Sistemas da National Immigration Administration · Breach

Actor claims breach of China's National Immigration Administration

Nov 09, 2026 · 1 min read

A threat actor claims to have hacked China's National Immigration Administration. The post lists more than 37,000 entry and exit records with personal data and 401 operator and administrator accounts, including passwords. The claim is unverified.

By HIFY Radar newsroom Updated 11/09/2026 10:38 AM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Alleged

An actor branding itself IndianCyberForce claims to have hacked China's National Immigration Administration. In a pair of X posts on November 8, 2026, roughly 34 minutes apart, the actor first announced the breach and then published a detailed inventory allegedly exfiltrated: 37K+ person records with Chinese-labeled entry-exit fields, 34K+ operational log rows, and credentials for 401 operators, admins and other officials.

Inferred

The claim was also pushed through the group's Telegram channel (IndianCyberForceTG). Nothing in the available evidence verifies that any breach or data theft actually occurred; the material is entirely actor-controlled and should be treated as an unverified claim pending independent validation.

What happened

Observed

At approximately 09:53 UTC on November 8, 2026, the X account CyberForceX1 posted: "National Immigration Administration Government of China Has Been Hacked", tagging the posts #IndianCyberForce and #PaperDragon, with an attached image.

Observed

About 34 minutes later, the account CyberForceX posted a follow-up titled "National Immigration Administration Of China Has Been Hacked: Data Breached", enumerating three alleged datasets and their database field names, plus a link, repeating the same hashtags.

Observed

The Telegram channel IndianCyberForceTG, tracked via RSS, carried the claim at the same timestamp as the detailed post, indicating cross-platform syndication of the announcement by the same group.

Why it matters

Inferred

If authentic, the claimed haul is significant: it includes identity documents, nationalities, birth dates and vessel movements of travelers or crew crossing Chinese borders, plus usernames, passwords, emails and mobile numbers for 401 officials: data that could enable identity fraud, tracking of individuals, or follow-on intrusion into border-management systems.

Inferred

The #PaperDragon taunt frames the operation within ongoing India–China hacktivist rivalry, where exaggerated breach claims are commonly used for visibility and propaganda. That context cuts both ways: some such claims later prove real, many are fabricated or recycled, so the specific field-level detail here warrants scrutiny rather than automatic dismissal or acceptance.

What to do

Inferred

Treat the breach as unverified. Analysts should monitor the IndianCyberForce Telegram channel and associated X accounts for follow-up data samples, monitor breach-verification platforms for any deposited datasets, and check whether the actor publishes proof such as record samples or database screenshots.

Inferred

Organizations whose personnel or operations intersect with Chinese port entry-exit procedures should note the claimed leak of 401 operator/administrator usernames and passwords, and apply standard precautions: credential monitoring, rotation of any shared or exposed accounts, and phishing awareness: until the claim is substantiated or discarded.

Confirmed and still uncertain

Observed

Known: two X posts (CyberForceX1 and CyberForceX) and one Telegram channel post claiming the breach, including alleged record counts (37K+, 34K+, 401 accounts) and full field lists for each dataset. The claim is dated November 8, 2026.

Inferred

Unknown: whether the National Immigration Administration was actually compromised; whether any of the claimed data is genuine or current; whether the 401 passwords are plaintext, hashed, or fabricated; the time or method of the alleged intrusion; and any victim or third-party confirmation. The evidence batch contains no data samples, no verification, and no independent reporting.

What people are saying

Observed

CyberForceX1, in the initial post: "National Immigration Administration Government of China Has Been Hacked": followed by the hashtags #IndianCyberForce and #PaperDragon.

Observed

CyberForceX, in the follow-up: "National Immigration Administration Of China Has Been Hacked: Data Breached", listing "37K+", "34K+" and "401 operators, admin, other officials" as the exfiltrated categories, again closing with #IndianCyberForce and #PaperDragon.

Observed

No statements from the National Immigration Administration of China, Chinese authorities, researchers, or other threat actors are present in the evidence batch; the conversation so far consists solely of the actor's own announcements.

Evolution

Observed

The operation unfolded in two steps: a bare announcement of the hack at ~09:53 UTC on November 8, 2026, followed at ~10:27 UTC by the detailed breach inventory with database schemas and record counts. The Telegram channel item carries the same timestamp as the second post, marking the start of cross-platform distribution.

Inferred

As of the current evidence, there is no follow-on activity: no data release, no sample dump, and no takedown or denial: so the story's next likely developments would be a proof dump, a victim statement, or silence from the actor.

Reach

Observed

2 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

Dataset 1 (claimed 37K+ rows) appears to be a person-level entry-exit table with Chinese field labels: XM (name), XBDM (gender code), ZJLBDM (document type code), CRJZJHM (document number), GJDQDM (nationality code), CSRQ (birth date), JTGJ (associated vessel), SBR (declarant), CRRQSJ (entry-exit date), CRSJD (entry-exit time period), CRBZ (entry-exit flag), port (berthing point), and cre_time (declaration time).

Alleged

Dataset 2 (claimed 34K+ rows) has the shape of an application or audit log: module_id, op_type, data, cre_time, realname, company, department, port.

Alleged

Dataset 3 (claimed 401 accounts) is an administrator/operator table: rid, username, password, realname, email, mobile, status, parent_id, create_time, version, port, company, department, sex, birthday, type, admin_id, admin_time, admin_name. The actor lists a plain "password" column; whether it holds plaintext, hashes, or is invented cannot be determined from the post.

Inferred

The field naming conventions (CRJ-prefixed entry-exit codes, pinyin abbreviations) are consistent with a Chinese border entry-exit management data model, which suggests the schema was either observed in a real system or carefully fabricated by someone familiar with one.

Sources and evidence

Observed

The evidence base consists of three items, all originating from the claiming actor: an X post by CyberForceX1 announcing the hack, a detailed X post by CyberForceX listing the alleged datasets, and the RSS-tracked Telegram channel t.me/IndianCyberForceTG designated as the primary source for the group's activity.

Inferred

Evidence assessment: the Telegram feed item contains no body text, and neither X post includes verifiable data samples. There is no independent corroboration, no victim communication, and no third-party reporting in the batch, so the breach claim currently rests entirely on the actor's self-published assertions.