Data leak may hit courier's client numbers

Staff members with a postal delivery company prepare packages in Yiwu, Zhejiang province. A Chinese express courier, Yuantong Express, may lose clients after media reports that personal information about its customers was sold online. ZHANG JIANCHENG / FOR CHINA DAILY

Postal delivery company Yuantong Express could face falling customer numbers after media reports that personal information on the company's express envelopes is being peddled on the Internet.

"We're concerned about the security of our personal information after the scandal with the company, so we're considering changing to another express courier," said Wang Yan, who works in the administration department of Xizi Otis Elevators, a customer of Yuantong since 2009.

Several companies have already reported switching from Yuantong, including Shanghai Jinxing, which is based in the Pudong New Area and whose main business is the import and export of wood products.

"But other express couriers may have the same problem, so we're thinking of opting for a safer method," said Cheng Pinyi, administration director of the company, which used to send about 100 packages through Yuantong on a daily basis.

Shanghai Morning Post reported on Tuesday that nearly 1 million items of personal information have been stolen and sold through the Internet, mainly through Taobao, a popular online marketplace.

The information includes the names, addresses, and cellphone numbers of both senders and recipients, all of which typically appear on the courier envelopes.

"The incident exposes external and internal loopholes in information management. We're in close cooperation with the police and Taobao to find the source of the leak of the information," said a manager with the information department of Yuantong Express who gave only his surname, Zhou.

Shanghai police started investigating the incident on Wednesday and said preliminary analysis showed the information had been leaked by company employees.

A search for "personal information" with "express delivery" on Taobao showed more than 2,800 results on Thursday. The price of information relating to one person was usually less than 1 yuan ($0.16), depending on the number of purchases made.

A China Daily reporter contacted three stores who sell information on Taobao, and all of them said they only have the information sourced from Yuantong.

One store manager said the information comes from her friend who works at Yuantong.

Zhou said the cause of the leak is a new database at Yuantong containing details of all customers that have used their express service, including their personal information. He said the database is required by law.

"The purpose of the database is for customers to track the progress of their package and it's also easy for customers to obtain information on the packages they have sent through the system," Zhou said. "Moreover, if someone sends prohibited goods, he or she can be traced with the information from the system."

Several other courier companies have databases, but Yuantong's is the most complete, including names, phone numbers and addresses, according to Zhou.

"If the poor handwriting confuses the courier, it's easy to type in a customer's name or phone number in the database and find the corresponding address. That's why we include addresses in the database," he said.

A courier with Quancheng Express in Shanghai, who asked to remain anonymous, said that few delivery personnel would think it worthwhile to sell customer information. They work to tight deadlines, he said, and the amounts of money to be made from selling information are too small.

"If the leak was caused by several couriers, the amount of the leaked information cannot be big. It might be some senior managers from the company," said a senior manager of a courier company in Shanghai, who declined to be named.

In August, public prosecutors in Shanghai warned of a sharp increase in the theft of personal information, with criminals stealing and selling data for various purposes, including telecom fraud, racketeering and burglary.

In March, the government brought into effect a new regulation, the Management Measures of the Express Market, stipulating that courier companies and employees are forbidden to provide personal information obtained in the course of their work.

Those found guilty of breaking the regulation will be given a fine ranging from 10,000 yuan to 30,000 yuan.