Several banks in the country are suspected of leaking customer data, with nearly one million account information being sold on the dark web.

Recently, there have been reports that customer data from multiple domestic banks is being sold on the dark web. According to reports, the leaked data is divided into two main categories:

The first category consists of about 900,000 account information records from a large agricultural bank, priced at $3,999. This data involves sensitive financial information about customers, including their names, addresses, contact details, ID card numbers, as well as deposit amounts and the services they have used.

The second category of data is broader, including 800,000 customer records from a certain Shanghai bank, 460,000 credit card information from a certain Industrial Bank, 200,000 high-end customer data from Shanghai Wealth Management, and 100,000 customer information from a certain Pudong Development Bank. In addition, there are detailed information about 12 million Chinese startup companies, personal data of 200,000 Chinese corporate executives, and 1.2 million data of Chinese VPN users. Among them, the startup company information covers content such as company name, legal representative, registered address, and business scope.

Industry experts analyze that bank data breaches typically occur through two channels: first, technical personnel illegally exporting data from the backend database; second, business personnel obtaining data from the frontend system. From a technical perspective, database breaches may be caused by internal personnel illegally copying data or external hackers intruding. This incident is likely due to insufficient security measures leading to the database breach.

This incident has once again raised concerns about the data security of financial institutions. Banks, as organizations that hold a large amount of sensitive personal information, should adopt stricter security measures, enhance internal management, and improve technological defenses to ensure the safety of customer information. At the same time, relevant regulatory authorities need to strengthen their oversight of data protection efforts by financial institutions, establish more stringent data security standards, and prevent similar incidents from occurring again.