Following the recent conclusion of the national college entrance exams, numerous parents reported receiving promotional messages and calls from enrollment agencies even before the tests, with some receiving over a dozen such calls daily. These callers could even accurately state the student's name and academic performance. How do these agencies pinpoint parents so precisely, and who is behind the illicit trade of student personal data?
Parents Receive Pre-Exam Calls; How Student Data Was Leaked
Since April this year, the Emeishan City Public Security Bureau in Sichuan has received multiple reports from the public regarding off-campus enrollment agencies suspected of illegally obtaining student information and conducting disruptive, non-compliant recruitment. The victims were primarily graduating students preparing for senior high school or college entrance exams and their parents.
One parent, Ms. Zhou, stated that during the final year of high school, she received numerous calls urging her to pay advance fees to secure a school placement for her child, or suggesting enrollment in training institutions if the exams were not passed.
Another parent, Mr. Wu, reported receiving various messages and calls starting from the winter break of the ninth grade. Initially, it was two or three calls a day, but it escalated to over a dozen daily. Despite blocking each number, new calls from various virtual and real numbers kept coming, making it impossible to block them all; his blocklist now contains over a hundred numbers.
Beyond disrupting daily life, what deeply unsettled parents was the precise personal information the callers possessed about their children.
Mr. Wu expressed his confusion, noting that the callers knew his child's name, school, class, homeroom teacher's name, and even specific scores for subjects like Chinese, Math, and English. He suspected a data leak but was unsure of the source.
Illegal Enrollment Ring Identified; 790,000 Student Records Seized
Investigators from the Emeishan Public Security Bureau's Cyber Security Unit quickly identified a local off-campus enrollment team. A raid on their office found several individuals using printed student lists to make calls. A USB drive was discovered on one person's keychain.
Preliminary analysis revealed the drive contained over 790,000 records of student personal information, covering 18 cities and prefectures in Sichuan. According to statements, the USB drive's owner was the boss of this recruitment team.
Uncovering the Leak Source and Dismantling the Data Trafficking Chain
The seized data was comprehensive, including student names, genders, ID numbers, household registration details, schools, classes, historical exam scores for various subjects, teaching staff information, guardian details, and contact numbers.
The team leader confessed that the student data originated from a deputy principal named Huang at a middle school in Deyang, Sichuan. A special task force immediately went to Deyang and apprehended Huang on May 15.
After searching four offices with Huang, investigators found a crucial USB drive containing 100,000 student records from the Liangshan region.
Huang revealed his source was Wu, the head of the school's admissions office. Wu had fled to Chengdu with all his storage devices, intending to destroy evidence.
The next day, Wu stopped his car at the Yangma River Bridge in Chengdu and threw a package containing USB drives, a phone, and a computer hard drive into the river. Under the direction of the Sichuan Provincial Public Security Department, police fully documented Wu's travel and activity trail. He was placed under criminal detention on May 21.
Wu stated that his student information came from He, the head of admissions at a vocational college in Meishan City. On June 2, the task force successfully arrested He in Wenjiang District, Chengdu. He is considered the top-level source in this black data chain.
He admitted that he had amassed the vast quantity of student information by collecting and compiling it from various channels.
Five Suspects Detained for Alleged Infringement of Personal Information
This case is a major infringement of citizens' personal information cracked during Sichuan police's "Summer Public Security Crackdown and Rectification 100-Day Campaign." Currently, five suspects involved in the case have been criminally detained for allegedly infringing upon citizens' personal information rights.
Police have sealed over 900,000 seized student personal information records. The investigation into the original sources of the data in suspect He's possession is ongoing and expanding.
During the investigation, police found that to avoid detection, the ring transferred student data offline.
Their method involved point-to-point, manual transfer using USB drives, which explains why Wu attempted to destroy evidence by discarding the drives. Furthermore, the suspects did not conduct immediate cash-for-data transactions; financial exchanges were delayed and concealed, likely settled after successful student enrollments based on recruitment quotas.
Data Leaks Heighten Risks of Fraud and Other Crimes
According to investigators, the illegally leaked student information is primarily used by tutoring agencies to recruit students who failed exams or by enrollment agents to attract graduating students.
Police emphasize that according to China's Civil Code and Personal Information Protection Law, an individual's personal information is protected by law. Any organization or individual must obtain others' personal information legally, ensure its security, and must not illegally collect, use, process, transmit, trade, provide, or disclose such information.
Illegally leaking and trafficking student and parent personal information not only fosters disruptive, non-compliant recruitment but also harbors significant risks of telecom fraud, seriously threatening public property safety.
Criminals exploit candidates' scores and application information to fabricate scams involving "internal admissions" or "financial aid applications," which are highly deceptive and can easily lead to financial losses. While this case has dealt a blow to such crimes, it serves as a reminder for the public to remain vigilant.
Police stated they will maintain strong efforts to combat the illegal leakage and trafficking of citizens' personal information. They will also collaborate with relevant regulatory bodies on traceability and governance work to effectively protect the personal information of students and parents.
Comments