Latest News

US telecom giant AT&T disclosed that hackers had stolen call records for tens of millions of its customers. In a surprising twist, the company paid a member of the hacking team more than $300,000 to delete the stolen data and provide proof of deletion. Hackers Exploited Poorly Secured Snowflake Accounts. The breach affected nearly all AT&T cellular customers and customers of other carriers who communicated with them between May and October 2022, and on January 2, 2023. Landline numbers were also impacted.

Despite AT&T’s payment to delete the stolen data, some customers may still be at risk as others might possess portions of the data. The incident highlights the growing threat of hackers exploiting vulnerabilities in cloud storage systems to steal sensitive information from major corporations.

Event completed. Presentation will be posted in DPO website ITS/DPO Training.

July 11 - HKU co-organized with PCPD for Higher Education community - https://hkuems1.hku.hk/hkuems/ec_hdetail.aspx?ueid=94510. Privacy principles will be highlighted and best practices and preventive measures in cybersecurity will be discussed.

14:15 - Reception

14:30 – 15:15 - Ms Clemence WONG, Acting Senior Counsel, PCPD
• Highlights of Data Privacy Laws
15:30 – 16:10 - Mr Arktos Lam, Cybersecurity Manager, HKIRC
• Cybersecurity in Higher Education
16:15 - 16:35 BREAK
16:35 – 17:15 - Panel Discussion (Addressing Future Challenges in Higher Education)
• Specifics about Cross Border Data Flow and Control (Ms. Chandy Ye, Director of Data Privacy Committee of HKCNSA)
• Trends in Privacy Regulations (Ms Ines Lee, Head of Legal Division, PCPD)

• Addressing Risks of AI & Cyber Threat Trends (Mr Arktos Lam, Cybersecurity Manager, HKIRC)

Posted since June 17

HKPF (CSTCB) - HKIRC - PCPD: "Ethical Phishing Email Campaign 2024"

The Cyber Security and Technology Crime Bureau of Hong Kong Police Force and the Hong Kong Internet Registration Corporation Limited co-organise “Ethical Phishing Email Campaign 2024” (the Campaign) to raise your staff awareness about suspicious emails and improving your organisation’s cyber security posture. The Campaign is supported by the Office of the Privacy Commissioner for Personal Data.

The Campaign will be conducted from August to September 2024, and participation will be free of charge. During the Campaign, your provided email addresses will receive several pseudo-phishing emails at irregular intervals to test your staff’s awareness.

Once the campaign concludes, each participating organisation will receive a comprehensive report on their employees’ performance in handling suspicious emails.

The Macau SAR has seen a recent uptick in identity theft and cybercrime, with an influx of sponsored ads popping up on social media platforms. The cyber attack followed a surge in fraudulent activities and other related crimes in the city. 

Cyber attack in Secretaries offices in Macau was started 8pm on July 10, resulted in the inactivity of several websites, including those of the Office of the Secretary for Security, Public Security Police Force, the Fire Services Bureau, the Public Security Forces Affairs Bureau of Macau and the Academy of Public Security Forces “due to a distributed denial-of-service (DDoS) attack from overseas.” The Judiciary Police have already begun investigations into the incident.

South China Morning Post (scmp.com) - Overseas cyberattack shuts down 5 Macau government websites for 45 minutes - https://www.scmp.com/news/article/3270048/overseas-cyberattack-shuts-down-5-macau-government-websites-45-minutes

- Proposed Legislative Framework to Enhance Protection of  the Computer Systems of Critical Infrastructure (https://www.legco.gov.hk/yr2024/english/panels/se/papers/se20240702cb2-930-3-e.pdf)

- Legislate for Cybersecurity of Critical Infrastructure

23. To address the increasing risks of cyber-attacks globally, the Government is working to enhance the cybersecurity of our critical infrastructure, including energy, telecommunications, transportation, financial institutions, etc. We will introduce a bill into the Legislative Council (LegCo) for this purpose in 2024 (https://www.policyaddress.gov.hk/2023/en/p21.html)

- The Standard (https://www.thestandard.com.hk/breaking-news/section/4/217804/Govt-mulling-new-law-to-enhance-critical-infrastructure-computer-systems-protection)

• The Security Bureau seeks to regulate critical infrastructure operators to be responsible for securing their Critical Computer Systems (CCSs) and plugging the potential security loopholes to prevent personal data and business information from leaking.

•  8 sectors of essential services – including energy; information technology; banking and financial services; land transport; air transport; maritime; healthcare services and communications and broadcasting.

• CIOs have to formulate and implement a computer system security management plan and submit the plan to the newly established Commissioner’s Office for the implementation of the proposed legislation by the Security Bureau on strengthening critical infrastructure computer systems protection.

• For those CIOs who failed to formulate and implement a computer system security management plan, or have not conduct system security risk assessment according to the standard, the maximum fine will be up to HK$5,000,000.

