trading, fraud and money laundering, and it dominated the market until the first half of 2025, as the chart below shows.
In May 2025, however, Haowang Guarantee suffered a major blow:
- On May 1, the US Financial Crimes Enforcement Network (FinCEN) named its parent group a "primary money laundering concern" and cut off its access to the international financial system. In early May, the messaging app then banned its trading groups and accounts.
- On May 9, Haowang announced that "a large number of trader accounts have been closed." Its operations collapsed, and its public trading groups stopped working entirely.
The timeline above shows how Haowang Guarantee collapsed and where its business went.
Threat Hunter's monitoring shows that after Haowang Guarantee went offline, the number of data-leak incidents linked to it fell from 832 in March to almost zero in June.
Demand from threat actors did not go away. After Haowang Guarantee collapsed, new platforms such as "Tudou Guarantee" quickly emerged.
Data-leak incidents linked to Tudou Guarantee jumped from 12 in April to 358 in June, an increase of almost 30 times.
In the illegal data-trading market, both supply and demand are very active. This strong demand has created a complete criminal trading chain. But the deals themselves carry high risk and uncertainty, so buyers and sellers find it hard to trust each other directly.
This is why "guarantee platforms" emerged as intermediaries in the criminal ecosystem. They do more than match buyers and sellers: they hold funds in escrow and settle disputes, which makes them a key support for the whole trade. Even when one platform is taken down, new intermediaries soon fill the gap under a different name. As long as the trade exists, there will be demand for these criminal service providers, and that makes them very hard to wipe out.
2.2 Criminal platforms can be shut down, but demand for data trading is hard to eliminate
2.2.1 A crackdown on the leading forum cut supply sharply; before the shutdown it supplied almost 15% of dark-web incidents
Criminal platforms face constant enforcement pressure, yet demand for data trading has not weakened. Take BF, a leading dark-web forum. In the first half of 2025 it was still one of the most important sources of leaked data in the world.
Threat Hunter's monitoring shows that dark-web channels accounted for 15,096 data-leak incidents from January to June 2025. BF contributed 2,190 of them, or 14.5% of all dark-web incidents. Its activity kept rising in the three months before the shutdown and peaked at 657 incidents in March 2025.
When BF was suddenly shut down on April 15, the number of related incidents fell quickly. Only 393 were recorded in April, a drop of 43.2% from March, and the number fell to zero in May. The platform's supply fell off a cliff.
2.2.2 After BF shut down, several other forums quickly took over
Even so, the shutdown did not reduce overall threat-actor activity. Users simply moved to other dark-web platforms and private messaging tools.
The platforms below, tracked by Threat Hunter, show this shift:
- D**s forum: incidents passed 100 in April, rose to 275 in May (up 374% from March) and jumped to 1,095 in June, almost 20 times the level before the shutdown.
- R**d forum: after a short dip in April linked to the BF shutdown, activity rebounded strongly in May and June. June incidents were 138% higher than in April.
- X*S forum: activity had been very low, averaging only 13 data breaches a month from January to March. It rose to 48 in May and 67 in June, an increase of more than 400%.
- E**t forum: incidents rose to 70 in April (up 169% from March) and reached 110 in June, a steady upward trend.
These figures show that the criminal ecosystem can repair itself quickly. When a platform is hit, its traffic, resources and participants soon regroup on new platforms, and market activity recovers fast.
2.2.3 BF's core users moved quickly, and threat-actor activity continued without a break
Threat Hunter found that BF's top ten posters, who accounted for 14.6% of the platform's incidents, moved to other platforms right after the shutdown and stayed active.
BF's most active user in the first half of the year, K***t, is a good example.
Since BF went offline, "K***t" has moved without interruption to the X*S forum and keeps posting user data from outside China, shopping orders, CRM system records and other data. The data covers many types, countries and industries.
The user posts often and in a consistent data format, which suggests strong data-cleaning and distribution skills. This is a typical professional data reseller who adapts easily to new black-market platforms and moves between them efficiently.
