One Hacker Stole 10 Petabytes From China’s Supercomputer — Through a VPN
One Hacker Stole 10 Petabytes From China’s Supercomputer — Through a VPNsomeone walked into the digital equivalent of fort knox with a stolen keycard and spent six months loading trucks
10+ petabytes of classified Chinese defense data — missile schematics, aerospace research, fusion simulations — allegedly exfiltrated through a single compromised VPN domain. the attacker deployed a botnet inside the system and nobody noticed for half a year.
The hacker, going by “FlamingChina,” posted samples on Telegram in February and is now selling the full dataset for hundreds of thousands of dollars in crypto. Multiple cybersecurity experts who reviewed the samples say they appear genuine. This might be the largest known data heist from China. Ever.
🧩 Dumb Mode Dictionary
| Term | Translation |
|---|---|
| NSCC | National Supercomputing Center — China’s state-run supercomputer network. Think of it as the government’s shared hard drive for 6,000+ organizations |
| Petabyte | 1,000 terabytes. 10 petabytes = roughly 10 million HD movies. or about 2,500 times the size of the entire Library of Congress |
| VPN domain | The login gateway for remote access. Compromising it = getting the front door key |
| Botnet | A swarm of automated programs that do your bidding inside a network. In this case, they quietly siphoned data for months |
| Exfiltration | Fancy word for stealing data out of a network without triggering alarms |
| Tianhe | “Milky Way” — the supercomputer series housed at Tianjin NSCC. Once ranked #1 globally |
📖 How It Went Down
- A hacker (or group) calling themselves FlamingChina compromised a VPN domain connected to the Tianjin National Supercomputing Center
- Once inside, they deployed a botnet — automated programs that extracted, downloaded, and stored data
- The entire operation took approximately 6 months without detection
- On February 6, 2026, FlamingChina posted samples on a Telegram channel
- They’re selling previews for thousands of dollars; full access costs hundreds of thousands in cryptocurrency
you read that right. six months. inside a supercomputer that serves china’s defense sector. undetected.
🎯 What Got Stolen
The alleged dataset includes files from some of China’s most sensitive organizations:
| Organization | What They Do |
|---|---|
| Aviation Industry Corporation of China | Military aircraft, drones, fighter jets |
| Commercial Aircraft Corporation of China | Commercial aviation (C919 program) |
| National University of Defense Technology | Military R&D, the people who built Tianhe |
Types of files reportedly in the dump:
- Documents marked “秘密” (Secret) in Chinese
- Missile schematics and weapons renderings
- Animated simulations of defense equipment (bombs, missiles)
- Aerospace engineering research
- Bioinformatics datasets
- Fusion simulation data
this isn’t some customer database leak. this is war-room stuff.
📊 Putting 10 Petabytes in Perspective
| Comparison | Size |
|---|---|
| 10 petabytes | 10,240 terabytes |
| All of Netflix’s content | ~15 petabytes |
| Library of Congress (digital) | ~4 petabytes |
| The Pentagon Papers (original) | a few filing cabinets |
| This hack | roughly 2.5 Libraries of Congress |
For context, the famous OPM hack in 2015 (which exposed 21.5 million federal employee records) was measured in terabytes. This is measured in petabytes. It’s not even the same conversation.
🗣️ What the Experts Are Saying
- Marc Hofer (cybersecurity researcher who communicated with FlamingChina): Reviewed data samples and found them consistent with legitimate classified research output
- Multiple CNN-consulted experts: Initial assessment indicates the leak appears genuine
- Documents marked “secret” in Chinese matched formatting conventions used by PLA-affiliated research institutions
- CNN itself cannot independently verify the dataset’s origins — but nobody credible has called it fake either
the silence from Beijing is lowkey the loudest confirmation.
💬 The Bigger Problem Nobody's Talking About
China’s NSCC in Tianjin serves over 6,000 clients. That’s universities, defense contractors, AI research labs, biotech firms, and nuclear research facilities — all running through one hub.
A single VPN compromise gave access to ALL of it.
This is the “put all your eggs in one basket” meme but the basket is a nation-state’s entire defense research infrastructure and the eggs are missile blueprints. The centralization that made the Tianhe supercomputer powerful is the same thing that made this breach catastrophic.
when your security posture is “nobody would dare hack a supercomputer,” you’ve already lost.
