Chinese police probe unauthorized and highly unusual online dump of documents

The interior of the I-Soon office, also known as Anxun in Mandarin, is seen after office hours in Chengdu

Chinese police are investigating an unauthorized and highly unusual online dump of documents from a private security contractor linked to the nation’s top policing agency and other parts of its government — a trove that catalogs apparent hacking activity and tools to spy on both Chinese and foreigners.

Among the apparent targets of tools provided by the impacted company, I-Soon: ethnicities and dissidents in parts of China that have seen significant anti-government protests.

The dump of scores of documents late last week and subsequent investigation were confirmed by two employees of I-Soon, known as Anxun in Mandarin, which has ties to the powerful Ministry of Public Security. The dump, which analysts consider highly significant even if it does not reveal any especially novel or potent tools, includes hundreds of pages of contracts, marketing presentations, product manuals, and client and employee lists.

The documents show apparent I-Soon hacking of networks across Central and Southeast Asia, as well as Hong Kong and Taiwan.

The hacking tools are used by Chinese agents to unmask users of social media platforms outside China such as X, formerly known as Twitter, break into email and hide the online activity of overseas agents. Also described are devices disguised as power strips and batteries that can be used to compromise Wi-Fi networks.

I-Soon and Chinese police are investigating how the files were leaked, the two I-Soon employees told The Associated Press.

One of the employees said I-Soon held a meeting Wednesday about the leak and were told it wouldn’t affect business too much and to “continue working as normal.” The AP is not naming the employees — who did provide their surnames, per common Chinese practice — out of concern about possible retribution.

The source of the leak is not known. The Chinese Foreign Ministry did not immediately respond to a request for comment. MDT/AP