Latest News

Seven cassettes of tapes were lost during the transportation from the Immigration Tower to the Queensway Government Offices on December 23 2024 in accordance with the recovery and backup procedures. The incident has been reported to the relevant authorities, including the Hong Kong Police Force, the Office of the Privacy Commissioner for Personal Data, the Security Bureau and the Digital Policy Office. PCPD received a notification of the data breach incident on 24 January and had initiated an investigation into the incident in accordance with established procedures.

In late December 2024, an unidentified threat actor used stolen credentials to access its PowerSchool Student Information System (SIS) platform. The information grabbed included names, postal addresses, grabbed in some districts Social Security numbers (SSN), personally identifiable information (PII), medical information, and grades.

Last news posted on July 29 2024-Oxfam HK revealing it suffered cyberattack

PCPD report - The investigation revealed that over 330 GB of data was exfiltrated potentially affected around 550,000 data subjects. Below deficiencies of Oxfam contributed to the occurrence of the Incident:

1. Outdated Firewalls which contained critical vulnerabilities;

2. Failure to enable multi-factor authentication;

3. Lack of critical security patches of servers;

4. Ineffective detection measures in the information systems;

5. Inadequacies of the security assessments of information systems;

6. Lack of specificity of its information security policy; and

7. Prolonged retention of personal data.

The government says it will look at how big the fines should be for companies that breach data protection laws to make sure they are acceptable to firms, while still having a deterrent effect.

LCQ2: Prevention of personal data breaches and financial crimes

https://www.info.gov.hk/gia/general/202501/22/P2025012200305.htm

Subsequent to the briefing for the Panel on Financial Affairs of the Legislative Council in October 2024, the Government is currently drafting the legislative amendments and will continue to engage the PCPD and other stakeholders to ensure that a balance is struck between fighting against financial crime and safeguarding personal data privacy in the legislative amendments.

PCPD received 1,158 enquiries relating to suspected personal data frauds in 2024 (793 in 2023); including

1. Fraudulent Recruitment Advertisements Scams

2. Scams Using Instant Messaging Applications (Apps)

3. Scams by Counterfeit Customer Service Agents/Online Auction Platforms

4. SMS/Email Scams

5. Telephone Scams

6. Scam Videos Using Artificial Intelligence (AI) Deepfake Technology

7. Scams on Social Media Platforms

Tips

1. Be vigilant

2. Authenticate the identity of callers

3. Keep an eye on your accounts and transaction records

4. Password protection

5. Smart use of social media and instant messaging apps

6. Fraud prevention information

The Volunteer Team of the PCPD visited St. James’ Settlement Wan Chai District Elderly Community Centre on 20 December and organised a Christmas fraud prevention gathering for around 200 elders. The event aimed to enhance the elderly’s awareness of fraud prevention in a lively and joyful way.

Powerpoint in Chinese only - https://www.pcpd.org.hk/english/news_events/media_statements/files/20241220_PC.pdf

Japan Airlines (JAL) got attack, which began at 7:24 AM local time , targeted the airline’s internal and external network equipment, leading to system malfunctions that have impacted communication and operational processes.

JAL is the nation’s second-largest airline, reported a significant cyberattack on its systems early Thursday morning, causing disruptions to both domestic and international flight operations.

In 2022, a similar attack disrupted operations at a Toyota supplier, halting production at domestic plants for an entire day. More recently, in June 2024, the video-sharing platform Niconico suspended its services due to a large-scale cyberattack.

PCPD has served enforcement notices on JobsDB and 3 recruiting organisations, directing them to take measures to remedy the contraventions and prevent recurrence and issued an advisory letter to each of the remaining five organisations.

PCPD call upon other operators of online recruitment platforms to:

• Beware of anyone using Blind Ads to perpetrate frauds or collect personal data by unfair means; and

• Carefully review recruitment advertisements received to identify Blind Ads and avoid publishing the same in order to protect the personal data privacy of members of the public.

The PCPD reiterated that Blind Ads may be used as an unscrupulous means to collect personal data and may be misused by swindlers to collect personal data for fraudulent activities. When job seekers are unable to ascertain the employers’ identities, they should check and verify the information contained in the Blind Ads carefully and should not respond to the Blind Ads arbitrarily and submit their personal data.

PCPD has uncovered a significant data breach involving EMSD, affecting over 17,000 individuals who were subject to 14 compulsory testing during the pandemic from March to July 2022,  including names, addresses, identity card numbers, and phone numbers. 

This incident highlights four major deficiencies in the EMSD’s handling of personal data.

1. Lack of written policies on the retention of personal data collected in the RTD operations.

2. Failure to make unequivocal request to the contractor for deletion of the relevant data.

3. Failure to take the initiative to delete the personal data involved.

4. Failure to properly follow up with the contractor on the deletion of data.

Investigation report: https://www.pcpd.org.hk/english/enforcement/commissioners_findings/files/r24_06502_e.pdf

Notorious ransomware group Brain Cipher has claimed to have breached Deloitte UK, allegedly exfiltrating over 1 terabyte of sensitive data from the professional services giant.

