Inside the Great Firewall Part 1: The Dump

A public Deep Dive reports a historic breach of China’s censorship infrastructure, leaking over 500GB of internal data from Great Firewall infrastructure in September 2025, with researchers noting the full dump is closer to ~600GB and a single archive around 500GB. The leak exposes more than 7,000 files, including raw IP logs from state-run providers and PCAPs, routing tables, SSL fingerprints, and metadata across Word, Excel, and PowerPoint documents that reveal usernames, organisations, and edit histories.

The breach is framed as exposing the human and organisational backbone of the GFW, linking operators to ministries, state-owned ISPs such as China Telecom, China Unicom and China Mobile, and academic partners, with a multi-tier enforcement model spanning national to provincial levels. Authors of internal documents are traced to individual operators, engineers, and analysts, and the dataset highlights how tools like Psiphon, V2Ray, and Shadowsocks are tested and fingerprinted within censorship workflows.

According to WIRED, the dataset offers a unique, highly actionable blueprint of China’s digital surveillance regime, including how DPI, TLS fingerprinting, and VPN/proxy detection are implemented, and the likely access pathways that enabled the breach.