The trend shows that core threat actors are highly mobile and resilient. As long as there is demand for data, they can rebuild trading channels quickly and keep the underground market active.
The BF case confirms a basic rule of the cybercrime market: when a main trading platform is taken down, users and demand move quickly to existing or new alternatives. The data-trading market adapts well. Even if the leading platform is destroyed, threat actors can keep their business running through other channels.
Part 3 looks at new trends in the data-breach trading market in the first half of 2025.
3. New Trends in Data Breach Trading Market Research in the First Half of 2025
3.1 Data-leak risk and the criminal ecosystem around credit approval and risk checks
3.1.1 Leaks of "multi-lending" data on individuals grew more than sixfold from the second half of 2024
Threat Hunter recorded 117 leaks of a type of loan data known as "multi-lending" data, 101 more than in the second half of 2024, an increase of 631.25%.
Threat Hunter's intelligence on "multi-lending" credit risk shows that these leaks have been rising more or less steadily since November 2024.
Multi-lending: a risk-check mechanism that detects when a borrower borrows from several lenders at once. It is a data-sharing system set up by a third-party data provider and a group of online lenders. When a borrower applies for a loan at any of these lenders, the application itself is captured and recorded like a signal. In practice, "multi-lending data" means the records of a borrower's loans across several lenders.
Data-leak intelligence: information that Threat Hunter collects from messaging-app groups, the dark web and other channels showing that sensitive personal or organizational information is being traded or used without authorization. It can include old or duplicate data and is often very large in volume.
Data-leak incidents: cases that Threat Hunter's security researchers confirm as valid after analyzing and checking samples of data-leak intelligence and removing old or fake data.
Threat Hunter's analysis shows that what threat actors call "multi-lending" data mainly covers borrowers' repayment history and overdue records. This data plays a key role in credit risk checks because it shows whether a borrower is applying for or holding loans on several platforms. When it is misused, it can seriously distort lenders' decisions and risk assessments. It also exposes borrowers' private information and makes them targets for targeted marketing or fraud.
The sample above, captured by Threat Hunter, includes borrowers' repayment information.
3.1.2 An underground credit-data supply chain has formed around loan records
Threat Hunter's investigation found that an underground supply chain has formed around loan record data. It covers a range of illegal activity: data theft, platform building, data sales, and targeted marketing and fraud downstream.
The supply chain is shown below.
- Upstream: the data comes mainly from credit bureaus and licensed third-party risk-data providers.
As noted above, the "multi-lending" data that threat actors trade mainly covers borrowers' repayment history and overdue records, which show whether a borrower is applying for or holding loans on several platforms. Misuse of this data distorts lenders' risk assessments and exposes borrowers to targeted marketing and fraud.
Threat Hunter also examined the risk-data query systems that threat actors offer. In every case, the user authorization letters involved the same domestic credit bureau.
The figure above shows a threat actor's ad that cites a credit bureau and a third-party risk-data provider.
In the figure above, a threat actor says the data comes from a licensed third-party data provider.
- Midstream: a wave of risk-data query platforms and platform-building services
Threat Hunter found that demand for "multi-lending" data has led many threat actors to advertise risk-data query services or to sell data on borrowers with overdue loans directly. These services usually offer several query and verification functions, such as "multi-lending" checks and "three-factor verification" (name, ID number and phone number). Typical systems Threat Hunter observed include "Fu risk-check query", "Yi risk-check system" and "Xin* risk-check query system".
The figure above shows a threat actor's ad for a risk-data query system.
Threat Hunter also found many threat actors on mainstream social platforms offering to help midstream and downstream groups build the platforms they need, such as "financing guarantee systems", "leasing systems", "risk-check systems", "credit inquiry systems" and "IOU inquiry systems". These offers usually promise full features and complete risk checks, "one-stop services" such as reporting overdue loans to credit bureaus and notarized enforcement of debts, plus "end-to-end support and traffic."
