China’s CAC Publishes 10 Cybersecurity Enforcement Cases
China’s top internet regulator has publicly released a package of ten “typical enforcement cases” spanning cybersecurity, data security, personal information protection and generative artificial intelligence, in a move that signals continued tightening of the country’s digital compliance regime. The Cyberspace Administration of China (CAC) announced the cases on 15 September 2026, according to Xinhua, with the full list republished by CCTV and China.com.cn.
The roundup — which invokes the Cybersecurity Law, Data Security Law, Personal Information Protection Law and Network Data Security Management Regulations — is timed to coincide with the 2026 National Cybersecurity Week, held 14–20 September in Jinan, Shandong.
A Sweep Across Nine Provinces and Municipalities
The ten cases stretch from Shanghai and Beijing to Anhui, Henan, Guangdong, Zhejiang, Chongqing, Sichuan and Jiangsu. They vary widely in severity: some involve dismissed employees planting malware, others involve hospitals and real-estate firms mishandling sensitive data, and two target generative AI services directly.
Consistent with standard CAC practice, every company is anonymized as “a certain” (某) enterprise, and no fine amounts were disclosed.
Malware, Stolen Data and Weak Passwords
The first case concerns a Shanghai electronics company whose portal backend had carried a weak administrator password since 2020. In April 2026 the system was breached, malicious code was planted in the site’s source files, and search-engine results for the site began surfacing large volumes of illegal and harmful content. The company failed to activate emergency plans or report the incident, and was ordered to rectify and fined.
In a striking second case, a Beijing network technology firm operating an app with around 350,000 users discovered that an employee surnamed Liu had planted a malicious program before resigning, unhappy over a contract-renewal dispute and seeking promotion fees. Users’ browser homepages and search functions were hijacked to promotional links. Liu was referred to public security authorities on suspicion of a crime.
A third case saw an Anhui data company lose more than 2,400 internal files — including audit reports, contracts, meeting minutes and graded-protection testing documents — after it deployed an Elasticsearch open-source version with an unauthorized-access vulnerability and failed to delete test data. The company and a directly responsible manager were both fined.
Hospitals and Personal Information Under Scrutiny
The fourth case targets a Henan hospital whose physical-examination system had a weak-password vulnerability exposing patient records. After being ordered to rectify, a review found that its firewall, intrusion-prevention system, vulnerability scanner, log-audit and database-audit tools had all failed due to expired licenses, and that terminals still carried 700 vulnerabilities, including 73 exploitable high-risk ones. The hospital was fined, its manager penalized, and the situation reported to the local health department.
Several cases focus squarely on personal information. A Guangdong software firm’s hardware device allowed unauthenticated console access on port 4000 and transmitted vehicle-status information to a WeChat account without encryption. A Zhejiang fitness app forced users to grant location, phone and storage permissions at once as an “anti-cheating” measure, refusing service if any were denied. A Chongqing real-estate company collected and stored more than 5,000 customer facial records for identity recognition and marketing without proper notice or separate consent, and was fined.
Perhaps most consequential for cross-border operations, a Shanghai technology company was found to have, since 2022, over-collected host configuration and usage data through a Windows app and transmitted it — along with registration details including names, phone numbers and passwords — to overseas data centers without filing for a mandatory data-export security assessment.
AI Governance Takes Center Stage
Two of the cases mark the first prominent publicized enforcement actions under China’s generative-AI rules. A Sichuan company’s WeChat mini-program offered AI text chat and image generation but failed to add explicit labels to AI-generated content, failed to embed implicit metadata labels, and failed to conduct a required security assessment. The CAC ordered the mini-program taken offline.
Separately, a Jiangsu company ran two websites acting as “API relay stations” that called multiple large-model interfaces to offer chat services without the required security assessment. It was ordered to rectify, its responsible persons were “strictly handled,” and it received a warning.
These actions reflect the AI-Generated Content Labeling Measures, effective 1 September 2025, which require both explicit and implicit labels on AI-generated text, images and video.
Analysis: Enforcement with a Compliance Message
A CAC official framed the release in national-security terms. According to Xinhua, the official said cybersecurity, data security and personal information protection “bear on national security, public interests, and the lawful rights and interests of the people,” urging enterprises to “earnestly fulfill their primary responsibilities.” The official added that cyberspace authorities “will continue to intensify enforcement” and “resolutely investigate and punish all types of prominent illegal and non-compliant problems.”
The pattern points to several trends. First, accountability now extends to individuals: multiple cases fine “directly responsible managers,” not just companies. Second, AI content governance has moved from rulemaking to enforcement. Third, data-export compliance is being actively policed, a signal to multinationals operating in China. Fourth, the mix of technical failures — weak passwords, expired security licenses, unpatched open-source components — shows that basic cyber hygiene remains a widespread weak point.
The anonymization is deliberate. As 21jingji noted in its reprint of the Xinhua report, the CAC does not name firms in these periodic roundups, publicizing the violation type and the lesson rather than the company.
What to Watch
With National Cybersecurity Week underway, further CAC activity is expected. The regulator has already clustered related announcements in this window, including an updated AI security governance framework and new generative-AI service registrations.
For companies operating in China, the message is clear: weak passwords, unfiled data exports and unlabeled AI output are no longer theoretical risks. They are enforcement priorities — and the penalties increasingly reach the managers personally responsible.
Unresolved questions remain. The CAC has not disclosed the specific firms involved or the exact monetary value of the fines. The release is part of an ongoing, periodic series rather than a response to a single incident, suggesting more cases will follow as regulators work through the backlog of compliance gaps across China’s digital economy.