The Office of the Privacy Commissioner for Personal Data (PCPD) participates in the “Bug ​​Hunting Campaign 2024” (Campaign) as a Strategic Partner. The Campaign is co-organised by the Cyber ​​Security and Technology Crime Bureau (CSTCB) of the Hong Kong Police Force and Cyberbay.  Organisations which enrol in the Campaign will have their website security levels tested by cybersecurity experts to help identify potential vulnerabilities. The CSTCB will announce the list of participating organisations that meet the specified cybersecurity requirements on the official website of “CyberDefender” to commend their efforts in safeguarding cybersecurity.

The Campaign is now open to organisations for registration. Please click below for the details. 

https://www.cyberbay.tech/zh/events/protectHK2024

Re-organized on July 3 - Rgistration link: https://www.pcpd.org.hk/spec_event/spec_event81_apply_cn.php

Date: 3 July 2024 (Wednesday)

Time: 3:00 pm – 4:30 pm

https://www.pcpd.org.hk/english/whatsnew/20240524.html - Summary

https://www.pcpd.org.hk/english/whatsnew/files/20240523Seminar_PPT.pdf - Deck

https://www.pcpd.org.hk/spec_event/spec_event79_apply.php - Invitation

PCPD notes that cyberattacks on the information systems of organisations occurred from time to time, resulting in the leakage of personal data. These incidents were generally caused by the organisations’ failures to adopt adequate and effective organisational or technical security measures to protect their information systems, or by the negligence or error of staff members.

Ms Ada CHUNG Lai-ling, the Privacy Commissioner, and Mr Brad KWOK, Chief Personal Data Officer of the PCPD will talk about lessons learnt from data breach cases which occurred in recent years, and elaborate on the causes of the data breaches and the remedial measures taken. The speakers will also provide their recommendations on how to enhance cybersecurity and data security measures, as well as highlight the key points in preventing and handling data breach incidents.

Date: 23 May 2024 (Thursday)

Time: 3:00 pm – 4:15 pm

Note: Event posted on May 29

“Artificial Intelligence: Model Personal Data Protection Framework”

Quick reference to Leaflet - 

https://www.pcpd.org.hk/english/resources_centre/publications/files/leaflets_protection_framework.pdf (English); https://www.pcpd.org.hk/tc_chi/resources_centre/publications/files/leaflets_protection_framework.pdf (Chinese)

Framework - 

https://www.pcpd.org.hk/english/resources_centre/publications/files/ai_protection_framework.pdf (English);  

https://www.pcpd.org.hk/tc_chi/resources_centre/publications/files/ai_protection_framework.pdf (Chinese)

Recommended measures of 3 Data Stewardship Values & 7 Ethical Principles in the “Guidance on the Ethical Development and Use of AI” published in 2021:

• Establish AI Strategy and Governance

• Conduct Risk Assessment and Human Oversight

• Customisation of AI Models and Implementation and Management of AI Systems

• Communication and Engagement with Stakeholders: Communicate and engage regularly and effectively with stakeholders

post since June 12

The School of Continuing and Professional Studies, The Chinese University of Hong Kong (CUSCS) fell victim to hackers in June, affecting about 20,870 Moodle users.

CUSCS said Thursday the Moodle online learning platform has been hacked on June 3.

The information involved included the names, email addresses and student numbers of 20,870 Moodle accounts, including employees, part-time tutors, students, graduates and some visitors.

CUSCS online learning platform Moodle was hacked involving over 20,000 accounts by i-CABLE, Chinese only

CUSCS alleged that on June 3, it was discovered that the Moodle e-learning platform had been hacked, involving information including the names, email addresses and student numbers of 20,870 Moodle accounts, including staff, adjunct tutors, students, graduates and some visitors. The School has reported the incident to the Police, and the University has reported the incident to the Office of the Privacy Commissioner for Personal Data in accordance with the established procedures, and other relevant follow-up work will continue.

Scams in various forms often involve swindling and embezzling citizens’ personal data, including names, identity card numbers, contact numbers, email addresses and credit card details. Members of the public must stay vigilant at all times, especially when using smartphones and social media, in order to prevent fraudsters from obtaining your personal data. Speakers include:

• Ms Joyce LAI, Assistant Privacy Commissioner for Personal Data (Corporate Communications and Compliance)

• Mr Andy LAU, Senior Inspector of Police, ADCC (Publicity) of the Commercial Crime Bureau, Hong Kong Police Force

Secretary for Innovation, Technology and Industry (Sun Dong) to address. 

Cybersecurity incidents, including unauthorised access into computer systems by hackers and leakage of personal data, have occurred one after another in government departments and other public organisations in recent years, which have aroused public concern and worries:

1) whether penalties to be imposed on the responsible personnel concerned;

2) monitor compliance by government departments and other public organisations with the Guidance Note on Data Security Measures by PCPD;

3) whether any civil servant has been subjected to disciplinary actions as a result of the data leakage incidents mentioned in 1);

4) enhance the cybersecurity of government departments and other public organisations;

5) specific plans and measures (including amending or enacting the relevant legislation) the Government has in place in the coming year to enhance the cybersecurity.

