Taipei Prosecutors Indict 2 for Buying and Selling Hospital Patient Data, Seek Heavy Sentencing

(Central News Agency reporter Hsieh Chun-lin, Taipei, June 15) Taiwanese nationals Cheng Yu-hong and Liu Che-hung are accused of purchasing personal medical data—such as patient records—from an overseas hacking group that illegally infiltrated hospital computer networks, and attempting to resell it. Taipei District Prosecutors' Office indicted both individuals today on charges including violations of the Personal Data Protection Act, citing their weak legal awareness and requesting the court impose heavy sentences.

According to the indictment from the Taipei District Prosecutors' Office, Chinese nationals Luo Zheng-yu and Xu Li formed the hacker group 'Crazy Hunters,' conspiring with Zhao Yi-ze, a Chinese national involved in personal data trading. The prosecutors have already issued arrest warrants for these three individuals.

The indictment states that between February and April 2025, the 'Crazy Hunters' hacking group illegally accessed computer systems at Mackay Memorial Hospital, Changhua Christian Hospital, and a corporate company, stole data, disclosed it on the BreachForums website, and openly sold personal data obtained from the two hospitals.

Liu Che-hung first arranged the deal with the 'Crazy Hunters' group, after which Cheng Yu-hong transferred 1,000 Tether (USDT) from a digital wallet to purchase a file named '20000.csv' containing unspecified patient medical records from Mackay Hospital. Cheng then attempted to sell the data to an unidentified Telegram user, claiming, 'I have a dataset from Taiwan—just extracted from a medical institution last month,' and 'My associate got it; all high-net-worth individuals.'

Following investigation, the Taipei prosecutors concluded that both Cheng Yu-hong and Liu Che-hung are suspected of violating the Personal Data Protection Act by unlawfully collecting and using personal data as non-governmental entities, and have formally filed public prosecution today.

Prosecutors emphasized that both individuals were fully aware the data was obtained illegally by hackers breaching hospital networks, and that the content—including medical histories, treatments, genetic information, and health check results—constitutes deeply private and sensitive personal information. Despite this, they purchased and collected the data for profit, with no regard for the potentially irreversible harm to numerous citizens if such data were leaked. The prosecutors deemed their legal awareness extremely weak and have requested the court impose severe sentences on both defendants. (Editor: Chang Ya-ching) 1150615