Online personal data thefts on the rise in Shanghai

Public prosecutors in Shanghai warned of a sharp increase in theft of personal information online, with criminals stealing and selling data for various criminal purposes, ranging from telecom fraud to racketeering.

According to prosecutors, there was only one such case involving eight suspects during the first half of 2012, but the same period in 2013 has seen 30 cases involving 57 suspects.

"More than half of the suspects committed the crime by taking advantage of their positions, and their motive is to promote products or obtain money by the transaction," Gu Xiaomin, director of the public prosecution division of the Shanghai People's Procuratorate, said at a news conference on Monday.

He said that many cases involve employees in online shopping companies passing on the financial data obtained from their customers. Most of the suspects are under 30 years of age and have a good educational background, at least a college degree, with some holding PhDs.

Pudong prosecution agency investigated 10 cases involving the leak of more than 20 million items of information, including member information from some shopping websites. The information was leaked by an employee at a shopping platform who had access to the company's core database.

Prosecutors identified one suspect as a man named Xu, the former director of operations for Yihaodian, a major Chinese online grocery store. They said Xu had incited his former colleague, a man named Peng, to obtain the password for the company's database, which he did with the help of a technician named Miao.

Between October 2010 and September 2011, Peng logged on to the database three times and stole nearly 4 million items of client information, including their names, mobile phone numbers and addresses, prosecutors said.

Most of the stolen information was passed to sales people wishing to promote products. Some of those sales people even sold the information, publishing it online.

A manager of a handiwork company, who was identified as Liu by the prosecuting agency, paid around 4,000 yuan ($652) for personal information and then resold it to a dozen people across the country, making a profit of more than 40,000 yuan.

"The fact that some data was intentionally leaked by employees shows their lack of social integrity, as well as the loopholes in the confidentiality system of some businesses, such as allowing logging in to the database from a wide area network," said Wen Lan, a spokeswoman for the Shanghai People's Procuratorate.

The lack of social integrity is highlighted by one case, in which Shanghai police detained four suspects in June on suspicion of illegally purchasing the family details of at least 400 students online and then obtaining money from their parents by disguising themselves as surgeons and teachers and claiming the children required urgent medical treatment.

Concern over the security of personal data is not restricted to online shopping, however. Some have also expressed concern of data security at government agencies.

Yi Shenghua, director of criminal cases at the Yingke Law Firm in Beijing, told China Daily, "Authorities should limit who has access to citizens' information within government departments."