YS168 Data Breach
The 2017 YS168 (永硕E盘) data breach occurred in February 2017 when the user database of YS168 (ys168.com), a long-running Chinese cloud storage and network disk hosting provider, was leaked online.
Exposed Data Types
3- Email addresses
- Usernames
- Passwords
About This Breach
What information was affected in the YS168 incident?
The leaked membership dataset (ys168.com.txt) contains registered user credentials for cloud storage accounts. The breach compromised records for 276,985 unique individuals, exposing:
- Account Identifiers: Account usernames.
- Contact Credentials: Canonical email addresses across major domestic Chinese providers (163.com, 126.com, 21cn.com, qq.com, citiz.net) and international services.
- Authentication Secrets: Plaintext account passwords.
How many accounts were affected?
Rigorous RFC canonical parsing and deduplication confirmed 276,985 unique valid email addresses.
Technical analysis and security risks
The leak reveals that user credentials were stored completely unhashed in plaintext. Exposure of plain passwords paired directly with email identities poses immediate risks of automated credential-stuffing attacks across webmail and financial accounts.
Recommended actions for affected users
Users who registered with YS168 should:
- Immediately update passwords on any email or personal accounts where their storage password was reused.
- Enable two-factor authentication (2FA) across all vital online services.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
