Students’ personal data sold publicly at cheap prices in Vietnam

Personal information, especially that of students from Ho Chi Minh City, is being traded on the Internet at very cheap prices.

In the role of a data buyer, a Tuoi Tre (Youth) newspaper reporter posted a request in a Facebook group with 8,500 members calling for a list of 10th graders who have just enrolled in Ho Chi Minh City, focusing on District 7, District 8, Nha Be District, and Binh Chanh District. 

The post then immediately attracted three data suppliers. 

A supplier named Dang provided 30 telephone numbers through Telegram, a messaging app, with each attached to the name of a student or their parents.

Though residing in northern Vietnam, Dang has information on students in Ho Chi Minh City. Most phone numbers provided by Dang are real. 

“Without filtering data by district, each number is sold for VND7, while a filtered number costs VND10,” he said.

Another provider called Hieu affirmed he could immediately supply about 3,000 students divided into classes and schools, depending on the requested area.

However, the data may have some errors and need correcting due to new students’ incomplete information, he said.

Hieu then showed a data checklist including 9th graders in the 2022-23 school year, who will be new high schoolers in the following years.

Each row comes with gender, date of birth, phone number, student identification code, and the student’s full name.

He asked for VND2.4 million (US$100) for the list with each student priced at VND1,000 ($0.042)

Upon hearing that the price was only VND7 for a student, Hieu asserted, “That deal is definitely a scam. It can’t be that cheap.

“They must have given a few correct numbers for test calls. After transferring money, they may provide a wrong list or perhaps cut off contact right away.”

Meanwhile, a supplier called Long prioritized selling data in bulk for two reasons.

Aside from better prices, parents are the ones paying tuition fees, so it is more reasonable to call them first. 

Long assured buyers of the quality of his data.

“Our data is collected right from schools. Besides, many English centers and summer camps acquire at least 10,000 numbers, but normally over 20,000 contacts from us during the peak season,” he said. 

It costs VND300 for each datum when purchasing 5,000 telephone numbers, but buying 10,000 numbers only fetches VND200 individually, said Long. 

Personal data traded by schools

Each vocational education and training establishment usually buys about 100,000 students’ phone numbers in Ho Chi Minh City, focusing on 9th and 12th graders, said a marketer named M.Q..

“The probability of students being interested in is often low, but it is still one of the channels that help search for learners,” M.Q. said.

With the phone numbers, the marketing department scans Zalo, a Vietnamese chat app, and then runs advertisements for courses.

Students attracted by these advertisements will continue to receive text messages on the program. 

In the meantime, a life skill training center in Ho Chi Minh City plans to collect customers’ personal data, employee T.L. said. 

The information is gathered directly from schools, using the ‘win-win’ principle. The center will come to middle and high schools to hold mostly free events and competitions or offer gifts, and scholarships. They then require a list of its students in return. 

There are three main sources that reveal student information, said director of the Athena Cyber Security Center Vo Do Thang.

The first source is the technical vulnerability in which schools’ data entry machines can be hacked to take away the data.

The second is from the data entry teams of schools. It is possible that some people in the schools’ data entry teams have backed up and released the information, he supposed.

Clusters specializing in data collection from many places aside from schools are also one of the reasons why personal information gets leaked.

Collections can be stored over many years, for basic student information such as names, parents, and even their phone numbers are normally consistent across educational levels, Thang said.

Data could also be exploited from prenatal clinics, he acknowledged.

The team obtains data on a group of children born in the same year along with their parents’ contact details.

These children will soon enter kindergarten and reach elementary schools where they must learn English, which means those data sets can be used for the next 10-15 years.

By Minh Chau & Trong Nhan – Tuoi Tre News – September 13, 2023