Vietnamese 10th grader allegedly hacks national vaccination system, sells 20mn personal records

Police in Lam Dong Province in the Central Highlands region said on Wednesday that they had launched criminal proceedings against N.H.A., a 10th-grade student residing in Quan Thanh Commune, Nghe An Province.

The teenager faces charges of illegally providing or using information on computer and telecommunications networks, as well as unauthorized access to computer networks, telecommunications networks, or electronic devices, under Articles 288 and 289 of Vietnam’s Criminal Code.

Investigators said the boy taught himself programming through online resources and developed algorithms that enabled him to exploit security flaws within the system, managed by the Ministry of Health's General Department of Preventive Medicine.

The student collected personal information and data of citizens nationwide and then posted them in online groups involved in the buying and selling of data.

Preliminary findings by investigators indicated that he advertised and sold nearly 20 million records of personal data, earning more than VND100 million (US$3,800) in illicit profits.

The investigation began after cybersecurity officials discovered multiple accounts in closed groups offering large volumes of personal data for sale.

Officials identified the activity as a significant threat to privacy rights and warned that such data could be used to facilitate fraud and financial scams.

In response, the head of the Lam Dong Department of Public Security directed the cybersecurity and hi-tech crime prevention division to join hands with the criminal police division to investigate and dismantle the operation.

Police emphasized that the unauthorized collection, trading, or public disclosure of personal data is strictly prohibited under Vietnamese law.

Under Article 288 of the Criminal Code, individuals convicted of illegally providing or using information on computer networks may face prison sentences of up to seven years.

Article 289 stipulates penalties ranging from one to five years in prison for unauthorized access to computer or telecommunications systems, with sentences potentially reaching 12 years in cases involving the theft of large quantities of data.

The province’s police have urged agencies and firms to strengthen cybersecurity measures and promptly address system vulnerabilities to prevent data breaches.

Parents and schools are urged to guide their children and students toward safe and responsible Internet use.