U.S.-listed shares of Alibaba Group
The move isn't entirely surprising given the sheer scale of the data stolen, which contained information on one billion Chinese citizens. The database was hosted on Alibaba's cloud platform, according to third-party investigators and confirmed by employees at the company. While the database was stored in a secured server, a publicly available web portal was created without any form of password protection.
The database carried an endemic flaw, however, that made it impossible for a password to be created in the first place.
According to cybersecurity firms LeakIX and SecurityDiscovery, the platform offered by Alibaba to the Shanghai police were outdated and lacked many security features, including the ability to set a password. While available through an add-on to the program, it was not installed on the database. The database, which analysts believed had been left unmaintained for a number of years, was left vulnerable for at least a year before the theft.
Having potentially been partially culpable for a historically massive data breach isn't a good look for Alibaba, even at a time when Chinese tech companies are facing widespread scrutiny from domestic regulators. The sheer scale of the breach and the glaring issues with Alibaba's product both make for reputational stains that are a bit too large to ignore. The company's cloud business, a fairly large enterprise stretching from China to the European Union, is likely to take a hit from the breach.
While company has seen some relief from the over 70% loss in share value it has suffered since its pandemic highs, Alibaba's security stumbles within its cloud division could be a severe detriment to the value of its ADRs.
Alibaba shares slid 4% on Thursday following initial reports by the Wall Street Journal of the meeting between authorities and Alibaba executives. Friday saw an early morning plunge, but the company managed to reverse some of that plunge by market close, sliding 1%.
