China probes data leak as HIV patients report scam

A patient with HIV in a Beijing hospital. According to the World Health Organisation, more than 575,000 people in China had HIV last year.
A patient with HIV in a Beijing hospital. According to the World Health Organisation, more than 575,000 people in China had HIV last year. PHOTO: REUTERS

Many people report being blackmailed by callers who have all their personal details

BEIJING • Mr Bai Hua, the director of a support network based in Beijing for people with HIV/Aids, said he began receiving the messages about two weeks ago.

Hundreds of people with HIV across China were reporting that they were being called by someone who claimed to be from the government and had access to their medical records and other personal information.

According to Mr Bai, one man, who lives in Huangshan in Anhui province, said he received a call last week from someone who knew his name and the details of the case. The caller said he was with the city's Centre for Disease Control and Prevention and that under a new policy, the man could get a 4,680 yuan (S$950) subsidy for drugs and treatment. The caller left a number the man could call for more information.

The man wrote down the number but grew suspicious because the area code was for another province. He messaged the Beijing support network, BHL China League, and discovered that he was not the only one to have received such a call. Mr Bai said that, as of Wednesday night, more than 490 people with HIV had reported being contacted. Several were told that to receive the subsidy, they needed to pay a service fee by online or ATM transfer.

So far, Mr Bai said, he has been told of 11 who had been cheated out of sums ranging from US$100 to US$10,000 (S$135 to S$13,500) each, for a total of more than US$18,000. Some, suspecting fraud, said they challenged the callers, only to be told their medical records would be made public if they did not pay.

Some, suspecting fraud, said they challenged the callers, only to be told their medical records would be made public if they did not pay.

The question that Mr Bai and others are now asking is - How did these fraudsters gain access to what is supposed to be confidential medical data? And what might they do with that information?

"The swindlers clearly have detailed information about HIV carriers, including their names, ages, addresses, ID, places of employment, even information about their relatives," Mr Bai said. "That information could only have been obtained from the Chinese Centre for Disease Control and Prevention, because only it has this information from all over the country."

Under a government programme that provides free anti-retrovirals, people with HIV must submit personal and medical information to the centre. Some also need to register data with designated local hospitals to get the drugs. According to the World Health Organisation (WTO), more than 575,000 people in China had HIV last year.

"Given the scale of this, it's not likely that it was a lower-level organisation that leaked the information," Mr Bai said.

On Monday, the WTO and the Joint United Nations Programme on HIV/Aids released a statement on Weibo saying: "The leak of personal information of people infected with HIV is a violation of the fundamental right to patient confidentiality." They urged the health authorities to investigate how the information was disclosed and to step up security measures.

Calls to the centre this week went unanswered.

According to news media, the centre has reported the case to the police and has also notified its affiliates, asking them to warn patients about the fraud.

"Information about people with HIV is emphatically protected in our national information network," the state-run newspaper People's Daily quoted the centre as saying.

After these swindles, the centre said, it has undertaken emergency measures and information security checks and is upgrading security.

Mr Wu Zunyou, director of the National Centre for Aids/STD Control and Prevention under the national centre, wrote on Weibo on Sunday that "it's illegal and immoral to obtain HIV carrier's information to commit fraud".

While awaiting answers as to how their medical data was hacked or leaked, people with HIV are worried about the possibility of new swindles or blackmail.

"Now that it's basically certain that our information is in the hands of criminals, what will the authorities do to prevent more crimes from happening?" a 28-year-old Beijing resident with HIV who used the name Luoluo asked on Weibo.

"Will there just be an apology and then everybody forgets about it, leaving the victims to their nightmares?"

NEW YORK TIMES

A version of this article appeared in the print edition of The Straits Times on July 23, 2016, with the headline 'China probes data leak as HIV patients report scam'. Print Edition | Subscribe