China Cracks Down on Personal Information Crimes

China’s Cybersecurity Bureau of the Ministry of Public Security has published 10 typical cases of crimes against citizens’ personal information, exposing a sophisticated black-market data industry that spans multiple sectors and criminal methods. The announcement, reported by Xinhua News and republished by People’s Daily, reveals how criminals use inducement, hacking attacks, and insider collusion to illegally obtain and profit from massive volumes of personal data.

A Coordinated Law Enforcement Action

The 10 cases, released on August 11, 2026, span criminal operations across at least 10 provinces and municipalities, from Shenyang in the northeast to Guangdong in the south. The personal information involved ranges from several thousand to several million records per case, with the highest case value reaching over 11 million yuan (approximately $1.5 million), according to Legal Daily. All suspects in the 10 cases have been dealt with according to law, with penalties ranging from criminal coercive measures to formal indictments.

Diverse Criminal Methods Exposed

The cases reveal a disturbing variety of techniques used to harvest and monetize personal data:

Identity theft through fake business registration. In Shenyang, Liaoning, a gang led by Yang Mouguo, 25, recruited unsuspecting individuals with cash incentives of 200-300 yuan to register e-commerce accounts and business licenses. The accounts were then sold for 100-300 yuan each to gambling and telecom fraud gangs, with over 3,000 records of personal information illegally obtained and 27 suspects placed under criminal coercive measures.

Account trafficking to overseas fraud gangs. A gang in Gansu province, led by Cui Mouwei, 38, used social media and short video platforms to purchase real-name accounts for WeChat, QQ, and Douyin, reselling them to overseas fraud gangs for telecom scams. The operation involved over 20,000 records of personal information and 1.3 million yuan in case value, with six suspects transferred for prosecution.

Hacking and social engineering databases. In Anhui, Liu Mouyuan, 20, and associates built a “social engineering database” using hacking techniques, providing paid personal information query services to lawyers, private detectives, and information brokers. Nine suspects were transferred for prosecution.

E-commerce order decryption. A scheme in Sichuan advertised “order decryption” services on Douyin, Kuaishou, and Xiaohongshu, illegally obtaining over 2 million records of e-commerce order data including phone numbers and addresses. The case value reached 8 million yuan, with five suspects transferred for prosecution.

Insider Threats Across Industries

Several cases highlight the growing threat of “insiders” (内鬼) within legitimate businesses who leak customer data for profit. In Guangdong, a gang infiltrated a real estate agency by having an operative hired as an employee, who then used technical means to bypass security and scrape agent information in bulk. The data was sold to decoration companies with a 2% commission on closed deals.

In Shanxi, an education and training industry insider named Wang Moujie, 34, exchanged and sold student data across multiple institutions, also purchasing data from eye hospitals and schools. The operation formed an “insider theft, industry trafficking, precision marketing” criminal chain involving over 500,000 records, with 12 suspects indicted.

A particularly elaborate scheme in Shaanxi involved a decoration industry black-market chain led by Shi Mou, 33, and Huang Mouwei, 29. The gang collected personal information from decoration companies and purchased data from government data maintenance companies, demolition service companies, property management firms, sales offices, and even village committees. Over 6 million records were trafficked, with 11 suspects indicted.

The Shared Charging Bank Scheme

The most sophisticated case involved a Shanghai gang that established a shared charging device company, placing free charging banks in budget hotels. In exchange for “review manipulation services,” hotels provided guest names and check-in times. The gang operated as a full company with sales, technology, positive review, negative review, and after-sales departments, illegally obtaining over 1 million records and manipulating more than 100,000 online reviews. The case value exceeded 11 million yuan, with 33 suspects indicted.

Sensitive Data Trafficking and Private Investigation

Two cases exposed the trade in highly sensitive personal information. In Jiangsu, Xia Mouqiang, 38, established a “legal consulting” studio that obtained hotel records, vehicle files, and travel tracks through overseas social platforms, selling this data to lawyers, private detectives, and information brokers under the guise of “legal assistance.” The data was used for unfair advantage in divorce, debt collection, and commercial competition cases.

In Zhejiang, a “private detective” gang led by Wu Mou, 34, advertised “marriage investigation” and “finding people” services on WeChat and Douyin. The gang colluded with industry insiders to obtain tracking data and hotel records, employing operatives for GPS tracking, physical surveillance, and covert recording. They provided illegal services to 12 clients with a case value exceeding 1 million yuan.

Legal Framework and Enforcement Context

These cases operate within China’s comprehensive legal framework for personal information protection. Under Criminal Law Article 253-1, illegally selling or providing citizens’ personal information carries sentences of up to three years imprisonment, or three to seven years for especially serious cases. The Personal Information Protection Law, effective November 2021, and the Data Security Law establish comprehensive rules for data processing and classification.

Since 2020, Chinese public security organs have conducted annual “Clean Network” (净网) special operations targeting cybercrime, including personal information crimes. In 2024 alone, over 7,000 such cases were solved, and authorities have arrested more than 2,300 industry insiders involved in data leaks. The August 11 announcement follows a similar release of six typical cases in June 2026 and five cases by the Supreme People’s Court in May 2026.

Public Advisory and Forward Look

The Cybersecurity Bureau has advised citizens to properly keep, store, and use personal information, and to promptly report any leads of personal information leaks to public security authorities and relevant departments, using legal weapons to defend their rights and interests.

As China’s digital economy continues to expand, the fight against personal information crimes remains an evolving challenge. The release of these 10 typical cases signals that authorities are intensifying their scrutiny of both the criminal networks and the industry insiders who enable them. With the “Clean Network” campaign ongoing, further enforcement actions and case disclosures are expected in the coming months as authorities target the acquisition, trafficking, and use links of the personal data black market.