The figure above shows a criminal group's ad for platform-building services.
- Downstream: fuel for targeted marketing, fraud, money laundering and other crime
Threat Hunter found that the people who buy and use these loan records fall mainly into the following groups:
- Lending staff: mainly loan approvers at small and mid-sized lending platforms, who use the illegal data to check applicants' credit standing.
They use it to complete approvals or to pick out target customers for targeted marketing.
- "Score runners": mainly money launderers. After obtaining the data, they win the trust of the people in it and use their bank cards to move illegal funds.
This practice is known as "score running".
- Fraudsters: they run "fish-killing" (also called "shark") scams, mainly through telecom fraud such as loan scams and impersonation of police, prosecutors and courts.
They use the illegally obtained data to target victims precisely and raise their success rate.
- File checkers: in the data-trading market, some services look up an individual's credit status on request, a form of doxxing.
The checker submits the person's name, ID number and phone number to an upstream data query and receives the matching credit report.
In the figure above, the left image shows a midstream threat actor saying the data suits money laundering and fraud, and the right image shows the output of a personal credit report query.
Appendix: Definitions of related slang words
Threat Hunter has researched and tracked intelligence related to "multi-lending" data in depth. The terms below are common slang among the threat actors involved. Finance (also "cw"): staff of loan-shark or private-lending platforms.
Rongdan (also written "RD"): a family of small online lending platforms, mostly small or micro lending apps with a simple application process and a high approval rate. "Rongdan data" means user data from these small lending platforms.
IOU (also "JT"): loan-shark or private loans for which the borrower signs a paper or electronic IOU. "IOU data" means user data from these signed IOUs.
"Anti-aircraft guns": loan-shark platforms or lenders. "Anti-aircraft gun data" means user data from people who borrowed on these platforms.
Device rental: renting devices in installments on rental platforms, often followed by cashing out. "Rental data" means user data from installment deals on these platforms.
Gold: short for "gold mall", small platforms that let users buy gold and pay in installments, much like device rental cash-outs. "Gold mall data" means user data from cash-outs on these platforms.
E-cards and vouchers: like device rental and gold malls, small platforms that sell e-cards, vouchers or gift balances on installment. "E-card data" means user data from cash-out purchases on these platforms.
3.2 Leaks of bank "scan-code application" loan data: trends and the ecosystem behind them
3.2.1 Leaks of bank "scan-code application" loan data grew more than fourfold from the second half of 2024
Threat Hunter's ongoing monitoring found another type of loan-data leak in the first half of 2025, known as "bank scan-code application data". There were 111 such incidents, 89 more than in the second half of 2024, an increase of 404.55%.
Bank scan-code application: data generated when a customer applies for a loan by scanning a loan-campaign QR code given to them by a bank account manager.
Threat Hunter's analysis shows that what threat actors call "overnight scan-code application" data relates mainly to bank loans. It includes the borrower's phone number, city or region and the result of the loan application. Lists of bank loan platforms provided by threat actors cover more than 80 banks, most of them local or commercial banks.
In the figure above, the left image shows the format of the leaked data, and the right image shows threat actors launching an "overnight scan-code application" data product.
3.2.2 Bank "scan-code application" leaks: a fintech marketing tool is the core risk, affecting more than 80 banks
Threat Hunter traced the bank QR codes in the leaked data and found that all of them pointed to the same "xx Marketing Assistant" platform, built by a well-known fintech service provider. Based on the list of bank loan platforms that threat actors published, more than 80 banks are affected.
The flow chart above shows how bank loan-application data leaks.
Because the incidents involve many banks, Threat Hunter reconstructed the process in detail:
- To apply for a loan, the customer scans a loan-campaign QR code provided by a bank account manager.
- The QR code carries the account manager's details and opens the bank's official mini program.
- The customer then chooses a loan product in the mini program and submits an application.
