Hong Kong Privacy Watchdog: Over 153,000 Affected in Canvas Data Breach

Hong Kong's privacy watchdog has revealed that a global cyberattack on the online learning platform Canvas in May impacted more than 153,000 students and staff across four local educational institutions. This figure significantly exceeds the initial estimate of 72,000 individuals reported by the Office of the Privacy Commissioner for Personal Data (PCPD).

The PCPD's investigation confirmed that the City University of Hong Kong (CityU), the Hong Kong Academy for Performing Arts (HKAPA), the Hong Kong Institute of Construction (HKIC), and the Hong Kong University of Science and Technology (HKUST) were affected. The City University of Hong Kong was the hardest hit, with personal data of nearly 147,000 students and staff, including names, email addresses, and student IDs, being leaked. HKAPA reported around 4,500 affected individuals, and HKIC reported approximately 2,300.

While the initial reports suggested seven institutions were affected, the PCPD's findings narrowed it down to these four. The watchdog stated that the internal systems of these institutions, separate from Canvas, remained unaffected. Security measures were in place prior to the breaches, including pre-assessments of Canvas and contractual agreements with the platform operator, Instructure.

The PCPD concluded that the data breaches stemmed from vulnerabilities related to the third-party platform itself, and there was no evidence to suggest the institutions had failed in their duty to protect personal data. However, the watchdog has recommended that the affected institutions reassess data breach risks, enhance monitoring of third-party platforms, minimize stored data, and strengthen overall data security measures.

“

The Affected Institutions confirmed that their internal systems (i.e. systems other than Canvas) have not been affected by the Incident.