12 caught in insurance company client data leak

TWELVE suspects have been detained for allegedly leaking and selling over 10 million items of client data from an insurance company in Shanghai.

The suspects made profits of over 20 million yuan (US$3 million) from the illegal business, police said. They could face up to seven years in prison.

Police in Yangpu District started their investigation in November last year when the insurance company reported that some computers of its sales staff had access to a large amount of client information.

Suspicion soon fell on two salesmen, one surnamed Chen and the other surnamed Liu. From their computers police found over 1 million items of personal information in Excel forms including identity card numbers, mobile phone numbers and home addresses.

The two suspects allegedly relayed the acquired data via an online shopping website to their accomplice who had disguised himself as an customer service staffer from an online shop.

The insurance company bans its sales staff from using mobile phones at work and accessing websites, except for online shopping websites, police confirmed.

The online shop was run by a man surnamed Yu and another surnamed Ba, former staff of the insurance company. Ba set up a business selling “quality client information” for profit.

The four suspects and eight others involved in the case were caught last month in the Pudong New Area and Huainan City, Anhui Province.

A suspect surnamed Liu, who is now under detention, claimed that he used an account given to him by Ba to access the insurance company’s database from May to October last year, for which he was paid 30,000 yuan.

Liu had worked for the insurance company for eight years. Staff at Liu and Chen’s level do not have access to the database of client information.

Shanghai police said they had solved over 1,300 cases of personal information infringement since last year. They said most of the cases were reported by companies who discovered the data leaks themselves.