Threat Hunter learned that the account managers' loan QR codes were in fact generated with a sales tool built by a third-party fintech company. (The tool's pages are sensitive, so they are not shown here.)
Threat Hunter's analysis of this fintech company found that it not only builds application software for banks but also supplies smart risk-check strategies, which set different follow-up approaches for borrowers with different credit profiles to support bank account managers. Its main role is to digitize bank operations and grow their lending business. After a customer applies in the bank's official mini program, the bank syncs the customer's details to the sales tool so that account managers can track performance and follow up. This sync also creates a data-leak risk.
The figure above shows threat actors listing the materials needed to apply on different bank loan platforms and how data volumes differ by platform, city and region.
In short, every application submitted in a bank's mini program is copied to the third-party sales tool for account managers to track and follow up, and that copy is where the leak risk arises.
When threat actors first advertised this data, they claimed it came from an insider. Because more than 80 banks are involved, a leak by staff at all of these banks is very unlikely. Threat Hunter's initial assessment is that the leak came from staff at the third-party fintech company.
Threat Hunter's research shows that once this data reaches the illegal data-trading market, it is used mainly by loan brokers for targeted marketing. Threat actors report that it works very well, with success rates of up to 20%, which also indicates that the data is genuine.
Risks and impact:
Customer loss and lost revenue: high-intent customers are contacted by competitors (loan brokers) the day after they apply and offered cheaper or faster alternatives. The bank loses potential customers along with the interest and fee income it could have expected.
Damage to reputation: the leaks badly undermine customers' trust in the bank's ability to protect data, especially in lending, a core business, and will harm the bank's brand over the long term. Regulatory risk: these incidents amount to serious leaks of personal financial information and violate the Personal Information Protection Law and other regulations. As data handlers, banks face heavy fines and regulatory action.
Part 4 describes Threat Hunter's data-leak risk intelligence service.
4. Threat Hunter data leakage risk intelligence service
In summary, data-leak risk remained severe in the first half of 2025. Incident volume stayed high, the criminal supply chain is mature and can repair itself, and shutting down platforms does little to curb market activity.
To meet this threat, organizations need to strengthen how they identify and respond to risk. That means understanding each incident in detail: verifying whether a risk is real, tracing its source quickly, getting leaked data taken down, following up on related risks, and making data-leak monitoring and early warning more timely.
Threat Hunter offers targeted solutions for these needs.
Threat Hunter's data-leak risk monitoring service monitors and mines intelligence from many channels across the internet in real time. Using its risk authenticity verification engine and manual data checks, it provides 24/7 real-time warnings of data-leak risks and links them to emergency response to keep harm and losses to a minimum.
- Internet-wide intelligence monitoring and mining: coverage of the dark web, anonymous group chats, file-sharing and document sites, code-hosting platforms and other channels.
Coverage keeps expanding across several dimensions, including continuous discovery of new channels, dedicated mining of deep intelligence sources ("Deep Source"), and multilingual channel coverage.
- Precise early warning of data-leak risks: for threat-actor trading data that is detected, the risk authenticity verification engine and manual data checks work together.
Together they produce an overall credibility assessment that helps organizations see risks clearly and act on them quickly.
(1) Risk authenticity verification engine: checks whether a risk is real based on three factors: source confidence, three-factor match rate and overlap with historical data.
(2) Manual data verification service: secondary checks, active verification and other methods help organizations judge risks more precisely.
- 24/7 emergency response: Threat Hunter's Digital Risk Response Center (DRRC) monitors, reviews and warns of risk intelligence related to each customer around the clock.
It provides 24/7 sample collection, intelligence mining, help with tracing sources, and takedown services, along with monthly data-leak risk monitoring reports and analysis of typical risk incidents.
Company website: www.threathunter.cn Partnership email: Marketing@threathunter.cn
Complete report
Keep the report for reference
Download the PDF, or open the Chinese edition to verify wording and exhibits.