Cool. China’s supercomputer got cleaned out like a Black Friday Walmart. Now What the Hell Do We Do? (⊙_⊙)
🛡️ Audit Your Own VPN and Remote Access Setup
This breach started with a compromised VPN domain. If you’re running any kind of remote access — for a business, a homelab, or even a personal server — now’s the time to check your configs. Rotate credentials. Enable MFA everywhere. Review who has access. VPNs are not magic invisibility cloaks; they’re doors, and doors need locks.
Example: A sysadmin in Warsaw, Poland audited his company’s FortiGate VPN after reading about a similar CVE, found 3 dormant admin accounts from ex-employees, and closed them before they became a problem. His CISO bought him lunch.
Timeline: This weekend — check your remote access configs, revoke stale credentials, enable MFA if you haven’t
🔍 Start Monitoring Outbound Data Volume
FlamingChina moved 10 petabytes out over 6 months and nobody flagged it. Most organizations don’t monitor egress traffic at all. Set up alerts for unusual outbound data patterns. Tools like Zeek (free, open source) or even basic NetFlow analysis can catch large data transfers that don’t match normal behavior.
Example: A network engineer at a São Paulo, Brazil fintech noticed a 400GB spike in nightly egress after deploying Zeek. Turned out a compromised Docker container was exfiltrating customer payment tokens to a C2 server in Moldova. Caught in 48 hours instead of 6 months.
💼 If You Work in Defense or Gov — Assume Breach
Zero trust isn’t a buzzword anymore, it’s a survival strategy. If a Chinese supercomputer serving 6,000 clients can get owned through a VPN, your agency’s network is not immune. Push for network segmentation. Assume the perimeter is already broken. Monitor lateral movement.
Example: An IT director at a Canadian defense contractor in Ottawa pushed to segment their R&D network from corporate after the SolarWinds fallout. When a phishing attack compromised an HR workstation in 2025, the attackers couldn’t reach any project files. The segmentation held.
📱 Track the Leak on Threat Intel Feeds
The FlamingChina dump is being sold on Telegram and potentially dark web markets. If you work in cybersecurity, aerospace, or defense — monitor threat intelligence feeds for samples from this breach. Knowing what’s out there helps you understand what adversaries know.
Example: A threat intel analyst at a Tel Aviv, Israel cybersecurity firm scraped Telegram channels for FlamingChina sample listings, mapped the file structures to known Chinese defense contractor naming conventions, and published IOCs that helped two European aerospace firms check if their joint-venture data was in the dump.
🧠 Learn From the Centralization Failure
The NSCC model — one supercomputer hub serving thousands of clients — is efficient but creates a single catastrophic point of failure. If you’re architecting systems (cloud, on-prem, hybrid), think about blast radius. What happens when one node falls? Can an attacker pivot from your dev environment to prod? From one tenant to another?
Example: A cloud architect at a Bangalore, India SaaS startup redesigned their AWS setup after learning about the Kaseya supply chain attack. She isolated each customer tenant into separate VPCs with no cross-account IAM roles. When a credential leak hit one tenant in early 2026, zero lateral movement occurred.
🛠️ Follow-Up Actions
| Step | Action | Tool/Resource |
|---|---|---|
| 1 | Audit all VPN and remote access credentials | Your VPN vendor’s admin console + MFA provider |
| 2 | Set up outbound data monitoring | Zeek (free), NetFlow, or your firewall’s built-in alerting |
| 3 | Review network segmentation | Draw your network topology — if everything touches everything, fix that |
| 4 | Subscribe to threat intel for this breach | Recorded Future, AlienVault OTX, Telegram OSINT channels |
| 5 | Run a tabletop exercise | “What if our VPN got compromised?” — walk through the scenario with your team |
Quick Hits
| Want to… | Do this |
|---|---|
 Understand the scale |
10 PB ≈ 2.5x the entire Library of Congress. Moved over 6 months. Undetected. |
 Protect your own network |
Audit VPN access, kill dormant accounts, monitor egress traffic |
 Track the fallout |
Watch threat intel feeds for FlamingChina sample drops on Telegram |
| Learn the lesson |
Centralization = efficiency AND catastrophic single points of failure |
 Start today |
Enable MFA on every remote access point you control. Right now. |
china built a supercomputer that could simulate nuclear fusion — and lost it all because someone forgot to patch a VPN. the strongest lock doesn’t matter if the door is made of cardboard.
!