Be aware of the risk of personal data leaks and breaches.
Personal data is increasingly becoming a valuable asset in the digital environment, but it is also a target for illegal collection, trading, and use. This reality not only poses a risk of violating privacy rights but also creates opportunities for various types of crime, especially cyber fraud. Therefore, every individual, agency, and organization must proactively raise awareness of data protection.
When personal data becomes a "commodity"
At the end of June 2026, the Cyber Security and High-Tech Crime Prevention Department, in coordination with the Security Investigation Agency of the Nghe An Provincial Police, dismantled a large-scale illegal personal data trading ring.
Through monitoring online activities, authorities discovered several individuals using Facebook and Telegram groups to sell personal data. The collected data was then compiled and edited using software before being sold to interested parties for illicit profit. To conceal their activities, these individuals used virtual wallets and bank accounts that were not registered in their names for transactions, frequently changed their residences, and communicated through online platforms.
During the investigation, on June 23, 2026, the Nghe An Provincial Police arrested Phung Xuan Duong (born in 1980, residing in Phu Tho province), the ringleader of the network, and summoned NVD (born in 2005, residing in Nghe An) to clarify his involvement in the illegal buying and selling of personal data. During the search, authorities seized 2 CPUs, 2 laptops, 4 mobile phones, and thousands of data files totaling over 72GB, containing over 50 million pieces of personal information of citizens nationwide. Initial findings indicate that from June 2025 to the present, the suspects have illegally profited over 1 billion VND; this includes data on many officials, civil servants, students, and business leaders. Notably, the data trading activities of the suspects involved foreign elements, and Phung Xuan Duong had a prior conviction for the illegal buying and selling of personal data.
Previously, through monitoring online activities, authorities discovered numerous accounts in private groups posting and selling large amounts of personal data. Investigations determined that NHA (16 years old, residing in Nghe An), a 10th-grade student, had self-taught programming and exploited security vulnerabilities to illegally access the National Immunization Information System, collecting approximately 20 million pieces of personal data from citizens nationwide and then selling them on groups specializing in data trading. On June 5, 2026, authorities prosecuted NHA for the illegal provision or use of computer network and telecommunications information, and for illegally accessing the computer networks, telecommunications networks, or electronic devices of others. Initial findings indicate that the suspect profited illegally by more than 100 million VND.
These are just two of many cases of illegal trading of personal data that authorities have recently discovered and handled. When personal data is treated as a kind of "commodity," with just basic user information, perpetrators can use it to carry out many illegal activities, especially online fraud.
This situation has caused considerable concern among residents. According to Ms. Nguyen Ha An from Vinh Hung ward, she frequently receives calls from unknown numbers offering loans, investments, and other services. What's concerning is that the callers know her exact name, address, and other personal information. "Sometimes I'm startled because they know so much about me, even though I haven't provided it to them," Ms. An shared.
Protecting personal data starts with each individual.
According to the Law on Personal Data Protection 2025, personal data is information that helps identify or recognize an individual and is protected by law. In the context of digital transformation, data not only serves to resolve administrative procedures, financial transactions, healthcare, and education, but also becomes an important resource for socio-economic development.
However, along with the expansion of connectivity and data sharing between systems comes the risk of information insecurity if there is a lack of synchronized protection solutions.
Many data breaches don't actually stem from sophisticated cyberattacks, but rather from carelessness during use. Using weak passwords, sharing passwords across multiple accounts, sharing login information, accessing fake links, or installing software from unknown sources can all create opportunities for malicious actors to steal data.
Lieutenant Colonel Tran Thien Giang - Head of the Cyber Security and High-Tech Crime Prevention Department, Nghe An Provincial Police.
This shows that, besides technical factors, people remain the most important link in data protection. When security awareness is low, even a single careless action can lead to the compromise of personal information or the data of an organization or unit.
In reality, many people still have the habit of posting images of their national identity cards, airline tickets, and personal documents on social media; easily providing information when participating in promotional programs, online surveys, or downloading applications from unofficial sources. These are all methods that criminals exploit to collect data.
Not only citizens, but also some agencies and businesses still do not truly prioritize the protection of customer data. Access control, account management, security vulnerability checks, or monitoring of data exploitation are not yet rigorous, increasing the risk of information leaks and breaches.
The consequences of losing personal data extend beyond annoying spam calls. Once they have access to a victim's information, perpetrators can create highly convincing scams, impersonating relatives, banks, or government agencies to steal assets; they can even use someone else's identity to open accounts, borrow money, or commit other illegal acts.
To mitigate this risk, authorities advise citizens not to provide images of their national identity cards, bank account information, or biometric data to organizations or individuals of unknown origin; not to access suspicious links or open unidentified files; and not to rent, lend, or sell bank accounts, e-wallets, or personal identification information in any form.
In addition, everyone should proactively use strong passwords, activate two-factor authentication for important accounts, regularly update security software, and check for unusual transactions. If you detect any signs of data breaches or suspect fraud, you should quickly contact your bank, the police, or the relevant management unit for timely assistance.
For agencies, organizations, and businesses, along with investing in technical infrastructure, it is necessary to regularly review security vulnerabilities, strictly control data sharing, assign access rights according to function, and raise awareness among staff in the process of managing and exploiting data.
Digital transformation is only truly effective when coupled with data security. Protecting personal data is no longer solely the responsibility of authorities, but the responsibility of every individual, every agency, and every business. Only when each person proactively protects their information and each organization considers data security a mandatory requirement in its management activities can a secure digital environment be built, creating a foundation for the development of the digital economy and society, and mitigating the consequences of high-tech crime.
