Personal data is widely sold online like a cheap commodity

(Dan Tri) - Data on students, business households, pregnant women or newborns and countless other categories are being blatantly sold on "data markets" despite the risk of being fined up to 3 billion VND.

Annoying calls know every personal information

Ms. Thu Ha's phone (28 years old, Quang Ninh) has almost never stopped ringing since giving birth to her baby.

Initially, it was an introduction to using the baby bath service at home. Next came a series of invitations for postpartum massage packages, milk stimulation, mother and baby care, photo shoots, and even advertising nutritional products.

Notably, what surprised Ms. Ha was that the person on the other end of the line knew her information very well.

"They called me by my name, knew I had just given birth, and even asked if the baby had been nearly a month old. Some people even knew whether I had a cesarean section or a normal birth," Ms. Ha said.

I refused many times but the calls continued. One day, she was frustrated because she received nearly a dozen calls from different units.

"I just wonder one thing: I have never registered or filled out any information with them, so where did they get the information?", she said.

Not only postpartum mothers like Ms. Ha, many young people who are students also fall into the same situation.

As a third-year student at a university in Hanoi, Thanh Thao (21 years old) constantly receives calls inviting her to learn English, provide job consulting, and skill courses for students.

What made Thao wary was that the counselor not only read her full name correctly but also knew the school she was attending, major, course, and even knew the address where she was living.

"There was a time when I thought I was the only one having this problem, but after asking my friends, I found out that there are some people who have the same problem as me," Thanh Thao said.

Repeated calls to find out personal information made Thao not only feel frustrated but also worried about her personal information being leaked and illegally sold (Illustration: Viet Anh).

The repeated calls made Thao not only feel annoyed but also worried about personal information being illegally collected and shared.

There are times when she is in class, on a shift at work, on the chaotic streets, or when she is busy, and her phone keeps ringing, disturbing her.

Despite blocking many unknown numbers, just a few days later, similar calls came again from other phone numbers.

Besides Thao's case, on forums and social networks, it is not difficult to come across similar complaints.

Worryingly, besides marketing calls from businesses and brands, there are calls that show signs of fraud.

In particular, the subjects often claim to be bank employees, authorities, delivery units or network operators, and at the same time read their full name, phone number, address, and even some other personal information to create trust to lure the victim.

Stories like the above are no longer strange. After each call, many people feel sore, tired and have the same question: Where did they get their data from?

Sales data is "as expensive as hot cakes"

Although it is a strictly prohibited act and has been punished in many cases, even up to the criminal level, illegal trading of personal data still takes place blatantly on social networks.

With just a few simple searches with keywords such as "Buying and selling data", "customer data", "personal data", Dan Tri reporters can easily access a series of groups specializing in exchanging, buying and selling data.

As noted, instead of posts offering for sale appearing densely, most of the content in the groups are posts looking to buy data.

Buyers often leave information anonymously and then continuously post their need to search for personal information in each field, while sellers will proactively leave comments and invite contact via Telegram and Zalo.

Posing as a person who needed to buy personal data of students in the inner city of Hanoi to serve marketing activities, the reporter posted an article looking to buy in a group with more than 20,000 members.

Just a short time later, dozens of accounts left offers like "I sell data and send the file to the bank after many checks", "I have the data you need", "contact me via telegram, I have enough", "inbox us to discuss further".

In the comments section, an anonymous account named "Hubi9712" claimed to be "Vietnam's number one data warehouse, providing all types of data such as business households, rich residents, dating applications, hot delivery, students, calling applications" and attached Telegram information.

Contact this person, they do not need to verify their identity or purpose of use but quickly introduce the service to the reporter.

Just state the need, the seller will immediately search for the type of data the customer wants, then continuously make attractive offers, even sending sample files for customers to preview (Screenshot).

With the desire to buy data of students born in 2004 to 2007, this person immediately found the file and sent a screenshot of the data file.

"I have it all in every year of birth", "I have scores, information about everything", "buying in bulk and there are discounts" are the accompanying affirmations.

According to the quote provided, the data is divided into levels, for example the basic data type will cost 500,000 VND for 1,000 students, while the VIP type with more information will cost 1 million VND for 1,000 students.

When the reporter expressed his sincere desire to buy the VIP type, the seller sent a sample file with many private and important information fields of the student such as full name, citizen identification card, gender, date of birth, field of study, hometown, phone number, email, living address, place of birth.

Faced with reservations about its reputation, this account immediately sent a series of images of previous transactions with the commitment: "If you transfer money, I will give you the file in a minute, I won't make you wait anything."

They are even willing to let the buyer find an intermediary for the sale transaction.

At another clue, when a reporter asked to buy data on women who had just given birth, this person also quickly sent a price quote with an introduction that the data could be classified by province or time of childbirth.

The seller also affirms that he can provide new data periodically if customers have long-term purchasing needs.

Approaching many different contacts shows that personal information of many target groups is being sold as a common commodity.

Even though the Personal Data Protection Law 2025 has taken effect, trading behavior is still complicated. Accordingly, Article 7 of the Law clearly stipulates that the act of buying and selling personal data is a strictly prohibited act.

If an organization or individual commits a violation, depending on the nature, extent and consequences, they may be subject to administrative sanctions or criminal prosecution. In particular, the maximum fine in sanctioning administrative violations is 10 times the revenue earned from the violation.

In case there is no revenue from the violation or the fine calculated based on the revenue from the violation is lower than the maximum fine, the maximum fine is 3 billion VND for organizations and 1.5 billion VND for individuals.