Hackers tried to access over 20 million active accounts on the Taobao shopping site, Chinese state media has said.
Inputting login details from a stolen database of 99 million, they found nearly 21 million of the usernames were also being used for Taobao accounts.
And, in November 2015, attempts to access those accounts were detected.
Owner Alibaba advised customers to change their passwords, and Chinese police have now made arrests in connection with the attempted hack.
“Alibaba’s system was never breached,” a spokesman said.