Many people are complacent in dealing with personal information. — Photo thanhnien.vn

Recently, the trend of "flexing" has been booming on Facebook.

Huỳnh Đình Trọng, a 31-year-old man, an employee at Ipix Trading and Service Import-Export Limited Liability Company in HCM City's District 1, is no exception to this trend.

Trọng proudly displayed all of his diplomas and certificates, including the ones he received as a student, until he started working. Shortly after, Trọng discovered that much of his personal information was being offered for sale on a website called "datakhachhang". Among these were his workplace address, hometown, permanent residence, phone number, personal photos and email.

"I was truly too naive when I shared so much information on social media. Having my personal data leaked is the "price to pay" for such carelessness," Trọng remarked.

Hà Duy Khánh, a 25-year-old man working at An Bình Trading Limited Liability Company in District 8, HCM City, was befuddled to see his date of birth, phone number, personal and work emails, weight and marital status all exposed on the internet, leading to frequent annoying "spam" calls.

But Khánh soon had the answer to his own question: "It's because I exposed my personal information myself." The information had been posted by Khánh on Facebook. "Instead of setting privacy settings, hiding information from others, I posted it publicly. I made a mistake."

Unknown traps

Khánh admitted that throughout his time on social media, he often casually shared all sorts of photos and information about himself from when he was young to the present. On numerous occasions, Khánh even flaunted his bank account number and balance. Moreover, he posted images of his house with details about the number of rooms, various entrances, and the arrangement of furniture. Khánh shared all of this on Facebook.

According to Đỗ Trọng Tiên, 34, the reason his information was leaked, allowing strangers to know detailed information about many family members, is because he used to post photos and tagged his father, mother, aunts and uncles.

"I was too careless and complacent about securing my personal data. As a result, all my information has been exposed," Tiên said.

Lâm Văn Trường, 29, a director of a marketing services company in HCMC, believes that many young people nowadays don't hesitate to provide personal information to others in order to gain benefits on social media.

"For example, many fan pages post content offering gifts to those who interact by leaving personal information. And many people are willing to do so. They provide a lot of information like: Facebook links, personal photos, phone numbers and addresses. For immediate gain, many people fail to recognize the 'trap' that these fan pages set up to collect information," Trường explained.

Sharing the same perspective, cybersecurity expert and former hacker Ngô Minh Hiếu, also known as Hiếu PC and currently working at National Cyberspace Security Monitoring Center, Information Security Department, said that most young people understood that personal information is highly important and should be kept secured.

"However, when they see posts about discounts, promotions, or winning prizes on various fan pages, many people willingly provide both personal and private information to receive free gifts. In doing so, they unintentionally create opportunities for businesses to collect personal data," Hiếu shared.

According to Hiếu, many people are quite careless when it comes to security. They don't research the risks, fail to consider the consequences, and thoughtlessly participate in social media trends, especially on Facebook, such as posting photos of their face from 10 years ago or determining which celebrity they resemble. In doing so, they unknowingly fall into the "trap" of sharing personal information.

Trần Anh Phú, 32, a director of a company specialising in Facebook-related services in District 4, HCMC, believes that a common mistake people make in exposing their personal information is "sharing everything on Facebook." They check in everywhere they go, take photos, share information about the places they visit, or their daily workspaces. Some even go as far as posting their monthly salaries, bank account numbers, tax identification numbers, and their children's school addresses.

Phú added, "Another reason for personal information leakage is the casual installation of 'cracked' software on computers or mobile applications. If you install software or applications from unreliable sources, there's a high likelihood of exposing your information and giving away all your data to malicious actors. This is because we cannot rule out that some of these applications have features that track user behavior and steal information."

Furthermore, Phú pointed out, "Currently, we are living in a digital transformation era. However, many people's awareness of information security hasn't caught up with this trend. Most of the personal information of social media users in Việt Nam is voluntarily shared by the individuals themselves. Many people are too careless, which leads to personal information leakage."

