China's National Security Agency warns of biometric data theft by foreign spies
China's National Security Bureau warned on 6 August 2025 that foreign intelligence agencies have stolen facial recognition and other biometric data from key targets to conduct espionage and infiltrate sensitive locations. The agency also documented cases of foreign companies misusing fingerprint payment systems and collecting iris data, and recommended protective measures including multi-dimensional authentication and stricter data handling practices.
What happened
On 6 August 2025, China's National Security Bureau published a security notice warning that foreign intelligence agencies have been illegally stealing facial recognition data from key targets, fabricating the data, and using it to obtain information and infiltrate sensitive classified locations.
The notice documented three categories of biometric data misuse: foreign spy agencies using stolen facial data for espionage; a foreign enterprise directly connecting its fingerprint payment system to its company database, leading to multiple hacking incidents and data theft; and a foreign company collecting iris information globally under the pretense of distributing cryptocurrency tokens and transferring the collected data sources.
Reported impact
Improper storage and leakage of biometric data endangers personal privacy, property security, and national security.
The collection and misuse of biometric identifiers poses threats to individuals whose data has been compromised and to state security when such data is used for espionage.
Index analysis
Facial recognition data contains precise information about facial features, bone structure, skin texture and other unique details that can be easily collected, analyzed, stored and identified.
Fingerprint and iris data are highly stable, difficult to replicate, and of high precision and uniqueness, making them targets for unauthorized collection and misuse.
Governance controls
China has enacted the Data Security Law, Cyber Security Law, Personal Information Protection Law, Network Data Security Management Regulations, and the Administrative Measures for the Security of Facial Recognition Technology Applications to provide institutional protection for biometric data.
The National Security Bureau recommended adopting a 'minimum necessity' principle when providing biometric information, requiring clear disclosure of data storage and processing purposes, and implementing multi-dimensional authentication in sensitive classified areas with regular updates to biometric authentication systems.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.