Proactive data security – a shield against cyber threats.
In the context of a rapidly developing digital economy, personal data has become an exceptionally important asset for every individual and organization. However, the leakage, unauthorized collection, sale, and use of personal data in Vietnam are becoming increasingly complex, causing serious consequences.
Alarming situation regarding the leakage and unauthorized access of personal data.
Recently, the constant stream of spam calls, loan solicitations, real estate advertisements, and calls impersonating police officers or bank employees has become a nightmare for many people. Even more worrying, behind these are high-tech criminal networks, sophisticated data brokers and fraudsters who exploit security vulnerabilities and user carelessness to steal assets, invade privacy, and threaten social security.
In recent years, the Nghe An Provincial Police have investigated and dismantled many cases related to illegal activities such as: collecting, storing, exchanging, and selling information about bank accounts and personal information... The perpetrators often use sophisticated methods such as creating fake accounts, using disposable SIM cards, renting or borrowing bank accounts, collecting personal information through social media and online applications, and then selling it to fraud rings for asset misappropriation and money laundering.
Specifically, on October 11, 2023, the Criminal Police Department of Nghe An Province successfully cracked a case, arresting 8 individuals involved in a ring that illegally bought and sold bank account information for the purpose of defrauding people of their assets. This ring was led by Pham Ngoc Dat (born in 2002), residing in Anh Son commune. According to authorities, in 2020, Dat worked in Cambodia. There, he learned that some individuals in Cambodia needed to buy bank account information from others at high prices for criminal activities. After returning to Vietnam, Pham Ngoc Dat recruited 7 other individuals, all residing in the former Anh Son district, to work as collaborators in the bank account information buying ring.
To obtain bank account information, Dat and other members of the network posted advertisements offering to buy bank account information for advertising campaigns at a price of 1.5 million VND per account. After acquiring the bank account information, Dat proactively contacted individuals abroad and resold it for 4 million VND per account.
During the investigation, the police initially determined that Dat's group had defrauded and acquired information from 23 bank accounts, profiting illegally by over 55 million VND. Notably, all accounts, after being sold by Dat to individuals in Cambodia, were used to commit online fraud and embezzle assets, with transaction amounts reaching up to 200 billion VND per account.
For example, on December 15, 2024, the Nghe An Provincial Police, in coordination with the Criminal Police Department of the Ministry of Public Security, the Professional Department of the Ministry of Public Security, and the police of many provinces and cities, successfully dismantled a criminal ring, arresting 41 individuals involved in the illegal collection, storage, exchange, sale, and public disclosure of bank account information; fraud and money laundering.
This is a criminal gang with completely new characteristics and methods, organized and with specific roles assigned to its members, led by Vu Trung Kien (born in 1994), residing in Hung Yen province (formerly Thai Binh); Pham Hoang Hiep (born in 1992), residing in Nghe An; Vu Hoang Nha (born in 1984) and Hoang Xuan Truong (born in 1988), both residing in Ninh Binh province.
These individuals target various segments of society, professions, and age groups, especially the elderly, low-income workers, those lacking legal knowledge, or students, to hire them to open bank accounts in exchange for payment ranging from 500,000 to 4,000,000 VND per account.
After obtaining bank accounts, this group resold them to fraudsters in Cambodia to receive and launder money obtained from criminal activities. In a short period of time, the criminals rented and purchased more than 500 accounts at various banks (including both personal and business accounts) for the purpose of fraud and money laundering.
Notably, the money obtained from the scams, transferred to accounts obtained from victims, is then further transferred by the ringleaders through various other accounts to purchase USDT cryptocurrency, thereby erasing traces of the crime and avoiding detection by authorities.
The reality is that personal data is being exploited rampantly online, from seemingly harmless activities like registering for Wi-Fi, receiving offers, participating in surveys, and using free applications, to systems within businesses and organizations. With just a few searches, you can easily find advertisements selling personal information in private groups: from full names, phone numbers, and addresses to even national ID card information, bank accounts, and credit history. The price is only a few hundred to a few thousand dong, but the price those whose information is leaked can pay is enormous, ranging from harassment to the risk of fraud and theft.
Solutions and legal frameworks for protecting personal data.
In response to this situation, on June 26, 2025, at the 9th session of the 15th National Assembly, the Law on Personal Data Protection was passed, effective from January 1, 2026. The law clearly stipulates each individual's rights regarding their data, including the right to know, consent to, access, modify, restrict processing, request deletion of data, and be notified when data is leaked.
In particular, the Law on Personal Data Protection clearly specifies prohibited acts such as: using another person's personal data; allowing others to use one's personal data to commit acts contrary to the law; buying or selling personal data; misappropriating, intentionally disclosing, or losing personal data...
At the same time, the law places strict responsibilities on agencies and businesses that collect data: They must be transparent about the purpose, use it only within the permitted scope, maintain information confidentiality, and notify in case of incidents.
Currently, the Ministry of Public Security is also drafting a Decree detailing and implementing the Law, seeking opinions from agencies, organizations, and individuals. The draft aims to standardize data processing procedures, require businesses to appoint data protection departments, conduct periodic risk assessments, monitor data transfers abroad, and tighten data management in the finance, banking, e-commerce, healthcare, and telecommunications sectors.
However, many believe that the most important thing to prevent the leakage of personal data is community participation. People need to be more vigilant, not share information with unclear applications or websites; not rent or lend their bank accounts or personal documents; set strong passwords and enable two-factor authentication; be wary of strange messages and links; and when they discover a breach, they must immediately report it to the authorities.
From a business perspective, data protection is not just about legal compliance; it's also crucial for building user trust. Businesses need to invest in cybersecurity, data encryption, access control, employee training, incident response procedures, and absolutely refrain from commercializing customer information.
Only when the entire society participates can we build a safe and transparent digital environment, creating a solid foundation for socio-economic development and protecting the legitimate rights of citizens in the digital age.
