1. Website tampering case of a certain electronic company in Shanghai. The internet information department found that the enterprise has long neglected the weak password problem of administrator accounts in the portal website backend system since 2020, and has not timely monitored and dealt with security risks such as violent cracking of related systems. The backend system was attacked in April 2026, and malicious code was implanted into the website source files. When searching for website related content through search engines, a large amount of serious illegal and harmful information appeared. The enterprise failed to fulfill its obligation to protect network security in accordance with the law, did not promptly activate emergency plans and take remedial measures when a network security incident occurred, and did not report to the relevant competent authorities in a timely manner, violating legal provisions such as the Cybersecurity Law. The local Cyberspace Administration has lawfully ordered it to make corrections and imposed fines.

2. A malicious program case was set up by a certain network technology company in Beijing. The cyberspace administration department found that the enterprise operates the "Assistant" application with approximately 350000 users. Liu, an employee of the company, participated in the development of the application during his tenure. However, due to dissatisfaction with the renewal of his labor contract, he implanted malicious programs into the application to obtain promotion fees before leaving. After installing the application, users will be redirected to promotional links when using the browser homepage, search engine, bookmarks, and other functions. The enterprise has failed to fulfill its obligations to protect network security in accordance with the law, neglected the management of the applications and employees it operates, failed to promptly identify relevant issues and take remedial measures, endangered user network security, and violated legal provisions such as the Cybersecurity Law. The local Cyberspace Administration has lawfully ordered Liu to make corrections, imposed fines, and transferred the suspected illegal and criminal activities of Liu to the public security organs.

3. Data theft case of a data industry limited company in Anhui. The cyberspace administration department found that the enterprise used an open source version of ES with unauthorized access vulnerabilities during the development of the "digital archive management system", and did not delete the test data in a timely manner after the development and testing were completed, resulting in the theft of more than 2400 internal documents such as audit reports, contracts, meeting minutes, etc., involving sensitive content such as network security level protection evaluation reports, project proposals, and budget approval documents. The enterprise has not fulfilled its obligations to protect network security and data security in accordance with the law, and has not taken technical and other necessary measures to ensure network security and data security, violating legal provisions such as the Cybersecurity Law, the Data Security Law, and the Regulations on the Administration of Network Data Security. The local cyberspace administration has lawfully ordered it to make corrections, issued warnings and fines, and imposed fines on the directly responsible supervisors.

4. A data leakage risk case in a hospital in Henan province. The network information department found a weak password vulnerability in the hospital's physical examination system, which could be used to obtain medical records and other data. After a comprehensive rectification by the local network information office, a review revealed that the hospital's network firewall, intrusion prevention system, vulnerability scanning tool, log audit system, database audit system, bastion machine and other security devices had expired due to authorization. There are still 700 security vulnerabilities in the network system terminal, including 73 high-risk vulnerabilities that can be exploited, and the risk of data leakage has not been eliminated. The hospital has not fulfilled its obligations to protect network and data security in accordance with the law, and has violated legal provisions such as the Cybersecurity Law, the Data Security Law, and the Regulations on the Administration of Network Data Security. The local cyberspace administration has lawfully ordered it to make corrections, issued warnings and fines, and imposed fines on the directly responsible supervisors. At the same time, the relevant situation has been reported to the local health department.

5. Personal Information Leakage Risk Case of a Software Technology Co., Ltd. in Guangdong. The cyberspace administration department has found that the hardware product developed by the company, "A Box," has an unauthorized access vulnerability. Without login verification, the company can access its 4000 port console business through a webpage to view vehicle status information. After the user has bound the WeChat official account, no encryption measures have been taken for the information in the process of transmitting personal information from the box product to the official account and querying the vehicle status information through the official account. The enterprise has not fulfilled its obligations to protect personal information in accordance with the law, and has not taken necessary technical measures such as identity authentication and data transmission encryption to ensure the security of users' personal information, violating legal provisions such as the Cybersecurity Law, the Personal Information Protection Law, and the Regulations on Network Data Security Management. The local cyberspace administration has lawfully ordered it to make corrections and issued a warning and punishment.

6. Zhejiang Information Technology Co., Ltd.'s mandatory collection and use of non essential personal information case. The cyberspace administration department found that a certain sports management app operated by the enterprise forcibly requires users to be granted multiple permissions such as location permission, phone permission, and storage permission at once under the pretext of "preventing cheating" when enabling the running function. If users do not agree to the authorization, they will refuse to provide running related functions on the grounds that they refuse to provide all permissions. The company did not provide differentiated function options to users in different scenarios, forcibly requested multiple permissions at once, and collected and used non essential personal information beyond the scope of other alternative methods to achieve processing purposes, violating legal provisions such as the Personal Information Protection Law and the Regulations on Network Data Security Management. The local cyberspace administration has lawfully ordered it to make corrections and issued a warning and punishment.

7. Case of illegal collection of facial information by a real estate company in Chongqing. The cyberspace administration department found that the company has installed more than 10 image capture devices in its office space, collecting and storing over 5000 pieces of customer facial information for customer identification and matching marketing with intermediary agencies. The company did not truthfully, accurately, and completely inform customers of the purpose, method, and purpose of collecting facial information. Without obtaining the customer's separate consent, the company collected, stored, and used customer facial information, violating legal provisions such as the Personal Information Protection Law and the Regulations on Network Data Security Management. The local Cyberspace Administration has lawfully ordered it to make corrections and imposed warnings and fines.

8. Case of a Shanghai technology limited company collecting and illegally leaving personal information beyond its scope. The cyberspace administration department found that since 2022, the enterprise has been continuously collecting user information on the host configuration, usage duration, user system, etc. of its hardware products through its Windows application beyond its scope, and transmitting the above information, as well as the name, phone number, email address, birthday, password, and other information filled in by users when registering for its related programs, to relevant data centers overseas. The enterprise collects user personal information beyond the minimum scope for achieving processing purposes, and transmits personal information outside the country without declaring data export security assessment in accordance with the law, violating legal provisions such as the Personal Information Protection Law and the Regulations on Promoting and Regulating Cross border Data Flow. The local Cyberspace Administration has lawfully ordered it to make corrections and imposed fines.

9. A small program operated by a certain technology limited company in Sichuan has not implemented the requirement for generating synthetic content identification. The online communication department found that the WeChat applet operated by the enterprise provided services such as AI text dialogue and image generation, but did not add an explicit logo to the synthetic content generated by artificial intelligence, did not add an implicit logo containing attribute information, service provider name or code, content number and other production element information in the file metadata, did not add an explicit logo to the generated synthetic content when providing the export function, and did not implement the security assessment requirements according to the regulations. There was a content security risk, in violation of legal provisions such as the Administrative Provisions on the Deep Synthesis of Internet Information Services, the Measures for the Identification of Artificial Intelligence Generated Synthetic Content, and the Provisions on the Security Assessment of Internet Information Services with Public Opinion Attributes or Social Mobilization Ability, the online communication department has ordered the applet to go offline according to law.

10. Jiangsu Science and Technology Co., Ltd. provided generative artificial intelligence services without conducting security assessments as required. The Internet Information Department found that the two websites operated by the enterprise called multiple large model product interfaces in the way of "API transit stations" to provide dialogue, question and answer and other services, failed to carry out security assessment as required, and there were content security risks, in violation of the Interim Measures for the Management of Generative Artificial Intelligence Services, the Provisions on Security Assessment of Internet Information Services with Public Opinion Attribute or Social Mobilization Ability and other legal provisions. The local Cyberspace Administration has lawfully ordered it to make corrections, dealt with the responsible persons strictly, and given a warning and punishment.