Brain Cipher is a ransomware group that emerged in June 2024, quickly gaining notoriety for its cyberattacks on organizations worldwide. Notably, it was responsible for a significant attack on Indonesia’s National Data Center, which disrupted services for over 200 government agencies, including immigration and passport control.

According to statements posted by Brain Cipher, the attack has exposed critical vulnerabilities in Deloitte UK’s cybersecurity infrastructure.

The PCPD and HKPC jointly released the results of the “HK Enterprise Cyber Security Readiness Index and AI Security” survey on 21 November. The “HK Enterprise Cyber Security Readiness Index” has increased by 5.8 points to 52.8 points (maximum being 100 points) compared with last year. The index comprises four areas including “Policy and Risk Assessment”, “Technology Control”, “Process Control” and “Human Awareness Building”.

Full survey: https://www.pcpd.org.hk/english/resources_centre/publications/surveys/files/AISecuritySurvey2024.pdf

HKPC’s “Phishing Defence Services”: https://www.hkpc.org/en/our-services/digital-transformation/cyber-security/phishing-defence-services

Finastra, a global leader in financial technology that serves 45 of the world’s top 50 banks, has confirmed a major data breach impacting its internal file transfer system SFTP. The London-based firm, which facilitates vital banking and wire transfers for over 8,100 financial institutions worldwide, detected the breach on Nov. 7. 

The breach targeted Finastra’s internally hosted Secure File Transfer Platform, or SFTP, which was exploited using stolen credentials—essentially, a username and password.

Facebook's ongoing privacy struggles, a German court has ruled that users affected by the massive 2019 data breach can seek compensation without proving specific damage, as reported by Bloomberg. This ruling represents a meaningful shift in how tech companies may be held accountable for data protection failures.

The 2019 breach exposed the personal information of 533 million Facebook users across 157 countries through a technique known as "scraping." The scope of exposed information was extensive, including full names, phone numbers, locations, birth dates, email addresses and biographical information.

2019 - https://www.forbes.com/sites/ajdellinger/2021/04/03/personal-date-of-533-million-facebook-users-leaks-online/

Amazon confirmed a data breach involving employee information after data allegedly stolen during the May 2023 MOVEit attacks was leaked on a hacking forum. The threat actor Nam3L3ss, published over 2.8 million lines of Amazon employee data, including names, contact information, building locations, email addresses, and more.

Amazon spokesperson Adam Montgomery confirmed Nam3L3ss' claims, adding that this data was stolen from systems belonging to a third-party service provider. 

Nam3L3ss has also leaked the data from twenty-five other companies. However, they say some of the data was obtained from other sources, including ransom gangs' leak sites and exposed AWS and Azure buckers.

Widex Hong Kong Hearing and Speech Centre and subsidiary Starry Hearing and Speech Centre say they were among outlets suffered a ransomware attack on July 5 that had encrypted their internal system data and impacted their applications.

The Office of the Privacy Commissioner for Personal Data estimated on Nov 4 that about 148,000 customers and 30-50 current and former employees had been affected.

Widex is a Denmark-based company that was founded in 1956 and specialises in hearing aids and related services. Its Hong Kong branch was established in 1986 and is one of the first private institutions to offer hearing and speech therapy services in the city. 

It marked HACLA’s second major cybersecurity breach in just two years, spotlighting significant challenges in securing critical public sector data. The Cactus ransomware gang has reportedly exfiltrated nearly 900GB of sensitive data from the organization; including:

• Personal identification information

• Database backups

• Financial documents

• Executive and employee records

• Customer information

• Internal corporate communications

HACLA, responsible for managing over 32,000 public housing units and overseeing a budget of $1 billion annually.

Look forward to your active participation!!

Landmark Admin, a company that provides administrative services to several major U.S. insurance carriers, has recently announced that a cyberattack in May 2024 exposed the personal information of over 800,000 individuals. The compromised information includes highly sensitive details such as names, Social Security numbers, driver's license numbers, passport numbers, tax IDs, bank details, medical information, health insurance policy numbers, and even life and annuity policy details.

Federal legislators confirm February's UnitedHealth's statement back in April that the data breach exposed data of a third of all Americans. 

After completing its investigation into February's data breach, the US Department of Health and Human Services said this week that roughly a third of all Americans' health data was exposed in the attack. In February, the ransomware hacking group ALPHV, also known as "BlackCat," launched a cyberattack on UnitedHealth subsidiary Change Healthcare. 

Change Healthcare is one of the largest health payment processing companies in the world and works with leading insurance companies like Aetna, Anthem, Blue Cross Blue Shield, and Cigna.

Continuation to Feb 26 news posted on DPO website 

https://www.bleepingcomputer.com/news/security/unitedhealth-confirms-optum-hack-behind-us-healthcare-billing-outage/

On 3 October 2024, PCPD expressed concern regarding LinkedIn’s default opt-in setting for using Hong Kong users’ personal data and content on the platform to train its generative AI models for content creation, and wrote to LinkedIn to enquire into the matter. 

The PCPD received a response from LinkedIn on Oct 13 confirming that it has paused any use of Hong Kong users’ personal data for such purposes as of 11 October 2024 while the PCPD’s concerns are being addressed.