What is actually known
On 26 October 2026, a newly emerged extortion group called WhiteArmor listed Hisense on its leak site. It claims 19GB of stolen data and demands $5 million in Bitcoin. According to Daily Security Review, the listing covers warranty-claims archives for Malaysia and Singapore, including customer names, phone numbers, emails and ID numbers, plus invoices, contracts and records for 2,549 suppliers. A 348KB sample was posted but could not be opened because its host was not responding. Hisense has published no statement, and nothing has been independently verified.
That caution matters. Extortion groups routinely overstate what they hold, and a listing is a marketing document. The useful question is not whether the claim is true. It is what China's rulebook would require if it were.
What the rules require
The CAC's National Cybersecurity Incident Reporting Management Measures (国家网络安全事件报告管理办法) were issued on 11 September 2025 and took effect on 1 November 2025, according to the official text on cac.gov.cn. Article 4 sets the clocks. Network operators generally must report to the provincial CAC office as soon as possible and no later than four hours after an incident. Critical information infrastructure operators get one hour. Central state organs get two. Major and particularly major incidents are escalated to the national CAC within an hour. Only incidents graded "relatively major" or above are covered, which is why Latham & Watkins notes that ordinary "general" incidents fall outside the deadlines.
For ransomware, Article 7 adds specific content. The report must include the amount demanded, the payment method and the payment date. Mayer Brown's December 2025 summary confirms that reading.
The case for the rule
The strongest argument for a hard four-hour clock is collective. Extortion crews reuse access, tooling and infrastructure. A regulator that hears about an intrusion within hours can warn other operators, help contain lateral spread and preserve evidence before it is overwritten. Asking victims for the ransom amount and payment method also gives authorities data on which groups are active and how they price. Voluntary reporting regimes have historically produced thin, late and sanitised disclosures, and a firm deadline is a reasonable response to that.
We accept most of that logic. Fast, structured reporting to a regulator is not the same as public shaming, and the measures themselves are careful on this point. Article 11 provides for reduced or no penalties where an operator took reasonable protective measures and reported on time.
Where the design is thin
The Hisense episode exposes three gaps that matter for any company deciding how much to trust the regime.
First, scope against foreign-held data. Article 2 applies to operators that build or run networks in China or provide services through networks within China. The Hisense claim concerns Malaysian and Singapore customer warranty data. Neither the CAC text nor the law-firm summaries we reviewed say whether data held for overseas markets, possibly on overseas systems, triggers the Chinese clock. A multinational with a Chinese parent cannot tell from the text which regulator is first in line. Malaysia's data regulator runs its own data breach notification portal, so the same incident could create parallel obligations in several jurisdictions with different clocks. Any firm in that position should confirm the local deadlines with counsel rather than assume one filing covers all of them.
Second, the clock itself. The measures do not say when the four hours begin. Latham reads it as likely running from when the operator becomes aware, but that is an inference. For a leak-site claim, awareness is itself ambiguous. Is it the moment the group posts, the moment someone at the company sees the post, or the moment forensics confirms a breach? A rule that punishes late reporting while leaving the trigger undefined pushes companies toward reporting every unverified claim. That floods the regulator with noise and penalises the careful verification the regulator should want.
Third, enforcement is open-ended. Article 10 says authorities punish late or missed reports under existing laws, and that where late, omitted, false or concealed reporting causes serious harm, the operator and responsible individuals face heavier penalties. Mayer Brown notes that the measures set no specific penalties of their own. Proportionate regulation means predictable consequences. Personal liability for individuals, set against vague thresholds, tends to produce defensive over-reporting, or worse, quiet concealment.
What a better version would do
None of this calls for abandoning the rule. Three adjustments would make it work better for the people it is meant to protect.
- Define the trigger. Say that the clock runs from reasonable confirmation of a reportable incident, and allow a short preliminary notice for unverified claims.
- Clarify extraterritorial treatment. State whether data on foreign systems or about foreign customers is covered, and how the measures interact with other countries' breach rules.
- Publish penalty ranges and the mitigation practice. Operators who report promptly should know in advance what credit they earn.
On the ransom question, reporting demand details is sensible for intelligence, but it should not become a back door to payment bans. The evidence on bans is mixed, and an outright prohibition would leave victims with the weakest options when backups fail. Keeping the regime focused on reporting and resilience, not on criminalising victims, is the proportionate path and the one most compatible with an open, innovative digital economy.
The test ahead
If Hisense reports promptly and the claim proves overstated, the regime will have worked as designed. If the claim is real and the company stays silent, outside observers will have no way to tell whether the measures were followed, because reports go to regulators, not the public. That opacity is the underlying problem. Without aggregate, anonymised statistics on reports received, deadlines met and penalties imposed, no one outside government can judge whether four hours is a workable standard or an aspirational one. The sensible next step for the CAC is to publish that data, along with a clarification on foreign-held data.