(Yicai Global) June 28 -- China’s new financial regulatory body is asking banks and insurance companies to step up monitoring and accountability when hiring third parties to manage their data after a number of leaks of sensitive information, including from 34 banks.

Banks and insurers should strengthen the management of third-party service providers and improve their risk assessments and due diligence checks, the National Administration of Financial Regulation, a new regulatory body tasked with supervising the country’s financial sector, said in a document issued to banks, insurers as well as companies and institutes engaged in financial products earlier this week.

In July last year, two databases of 34 financial institutions were hacked, the regulator said. The hacker gained access to the email account of an employee at an outsourced software developer by using a foreign mailbox proxy. He then sold this stolen data, which contained sensitive information including program source codes, design documents and database configuration files, on a foreign website.

In another incident, a third-party supplier of Business WeChat services to banks made unauthorized use of more than 6 million pieces of archived chat records from customer managers and their clients that it had stored on a rented public cloud. The records, which included clients’ names, identity card numbers, phone numbers, bank accounts and other personal information, were used to train its language model and were also supplied to other companies.

Banks and insurance companies need to carry out more on-site inspections, it said. All systems must be inactivated, with all related data deleted, after the termination of partnerships, it added.

Editor: Kim Taylor