Consultation Paper on Cyber-Dependent Crimes and Jurisdictional Issues published (with photo/video) (info.gov.hk) - https://www.info.gov.hk/gia/general/202207/20/P2022072000144.htm

A hacker group called RansomHub said it was behind the cyberattack that hit the Christie’s website just days before its marquee spring sales began, forcing the auction house to resort to alternatives to online bidding.

Cybersecurity experts said that RansomHub has emerged in recent months as an especially powerful ransomware group with possible connections to ALPHV, a network of Russian-speaking extortionists blamed for a cyberattack on Change Healthcare earlier this year. Hackers in that case appeared to receive a $22 million payment from the company’s owner, UnitedHealth Group, though United never admitted to sending the money. In April, RansomHub listed Change Healthcare as one of its victims and claimed to be holding onto four terabytes of stolen data.

The Seattle Public Library’s online catalog, e-books, Wi-Fi and public computers have all been taken offline Tuesday, as the agency investigates what it described as a ransomware event.

The library had planned to take its systems offline from Saturday night to Monday night for planned maintenance. The systems were supposed to be back up Tuesday, but they remain offline due to the ransomware event.

Webinar in Chinese ONLY

https://www.cyberbay.tech/events/protectHK2024

主辦機構將於2024年6月3日，3:00-4:00pm舉辦網上簡介會。

如欲參加，請電郵至： kenneth@cyberbay.tech 登記或索取更多活動資料，

或於活動當日直接按下以下會議鏈結：https://meet.google.com/coa-cwho-nmu

The British engineering company Arup has confirmed it was the victim of a deepfake fraud after an employee was duped into sending HK$200m (£20m) to criminals by an artificial intelligence-generated video call.

Arup confirmed that fake voices and images were used and added: “Our financial stability and business operations were not affected and none of our internal systems were compromised.”

Arup, one of the world’s leading consulting engineering firms, employs more than 18,000 people and famously provided the structural engineering for the Sydney Opera House including its distinctive concrete shells. Recent project involvements include the Crossrail transport scheme in London and the Sagrada Família in Barcelona.

ENG: https://www.scmp.com/news/hong-kong/education/article/3263231/hong-kong-secondary-schools-computer-servers-hacked-access-4-years-worth-data-blocked - 

Hong Kong Institute of Contemporary Culture Lee Shau Kee School of Creativity says IT staff on May 13 discovered access had been blocked to eight terabytes of data. Personal details of students, parents and staff over the past four years, including those who graduated in 2021 were affected.

CHN: https://www.stheadline.com/society/3345707

Design and engineering company Arup, which has also been active in the UAE for over 75 years now, has confirmed in a recent interview with CNN that it was targeted by deepfake scammers. 

The scam led to one of its Hong Kong employees paying out $25 million to the fraudsters, Arup told CNN.

From other info source - According to the police, the employee initially suspected he had received a phishing email from the company’s UK office, which mentioned the need for a confidential transaction. However, after the video call, where attendees looked and sounded like his recognised colleagues, he dismissed his doubts. He then agreed to transfer a total of 200 million Hong Kong dollars (about $25.6 million) across 15 transactions, as reported by Hong Kong public broadcaster RTHK, citing police.

Under the theme of “Safeguard Data Security • Safeguard Privacy!”, the PCPD held a series of promotional and educational activities in May, which included launching a mobile exhibition truck “Privacy Protection Truck” to reach out to the community, organising a data security seminar and introducing a data security mascot “Data Guardian”, with a view to raising the awareness of safeguarding data security among organisations and members of the public.

On 13 May, the PCPD organised the kick-off ceremony (the Ceremony) for the Mobile Exhibition “Privacy Protection Truck” at St. Paul’s Convent School (SPCS). The Supervisor and Principal of SPCS Sister Margaret WONG, members of the Personal Data (Privacy) Advisory Committee of the PCPD Mr. Raymond SY Kim-cheung, JP, Mr Joseph LIN Ho-man, MH, Dr Patrick WONG Chi-kwong, as well as members of the Standing Committee on Technology Development of the PCPD, Professor the Hon K F WONG, MH, Professor Jason LAU, Professor S M YIU, Ir Alex CHAN, Mr Alan CHEUNG and Dr Gregg LI officiated the Ceremony. Mr Albert Au, a renowned host, was the emcee of the event.

Europol, the European Union's law enforcement agency, confirmed that its Europol Platform for Experts (EPE) portal was breached and is now investigating the incident after a threat actor claimed they stole For Official Use Only (FOUO) documents containing classified data. 

EPE is an online platform law enforcement experts use to "share knowledge, best practices and non-personal data on crime."