JD Data Breach (2013): What Was Exposed & What To Do

In 2013, the Chinese e-commerce service JD experienced a data breach that exposed 13GB of data containing 77 million unique email addresses along with usernames, phone numbers and passwords stored as SHA-1 hashes. The incident was reported on 1 January 2013, though the precise date of the intrusion remains unknown. Public records provide no further attribution or technical details on how access was obtained.

Inside the incident

The breach affected 77.4 million individuals. The exposed material included email addresses, usernames, phone numbers and passwords hashed with SHA-1. The dataset totalled 13GB. No information has been released on the method of intrusion, the duration of unauthorised access or any subsequent actions taken by the organisation.

How a breach like this happens

Incidents involving large volumes of customer account data often begin with the compromise of an internet-facing system such as a web application or database server. Attackers may exploit unpatched software, weak authentication controls or stolen credentials to gain entry. Once inside, they can copy files containing user records and remove them without immediate detection. In many cases the organisation learns of the event only after the data appears on public forums or is offered for sale.

JD and its sector

JD operates as a major e-commerce platform in China, providing online retail services to millions of customers. Organisations in this sector routinely collect and store account credentials, contact details and transaction-related identifiers to manage user logins and order fulfilment. A breach at such a service therefore involves records that can be reused across other online platforms.

What was likely exposed

The breach record lists four categories of information. Exact confirmation of every field present in the 13GB dataset has not been published.

• Email addresses
• Usernames
• Phone numbers
• Passwords stored as SHA-1 hashes

Why it matters

Compromised email addresses and usernames can be used for targeted phishing campaigns. Phone numbers add another channel for social-engineering attempts. Passwords hashed with SHA-1, an algorithm now considered weak, may be cracked offline if the original values were simple or reused elsewhere. For the organisation, the event highlights the long-term operational cost of storing large volumes of customer identifiers without additional protective measures such as salting or stronger hashing.

If your data was in this breach

Individuals can change passwords on any accounts that reuse the affected credentials and enable multi-factor authentication where available. Monitoring email and phone activity for unusual login attempts provides an early indication of misuse. Readers can run a free exposure scan of their email address to check whether their information has surfaced in known breach data.

AICompiled with AI assistance from public sources and published under our editorial standards.