The courier API leak: 1.18 million waybills
Yousu Express handles last-mile delivery for e-commerce sellers in eastern China. On 3 March a security researcher reported that a cloud storage bucket with public read access had exposed 1,180,000 waybill records accumulated over 14 months. Each record held name, mobile number, street address, item description and order value; about 62,000 mentioned 'medication' or 'adult product' in the item description. Access logs show reads from 2,400 distinct IP addresses, 11 of them repeatedly over six months. Yousu's draft incident plan, written by the IT manager, is to close the bucket, email a generic 60-word notice to affected customers five days later, offer a RMB 20 coupon, and not report to the regulator because 'no payment card data or passwords were exposed'. Yousu processes personal information of roughly 8 million individuals and has no designated person in charge of personal information protection.
1. What are Yousu's notification obligations after discovering the leak, and to whom?
Read the worked answer
Article 57 applies in full. Two notifications are owed, in parallel.
- To the department performing personal information protection duties - here the cyberspace administration at the appropriate level, and the sector regulator for the postal and express industry. The obligation is to report the leak and the remedial steps taken.
- To the affected individuals. The notice must state, at minimum: the categories of personal information involved; the cause of the leak and the possible harm; the remedial measures already taken and what the individual can do to mitigate risk; and a contact channel for questions.
Timing. Article 57 requires the handler to act immediately and notify. Unlike the GDPR, the text does not set a 72-hour clock, but 'immediately' rules out the proposed five-day wait; the delay would be treated as an aggravating factor. The trigger is discovery, not certainty about the scope.
Content failures in the draft. A 60-word generic notice cannot carry the four required elements. A RMB 20 coupon is not a remedial measure and looks like an attempt to buy silence, which a regulator will read badly.
Practical sequence: contain the exposure and preserve logs; assess scope and harm; notify the regulator; notify individuals with the required content; offer identity-theft and fraud-monitoring guidance, given that names, phone numbers, addresses and item descriptions together enable highly convincing phishing calls.
2. The IT manager wants to rely on the 'no need to notify individuals' exception. Is it available?
Read the worked answer
No. The exception in Article 57 is narrow and does not fit these facts.
The exception applies where the handler has taken effective measures that can avoid harm caused by the leak - the classic example is data that was properly encrypted so that the exposed material is unreadable. If that condition is met, the handler may skip notifying individuals but must still notify the department.
Why it fails here:
- The bucket was publicly readable, so anyone could read the records in the clear; nothing prevented harm.
- Logs show active reading from 2,400 IP addresses, 11 of them repeatedly, which is evidence of harm rather than avoidance of it.
- Names, mobile numbers, precise addresses and item descriptions are a ready-made phishing and doorstep-fraud kit. The 62,000 records mentioning medication or adult products create a specific risk of sensitive disclosure and embarrassment that raises, not lowers, the case for individual notice.
The exception is a narrow carve-out for handlers who have already neutralised the risk. It is not a discretion to decide that the leaked data 'does not matter'. Treating it that way converts a containment incident into a concealment incident - and Article 66 allows fines of up to RMB 50 million or 5% of the previous year's turnover for serious violations, plus suspension of business, with personal liability for responsible individuals.
3. What structural governance failures does this incident expose, and what should Yousu put in place?
Read the worked answer
Several failures are independent of the leak itself.
- No designated person in charge (Article 52). A handler whose volume of processed personal information reaches the threshold set by the cyberspace administration must appoint a person in charge of personal information protection with clear responsibilities. With 8 million individuals, Yousu is far past any threshold, and the appointment must be real - decision rights, budget, and a reporting line to top management.
- Security measures (Article 51). Required measures include internal rules and operating procedures, classification and management by data category, encryption and de-identification, training, contingency plans and periodic audits. A public-read object store for 14 months means the classification and access-control controls did not exist in practice.
- Retention discipline. Waybills accumulated over 14 months with full addresses and item descriptions. Article 19 requires the shortest necessary retention period; most of this data should have been deleted or de-identified after delivery confirmation.
- Incident response. The plan was drafted by IT alone with no legal, communications or security component. It should define severity tiers, decision rights, notification templates pre-approved by legal, evidence preservation, and a rehearsal schedule.
- Compliance audit (Article 54). Handlers must audit their compliance regularly; audit findings should have surfaced the storage configuration.
- Evidence retention. Incident records and the impact assessment material should be retained for at least three years so that a later regulatory review can be answered with documents rather than assurances.