According to Hiếu, most services today in many fields include terms that allow the exploitation of personal data, which is embedded in the general policy when users register. This term is often represented by a small line of text that says, "By clicking Register, the user agrees to the policy." And the majority of people accept these terms without reading them because they are either lazy or find them too lengthy.

"Therefore, in addition to subjective reasons, people may leak their personal information in a passive manner that they cannot control. This is because hackers attack the security vulnerabilities of the entities or businesses that hold information. Additionally, employees of entities such as banks, telecommunications companies, hospitals, power companies, etc., may access information technology systems and then sell data to third parties. Furthermore, user data from social media platforms can also be leaked. For instance, a few years ago, data from 267 million Facebook users, including those in Việt Nam, was leaked on a hacker website. The leaked data included user identification codes, phone numbers, and full names of Facebook users," Hiếu explained.

One reason behind eighty per cent of data leaks

Nguyễn Phú Lương, Deputy Head of the Information Security Monitoring Department at the National Cybersecurity Monitoring Center. — Photo courtesy of Nguyễn Phú Lương

According to Nguyễn Phú Lương, Deputy Head of the Information Security Monitoring Department at the National Cybersecurity Monitoring Center, under the Authority of Information Security (Ministry of Information and Communications), 80 per cent of personal information leakage originates from the user's own carelessness.

"These are convenient opportunities for malicious actors to collect personal information and data for profit," said Lương.

To exemplify, Lương added that users provide personal information when registering accounts or services. Users set their personal information to public when using services. On various buying and selling platforms and groups, both sellers and buyers often publicly share personal information such as phone numbers and bank account details for ease of contact. Or users choose to use services from unreliable intermediaries who lack proper information security policies or have inadequate information security policies.

According to Lương, the remaining 20 per cent is due to service providers sharing or leaking personal information. This can happen due to vulnerabilities in the systems and applications of the service providers (including educational institutions' systems). Or it could be due to weaknesses in the customer information security policies of the service providers. Some businesses may intentionally share customer information with third parties.

Leaking personal information, especially mobile phone numbers and account names on social networks like Facebook and Instagram, can lead users to encounter issues such as spam messages and advertising messages.

"Malicious actors may use a user's real photo to create fake accounts to deceive their friends and family. Information in photos, such as the child's name, the name of the educational institution, dormitory location, school pick-up/drop-off tags, etc., can also become useful information for cybercriminals when users publicly share them on social media. Cybercriminals can use the information voluntarily provided by users or collected in some way to threaten extortion, kidnapping, or trick users into transferring money to the criminal's account," said Lương.

Users advised to be vigilant

When facing the risk of personal information leakage, users can take measures to prevent adverse situations. However, it's crucial that users act quickly, and the first step is to change their passwords as soon as possible.

If it's related to financial information, users should notify their bank and financial institutions to consider blocking credit cards.

If there are suspicions about transactions, immediately check and report to the bank or credit organisation. The leakage of information from one account can pose risks to other accounts, especially when passwords are shared or accounts regularly transact with each other.

According to Lương, the Ministry of Information and Communications plans to instruct firms to enhance the protection of personal data, implement measures to manage and protect personal data, and guide measures to protect personal data and ensure cybersecurity for systems containing personal data.

Furthermore, inspections and audits of sectors under the management of the Ministry of Information and Communications will focus on units that collect and process large amounts of personal information, such as social networks, telecommunications businesses, postal services, and multi-user platforms.

The Ministry continues to monitor and review the situation of leakage, buying and selling of personal information of agencies and organizations in Việt Nam, and provide timely warnings and support. At the same time, it is raising awareness among the people about protecting personal information and using tools for reporting to protect personal information.

Another solution is to promote the deployment of the Trust Ecosystem (tinnhiemmang.vn) to evaluate and confirm websites that ensure network information security, including personal data protection. — VNS