HUAZHU, China's largest chain hotel group with more than 3,700 hotels nationwide, recently reported to the Shanghai police that the personal information of its 130 million customers, including their names, identity card numbers, cellphone numbers and boarding details, are being sold online at a price of 320,000 yuan ($46,957). ThePaper.cn comments:

Although the police said its ongoing investigation has not yet revealed which parties are behind the large scale leaking and selling of personal information, Huazhu, as the collector of the data, has to accept that it bears some responsibility, as it is obliged to ensure the information is secure.

The information is apparently of tremendous commercial value to the buyers who mine and process the data and sell it to internet-related service companies that are eager to reach out to targeted customers. Such a large scale leak and trade in personal information, which involves 10 percent of the national population, deserves the public security department's high attention.

Huazhu has denied that any of its employees leaked the information. But many experts told the media that it would be almost impossible to stage such a large scale information theft without someone on the inside. It is not hackers that are the problem but a "ghost" in the company.

The case should ring the alarm bell for all business and public institutes, warning them to strengthen their protection and management of the personal data they collect and control.

In the era of the mobile internet, it is very convenient for companies to collect user information, but most companies are not prepared to properly secure the information they collect. Many companies have a similar risk of personal information being leaked and finding a way to reduce the risks is an urgent matter.

The legislature should amend the law to further make clear companies' obligations to keep the personal data they collect secure and make the relevant punishments more painful to deter people from becoming involved in the dirty trade.