On 2 October 2026 the Rhysida ransomware group listed Mat Bao Corporation, a Vietnamese domain, hosting, email and cloud provider, on its leak site. Rhysida claims about 106.8 GB across 746,108 files. According to a third-party summary of the listing, the files allegedly include correspondence with the regulators VNNIC and the National Electronic Authentication Centre (NEAC) and with the Government Cipher Committee, plus corporate records and scanned ID cards and passports. None of this is verified. Mat Bao has not publicly confirmed an intrusion, and ransomware groups are known to exaggerate or recycle data.
The claim is still a useful test of the regime Vietnam has just built. The new Law on Cybersecurity (No. 116/2025/QH15) took effect on 1 July 2026. The implementing Decrees 327–333/2026/ND-CP were issued on 19 August 2026, according to Rajah & Tann's summary.
The strongest case for the new framework
The state's logic deserves a fair hearing. Hosting, domain and email providers sit upstream of thousands of businesses and public bodies. When one is compromised, the harm spreads well beyond the provider. A unified law that replaces the 2018 Cybersecurity Law and the 2015 Network Information Security Law, classifies systems into five protection levels, and obliges providers to keep forensic logs is a rational response. Regulators cannot investigate what was never recorded. If the Mat Bao material is authentic, the exposure of identity documents and government correspondence would be exactly the harm the framework is meant to prevent.
What the decrees actually require
The obligations that stand out are about retention and localisation, not about resisting extortion.
- Log retention. Decree 333 requires service providers to keep system logs of account details, login and logout times, IP addresses and source ports, retrievable for at least 12 months. IP-identification logs must be kept in full and continuously, in storage that prevents modification or deletion and allows real-time provision to specialised forces.
- Localisation. Domestic enterprises must store covered user data in Vietnam, with a minimum storage period of 24 months.
- Incident notification. Managers of information systems must notify the competent specialised cybersecurity force "immediately" when an incident exceeds their capacity, and report results afterwards. The text sets no fixed deadline in hours.
The sanctions side is Decree 330. In Rajah & Tann's summary, cybersecurity violations carry maximum fines of VND200 million for organisations. Personal-data violations reach VND3 billion, and certain cross-border transfer violations can reach 5% of prior-year Vietnamese revenue.
Where the design cuts against its own goal
The first problem is that the obligations multiply the value of a breach. A provider must now keep at least 12 months of immutable, continuous logs that link identities to IP addresses, and must be able to hand them over in real time. Those logs are a concentrated trove for an extortion crew. A mandate to collect sensitive data without a matching, specific duty to secure it, encrypt it and segment it turns every compliant provider into a larger target. The decrees' retention rules are precise. The protective standard for the retained data is much less so.
The second problem is the notification trigger. "Immediately" when capacity is exceeded invites two bad outcomes. Providers may delay while deciding whether they are over capacity. Or they may over-report to a security ministry with no published protocol for confidentiality or follow-up help. Better regimes pair a clear clock with safe-harbour treatment for good-faith, timely disclosure. Without that, a victim's rational move is to say nothing, which is what Mat Bao has done so far. That silence may be perfectly legitimate while it investigates, but the framework gives it no structured way to speak.
Third, the penalty design looks backwards. A ceiling of VND200 million for an organisation's cybersecurity violation is small against the cost of a ransomware event. The personal-data tier is larger, but it punishes the breached entity. The attackers are in a different jurisdiction. Fines of that kind change behaviour only when paired with clear, achievable standards, and the ones here are largely deferred to system classification and appraisal timelines. Decree 331 gives organisations six months from 1 July 2026 to complete appraisal and 12 months to meet protection requirements. So the compliance window for a provider like Mat Bao was still open when the listing appeared.
Fourth, the alleged data touches the state itself. The listing reportedly references correspondence with the Government Cipher Committee. Decree 333 expressly carves Government Cipher Committee cryptographic systems out of the standard notification duties, which follow separate rules. That is understandable for classified systems. But if a private provider holds regulator correspondence, a carve-out for the state's own systems leaves a gap in how third-party exposure is reported.
A more proportionate path
Vietnam does not need to loosen its law. It should fill the gaps with guidance and not with heavier penalties:
- Publish a concrete notification clock, such as a fixed number of hours from awareness, with confidentiality commitments and limited liability for timely good-faith reports.
- Tie log-retention duties to minimum security controls: encryption at rest, access separation, offline backups. Make compliance with those controls a mitigating factor in sanctions.
- Offer victims incident-response support through the national response network the decree already names, so reporting leads to help and not only to scrutiny.
- Say publicly whether paying ransoms is discouraged, tolerated or reportable. The decrees, as summarised, do not address it.
What to watch
The Rhysida claim may prove inflated, partial or recycled. The policy question holds either way. A regime that mandates collection, localisation and fast handover will see more concentrated data, and it needs an equally clear regime for protecting it and for what happens after it is stolen. The first real test will be whether authorities, Mat Bao or both explain what, if anything, was taken.