It has been reported that on September 11, 2025, nearly 600 gigabytes of classified materials linked to the Great Firewall of China have emerged online in a breach of China's closely guarded internet censorship machinery, which is a breach of scale that has never been experienced. This leaked cache of internal GFW documents, which experts have described as the largest exposure of internal GFW documents ever in history, provides a rare opportunity to get a closer look at Beijing's highly automated digital surveillance system.
It is a collection of data that has been gathered from Geedge Networks, a company founded and led by Fang Binxing, one of the most renowned scientists in the world, along with the MESA Lab at the Institute of Information Engineering of the Chinese Academy of Sciences, which has collected and archived source code, internal communications, development logs, and archives of project management tools for a period of many years.
According to researchers who examined the document, the revelation not only confirms Chinese national security sweeping domestic control, but reveals how censorship and surveillance technology, packaged as deployable hardware and software systems, has been exported overseas.
Geedge's services are indicated in the documents, not only to sensitive domestic regions such as Xinjiang, Jiangsu, and Fujian, but also to governments in Myanmar, Pakistan, Ethiopia, and Kazakhstan, with further signs that the company's services may be deployed under the Belt and Road Initiative.
A 500GB archive of server repositories, detailed manuals, and operational files is one of the details of the breach that indicates not just a compromise of a state secret but also a glimpse into how China's digital authoritarian model of digital authority has been refined and marketed for international use as well.
There are two pivotal institutions at the heart of China's online censorship regime, which are referred to in the cache of leaked files: Geedge Networks and MESA Lab of the Institute of Information Engineering under the Chinese Academy of Sciences. As a result of the work of Geedge, led by its chief scientist, Fang Binxing— widely known as “Father of the Great Firewall”—Geedge has been seen for decades as the technical brain behind the operation of the firewall system.
There has been a forensic investigation into the incident, and it appears the attackers have exploited an incorrectly configured private code repository to gain access to backup snapshots, archived communications, and development environments. A single mirror archive of RPM packaging servers was estimated to have accounted for 500 GB of the material that was exposed, along with years' worth of documentation, JIRA project management data, and technical manuals.
It turned out that the breach exposed nearly 600 gigabytes of data.
In the files, scientists found evidence that Geedge was not only located in provinces such as Xinjiang, Jiangsu, and Fujian, which represent some of the worst cases of domestic censorship, but was also supplying censorship as a service to other countries under the Belt and Road Initiative.
The contract and proposal details the provision of keyword blacklists, real-time traffic monitoring, cloud-based filtering appliances, and other services to the governments of Myanmar, Pakistan, Ethiopia, and Kazakhstan, with diplomatic communications suggesting additional undisclosed customers.
In the leak, a parallel role also comes to light for MESA Lab, which was established in 2012 as the Processing Architecture Team for "Massive Effective Stream Analysis" and eventually became an international research centre worth millions of yuan.
The lab maintains internal source code and development records, which expose sophisticated algorithms for packet inspection, dynamic rule enforcement, and evasion detection, including simulated testing against encrypted tunnels circumvention tools as well as testing against encryption tunnels and circumventions.
The documents, which have been carefully reviewed by organisations such as GFW Report and Net4People on isolated systems, are seen as a groundbreaking intelligence breakthrough by analysts. They provide an unparalleled understanding of the mechanism of state-sponsored internet controls while raising important questions regarding the export of authoritarian surveillance techniques to the global marketplace.
The leaked cache contains nearly 600 gigabytes and tens of thousands of files and repositories, and together, they provide a rare and intricate insight into the machinery of China's censorship system, with its complex and comprehensive policies governing the internet.
In its core lies a massive 500GB mirror archive of RPM packaging servers. This demonstrates to us that, in addition to being a political construct, the Great Firewall is a highly engineered software ecosystem that is maintained to the same standard as a large, corporate-scale IT operation. Additional archives such as geedge_docs.tar.zst and mesalab_docs.tar.zst contain countless internal reports and research proposals.
A number of the files referencing projects such as “CTF-AWD,” “BRI,” and “CPEC” suggest connections and international collaborations that are based on the Belt and Road Initiative, while project management data and communication drafts show the coordination of researchers and engineers on a daily basis.
Even though many documents appear mundane, such as reimbursement receipts and documents labelled simply “Print”, censorship is still an institutionalised part of bureaucratic processes and procedures.
There are a number of things that distinguish this leak from other types of breaches, the most remarkable being its breadth and granularity. Instead of only a few emails or whistleblower memos, this collection comprises raw operational information that reveals years of investment, research, and development.
Several independent researchers, including Net4People, Hackread.com, and others, have noted that the file tree itself tells a great deal about the Firewall's evolution into a distributed, export-ready system. Additionally, the background materials also examine how the MESA Lab grew in 2012 from a small research lab at the Chinese Academy of Sciences into a multi-million dollar operation that contributed to national cybersecurity awards in 2016, which had been opened in 2016.
Originally created under the guidance of Fang Binxing, who is given credit for designing the Great Firewall, Geedge Networks quickly absorbed the talents of the MESA and has quickly emerged as one of the few private firms capable of supporting state censorship both domestically and internationally.
The immediate revelations of Chinese internet control infrastructure confirm what many observers have long suspected: that while the full analysis of source code may take months, they already confirm what many observers have long suspected. There is no static or insular Chinese internet control infrastructure. Instead, it is a living system shaped by government contracts, academic research, and private enterprise, and increasingly packaged for export to other countries.
A hacktivist group behind the disclosure has warned that examining the files should only be done in an isolated environment because there might be embedded malware and tracking elements in them. Despite these dangers, researchers and rights advocates argue that the trove offers the chance to gain a comprehensive understanding of the Great Firewall, both in terms of how it worsens and how its influence is being systematically extended outside of the country.
This unprecedented exposé of the Great Firewall's inner workings is far more than a breach - it marks an important turning point in the global debate around digital rights, sovereignty, and the export of surveillance technology worldwide. In the context of governments, these files provide an unfiltered look at how authoritarian states operationalised censorship, transforming it into a scaled, almost commodified system that is capable of deploying well outside their own borders.
As researchers and civil society groups, we find that this material is an invaluable resource unravelling censorship mechanisms, developing countermeasures, and creating stronger tools to circumvent censorship.
As a result of these revelations, policymakers around the world need to look at how Chinese surveillance infrastructure is spread through initiatives like the Belt and Road initiative, and to weigh the geopolitical implications of supporting regimes that restrict freedom of expression to take appropriate measures.
Since the data is subject to potential security risks, it is imperative to handle it carefully.
However, its availability presents an excellent opportunity to improve transparency, accountability, and resilience against digital authoritarianism, as well as strengthening transparency, accountability, and resilience. If used responsibly, this leak could not only reshape the way people perceive China's censorship model but also help to spark international efforts to safeguard the open internet in general.
.webp "Panama and Vietnam Governments Suffer Cyber Attacks, Data Leaked")
.webp)
