Huge amounts of personal data stolen, offered for sale in Vietnam

An employee at an advertising company in Ho Chi Minh City recently received an email from a stranger that reads, “I am offering to sell lists of directors and high income earners nationwide, with their necessary personal information including their full names, fixed and mobile telephone numbers, facsimile numbers, emails, occupations, business lines, home and company addresses and more.”

The email included an attachment with a demo version of nearly 200 lists of millions of people working in various fields across the country.

Such lists are being publicly offered for sale online, but when Tuoi Trecorrespondents contacted the people in charge and asked to meet them, most refused and said deals should only take place online and payments should be made by bank transfer only.

However, a dealer named Nha agreed to meet Tuoi Tre at his home in Thu Duc District on October 23.

Nha, 25, showed your correspondents a series of lists of directors, mobile phone subscribers, bank deposit account holders, and shoppers who are members at supermarkets, among other details.

These lists include full basic information about the people named on them.

Notably, among the lists is one that includes 3,400 people with a savings account at a major bank, showing all of their deposits and the balance.

Nha said he had more than 130 lists updated annually to provide to his customers.

Lists are offered for sale at different prices, Nha said, adding that a list of savings account holders costs VND700,000 (US$33), while another list cost VND2 million ($94).

Nha, a college graduate, said he has engaged in “this line of business” for a year and has obtained the lists from people working at different firms including banks, companies and agencies.

Nha can earn VND7-8 million per month through selling personal information, he said.

Truyen (L) is introducing his lists of personal data to a potential customer (Photo: Tuoi Tre)

Another seller of personal data reached by Tuoi Tre is Tuyen, 33, who worked at an insurance company for five years.

Tuyen, a resident in Hanoi, said he owns 168 lists, including thousands of people with savings accounts living in 16 districts in HCMC, 6,700 directors in Hanoi, 9,700 CEOs in HCMC, 5,000 post-paid mobile phone subscribers, 197,000 Vittel subscribers in HCMC and thousands of VIP shoppers at trade centers.

He said all these lists were updated in April so the information is highly accurate. He added that his lists are updated every six months.

Like Nha, Tuyen offered his lists at different prices, from VND1.2 million ($56.5) to VND10 million ($470) per list.

Tuyen revealed that he had to pay staffers at the banks, companies and other entities who provided personal data from their organizations to him.

If they were caught stealing internal information they would be dismissed, Tuyen said.

Another dealer named Long told Tuoi Tre that he owned a database containing 600,000 postpaid mobile phone subscribers and another database of over 4,000 pre-paid cell phone subscribers.

Long offered to sell the postpaid subscriber list for VND7 million ($330), while he set the price of the latter one at VND35 million ($1,650).

He claimed to be a database administrator and affirmed that his lists were updated earlier this month and were 100 percent accurate.

These dealers of personal information have left many people whose date was stolen disturbed.

Purchasers of this stolen information have called or texted the people whose data they have to offer to sell them different things, including houses and phone numbers, or insurance products, among other cases.

Illegal data traders can get seven years in jail

People who steal and trade personal information can be sentenced up to seven years in prison, pursuant to Article 226 of the Vietnamese Penal Code, said lawyer Nguyen Huu The Trach, from the HCMC Bar Association.

Under Article 38 of the Civil Code, an individual's rights to personal secrets shall be respected and protected by law, Trach said.

The collection and publication of information and materials on the private life of an individual must receive consent from that person; in cases where that person has died, lost his civil action capacity or is under fifteen years old, the consent of his/her father, mother, wife, husband, adult children or representative is required, except for cases where the collection and publication of information and materials are conducted through the decision of a competent agency or organization, he added.

Letters, telephone numbers, telegrams, and other forms of electronic information on an individual shall be safely and confidentially guaranteed, Trach said.

The inspection of an individual's letters, telephones, telegrams and/or other forms of electronic information may be performed only in cases where it is so provided for by law and decided by competent state agencies, the lawyer added.