An account named Ox1337xO, created on RaidForums in May 2021, announced a sale of a 17GB data package on May 13. This package is supposed to include details of citizen ID cards of many Vietnamese people. The post was then deleted, but was still stored in the cache of Google search engine, and has raised serious concern over information safety.

In his article, the hacker advertised that the data includes name, date of birth, avatar, address, email, phone number, identity card number, and photos of the identity cards of the back and front side.

The hacker offered the data for $9,000, paid by cryptocurrencies as Bitcoin or Litecoin, or by Vietnamese dong through an intermediary who is also a member of the forum. In a recent move, the hacker said he was willing to sell the data for only $4,300.

Mr. Ngo Tuan Anh, Bkav's Vice President in charge of cybersecurity, said that the 17G data included video clips, and the number of exposed user accounts was not high.

Besides, as this is merely the data of Pi Network cryptocurrency, the true volume of ID card information leak is only a little. Adding to this is the fact that Ox1337xO is an anonymous name which has just been created and requires cryptocurrency as the payment method.

Therefore, it can be said that this data transaction is most likely a scam.

BKAV’s Tuan Anh confirmed that there is no evidence to show an information leak from the national population database of Vietnam.

However, he also commented that this is a serious issue since the information of nearly 10,000 people, including sensitive ones such as eKYC clips and the front and back pictures of citizen ID card, is illegally sold publicly.

Trong Dat/Van Anh