Up to 3 Billion Pieces of User Data Stolen From Nearly 100 Tech Companies

* Third-party developer placed malicious software into carriers’ servers, giving it access to tech companies’ information

* Several executives of the developer have since been arrested and charged in the case

(Beijing) — A group of Chinese companies stole up to 3 billion pieces of user data from 96 tech companies — including e-commerce giant Alibaba Group Holding Ltd. — in the country’s latest case of privacy violations.

The group, led by Shenzhen-listed Ruizhi Huasheng Technology Corp., hijacked the data from the country’s major state-owned mobile carriers — China Mobile, China Unicom and China Telecom — according to a recent notice published by police in Shaoxing, Zhejiang province.

The user data — account information from the platform companies, including Tencent Holdings Ltd.’s WeChat, and Alibaba’s e-commerce site, Taobao — were then manipulated to make profits by a variety of means, such as selling them to advertisers, the notice said.

The data hijacking was possible due to a business partnership created in 2014, when Ruizhi Huasheng became a third-party developer for the country’s mobile operators’ targeted advertising business in more than 10 Chinese provincial-level areas.

Ruizhi Huasheng then placed malicious software onto the servers of the state-owned carriers, gaining access to enormous amounts of user data, according to information from the security department of Zhejiang-based Alibaba, which has aided local police in the case.

Shaoxing police launched the investigation in late June, when they received complaints from users who said that “friends” had been added to their social media accounts without their permission.

Several company executives, including legal representative Zhou Jialin, have since been arrested and charged with illegally collecting user data, according to a company statement posted on the Shenzhen Stock Exchange early last week. The incident has led to a majority of employees leaving the company, and police have frozen the company’s current account, the statement added.

Founded in 2013, Beijing-based Ruizhi Huasheng said its main business is providing marketing solutions for clients through its partnership with social media platforms such as WeChat and microblogging site Weibo.

The company’s data-related business has proved to be profitable. It reported revenue of 30 million yuan ($4.4 million) — 16 times of the previous year’s figure — which then fell slightly to 20 million yuan in 2017, but still with a gross-profit rate as high as 55%.

The case has been the latest in an ongoing government crackdown on crimes involving user data privacy violations. As of July 2017, Chinese governments have tracked down at least 1,800 data privacy cases and arrested nearly 5,000 suspects, according to official figures.

Contact reporter Mo Yelin (yelinmo@caixin.com)