List of information of businesses and businesses for sale online (screenshot).

A Google search about personal data gets countless results related to websites that provide information trading services. Specifically, when typing the keyword “danh sach khach hang” (customer list), about 254 million results appear with many websites such as: Danhsachmoi.com, Danhsachkhachhang.net, Fulldata.org, Danhsachkhachhang.biz.

These websites provide two types of services, free or paid. Even with a free data package, some websites are ready to publish a list of customers on the site, including name, age, address, phone number. Paid data packages are more specific, with information about job, workplace, interests, marital status, children. There is also information about those who own a car, those who bought life insurance, those with saving accounts, the lists of parents of school children, and the list of entrepreneurs.

Such data packages are also offered for sale on groups on Facebook. For example, a group named “Data khach hang tiem nang” (potential customer data) with more than 10,000 members introduces itself as "a place to exchange, freely buy and sell, and exchange data of potential customers from all industries and fields”. Another group with more than 8,000 members is called the "National association for buying, selling and exchanging potential data".

These websites and groups all request transactions through bank accounts and e-wallets, and send sales data via email. When the transaction is complete, the buyer can immediately download the file containing the customer list.

“We sell all kinds of data, priced from a few hundred to several million, tens of millions VND. But we don't meet face to face, just transferring money and you will get the data,” a man named Tuan told a VietNamNet reporter, who acted as a data buyer.

Consequences of personal information leak

The disclosure of personal information, including phone numbers and addresses, causes many troubles for many people, who receive dozens of calls every day inviting them to buy a car, house or life insurance.

Many people publicly post personal information on social networks, enabling network applications to secretly collect their information.

Many online services often collect, exploit and analyze personal information and data of their customers but do not have a mechanism to manage data safely. Personal data collected by these services becomes input material for exploitation in other fields.

Dr. Chu Thi Hoa, Deputy Director of the Institute of Legal Sciences (Ministry of Justice), said that in Vietnam, the sanctions for dealing with acts of buying and selling personal data in cyberspace are inadequate to deter and prevent violations.

Cybersecurity expert Ngo Minh Hieu told VietNamNet that personal information and data exposed online can be used to perform fraudulent acts. “The theft of information, especially identity cards, causes dangers that we cannot fully anticipate. The most typical example is being used to register e-wallet to trick others to transfer money. A bit more complicated, the information on the real ID card will be used to make a fake version, which is used to register bank accounts and make false documents for unsecured loans,” Hieu said.

Trading of personal data online is no longer a new issue in Vietnam, but in recent years, it has been rampant. Many businesses allow partners to access their customer data sources or are ready to sell their customer information.

In the past three years, the authorities have detected many large-scale data trading rings.

On January 15, 2022, the largest interprovincial-scale illegal trade of personal information and data was discovered by the Thua Thien Hue Provincial Police Agency. Defendants earned VND2.3 billion from selling information of about 6.2 million people.

Previously, 1,300 GB of data containing billions of information about individuals and organizations was publicly offered for sale online. The police forces have destroyed many forums of hackers.

Ka Mi

Heavy sanctions needed to prevent illegal trade of personal data

The personal data of many Vietnamese users is being illegally appropriated and even traded in the cyberspace.

The Ministry of Public Security completes draft decree on cybersecurity fines

The act of buying and selling personal data of over 10,000 people should result in a fine of VND80-100 million (nearly US$3,500), according to a proposal by the Ministry of Public Security.