China scapegoats personal data sellers as breaches power multi-billion dollar theft industry

The Haidian District People’s Court in the capital city of Beijing has handed down a combined 150-month prison sentence and about 120,000 yuan in fines to two suspects accused of selling citizens’ identities, addresses, and social media accounts. The accused were implicated for building a searchable database that held more than 900 million personal records.

China’s Supreme People’s Court publicized its ruling in this case, which is expected to be a deterrent at a time when stolen personal data has become the jet engine of a global wave of targeted crypto kidnappings and extortion.

The Supreme People’s Court published four personal-data crimes, noting that stolen information is being used to carry out fraud, extortion, and “doxxing” attacks that the court said severely endanger public safety.

China sends personal data sellers to prison

The Haidian District People’s Court convicted Lin and Wang of infringing citizens’ personal information and illegal use of information networks, according to the court’s official WeChat announcement published on May 7.

Lin had obtained over 600 million records; Wang collected more than 300 million. Together with a third suspect handled separately, they built a “social engineering database” website containing 170 million records that was accessed more than 100,000 times and used to look up personal information on over 1,300 occasions.

Lin received seven years in prison and a 70,000 yuan fine. Wang was sentenced to five years and six months with a 50,000 yuan fine. Both collected payment in cryptocurrency.

Leaked French data have turned into kidnapping wave

While China deals with its own data theft and illegal sales, the situation has already turned extremely violent in France.

In 2025, Ledger co-founder David Balland lost a finger before police rescued him from kidnappers. In another incident, a woman and her 11-year-old son were abducted in Burgundy. French prosecutors have charged 88 individuals in connection with crypto kidnappings.

Cryptopolitan previously reported that Telegram founder Pavel Durov raised the alarm on X that 41 crypto holders were kidnapped in France in the first three and a half months of 2026 alone. French judicial police official Philippe Chadrys confirmed the spike, stating that the country was dealing with a multi-national criminal operation.

Durov pointed to a breach at France’s Agency for Secure Documents that reportedly exposed data on 19 million people.

Criminals turn stolen data turns into stolen crypto

The line between data exposure and targeted crime is not hard to trace. Seb, president of the French Federation for Data Protection, wrote on X that France is on track to become the second-most-hacked country in the world in 2026, citing over 300 affected services, 23 million compromised accounts, and more than 250 million exposed data records.

Chainalysis put total crypto theft at $3.4 billion for 2025, with personal wallet compromises growing from 7.3% of stolen value in 2022 to 37% in 2025.

French crypto tax app Waltio reported in January 2026 that the hacker group Shiny Hunters claimed to hold personal details of roughly 50,000 customers.

Ledger itself disclosed a separate breach in January 2026 that it pinned on its payment processor Global-e. The January incident is different from the firm’s 2020 breach.

Cryptopolitan reported that Ledger cold wallet owners received letters in the mail, implying that the senders have their home addresses at least.

China’s Supreme People’s Court signaled that personal-data prosecutions will intensify. Whether conviction and enforcement can outpace the rate of new breaches remains an open question.