Latest News

EY’s Emerging Tech at Work 2023 survey reveals that 89% of employees believe adopting emerging tech benefits their company. Still, cybersecurity risk can be a barrier to adoption.

According to the same EY survey, approximately 73% of employees are concerned about the cybersecurity risks associated with generative AI, and 78% worry about quantum computing.

1. Start with clear-cut training

2. Shield the cloud

3. Monitor for data leaks

4. Minimize data retention

Hong Kong’s privacy watchdog is investigating a large-scale data breach at a prominent sports club involving the loss of about 70,000 members’ personal information, including identity card and passport details.

The Office of the Privacy Commissioner for Personal Data on Tuesday also urged members of the South China Athletic Association (SCAA) to report any suspicious activity, a day after the club announced the data leak.

The breach includes possible theft of information such as members’ names, identity card and passport numbers, and addresses, as well as their contact details.

ENG - https://www.scmp.com/news/hong-kong/society/article/3255944/hong-kong-privacy-watchdog-probes-data-breach-prominent-sports-club-involving-loss-about-70000

CN - https://news.rthk.hk/rthk/ch/component/k2/1745249-20240319.htm

The cyberattack on Nissan Motor Corporation and Nissan Financial Services in Australia and New Zealand, which happened in December 2023 resulted in the theft of sensitive data belonging to roughly 100,000 people, the company has confirmed.

In early December last year, Japanese car manufacturing giant said it was investigating a possible data breach. In an update posted on its website Nissan on Mar 14 said it had started notifying affected individuals, with data stolen from customers, current and former employees, as well as some dealers. Customers include owners of Mitsubishi, Renault, Skyline, Infiniti, LDV, and RAM brands, the company noted. Nissan believes that roughly 10% of the victims have had “some form of government identification” compromised. That includes 4,000 Medicare cards, 7,500 driver’s licenses, 220 passports, and 1,300 tax file numbers.

Acer Philippines confirmed that employee data was stolen in an attack on a third-party vendor who manages the company's employee attendance data after a threat actor leaked the data on a hacking forum. 

A threat actor known as 'ph1ns' published a link to download a stolen database containing Acer employee data for free on a hacking forum.

Acer is a Taiwanese maker of computer hardware and electronics. Earlier today, 

Okta denies that its company data was leaked after a threat actor shared files allegedly stolen during an October 2023 cyberattack on a hacker forum. After the internal investigation was completed in late November, it was revealed that the incident impacted all users of the customer support system, including a notable case being a subsequent compromise of one of Cloudflare's self-hosted Atlassian servers where the hackers employed access tokens stolen during the Okta breach.

Okta is a San Fransisco-based cloud identity and access management solutions provider.

To help enterprises and organisations understand how to effectively respond to cyber security risks and data leakage incidents, PCPD and HKIRC co-organise the seminar (please join online or F2F) to share the latest developments and trends of cyber threats, provide tips to enhance cyber security and highlight the key steps to prevent and cope with data breach incidents.

The Swiss government had around 65,000 files related to it stolen by the Play ransomware gang during an attack on an IT supplier, its National Cyber Security Center (NCSC) says. A total of 1.3 million files were stolen during the incident at software biz Xplain in May 2023, – a collection of seven federal agencies that alongside the Federal Council comprise the main government departments. Among them were classified files and sensitive, personally identifiable information (PII) – all of which are believed to be published on the dark web.

Hackers stole "sensitive information" including military and government documents from Taiwan's largest telecom company and sold it on the dark web, the island's ministry of national defence has said. The confirmation followed a report by local news channel TVBS on the hack of  Chunghwa Telecom. That report included a screenshot of a post in which hackers announced they were "selling Chunghwa Telecom 1.7 TeraBytes of data" that included government contracts.

Seminar on “Enhancing Data Security to Prevent Cyber Attacks”

PCPD - https://www.youtube.com/watch?v=hOSaUZuvzPk&feature=youtu.be

Hong Kong Police Force - https://youtu.be/3xk5sYnZHcc

American Express is warning customers that credit cards were exposed in a third-party data breach after a merchant processor was hacked. "We became aware that a third party service provider engaged by numerous merchants experienced unauthorized access to its system," explains the data breach notification.

UHG Optum was forced to shut down IT systems and various services after a cyberattack by “nation-state” hackers on the Change Healthcare platform.

United Health Group (UHG) is a health insurance company with a presence across all 50 US states. The organization is the world's largest healthcare company by revenue ($324.2 billion in 2022), employing 440,000 people worldwide. Its subsidiary, Optum Solutions, operates the Change Healthcare platform, which is the largest payment exchange platform between doctors, pharmacies, healthcare providers, and patients in the US healthcare system.

Despite ransomware losses remaining high, privacy violations have quickly risen to second in a list of expected cyber insurance claims costs. 

"Pixel-tracking claims are the latest target for the plaintiffs' bar — going after companies tracking website activity through pixels on the screen without obtaining proper consent." Activities like that could be why 31% of cyber insurance underwriters in a Woodruff Sawyer survey picked privacy as their top concern for 2024 — second only to ransomware, chosen by 63% of respondents.

Threat actors exploit Cisco AnyConnect vulnerabilities to gain unauthorized access to networks, compromise sensitive information, and potentially execute malicious activities. Exploiting these vulnerabilities allows attackers to bypass security measures, leading to unauthorized control over network resources, potential disruptions to operations, cyber espionage, data theft, and ransomware deployment.

The Hipocrate Information System (HIS) used by hospitals is offline after its database was encrypted. While 25 hospitals have already been confirmed to have had their data encrypted by the attackers, 75 other healthcare facilities using HIS have also taken their systems offline as a precautionary measure while the incident is investigated.

While Bank of America has yet to disclose how many customers were impacted by the data breach, an IMS breach notification letter filed with the Attorney General of Maine on behalf of Bank of America revealed that a total of 57,028 people were directly impacted.

Hyundai has confirmed to be the victim of a cyber breach. 3TB of data from the German-based division have been nabbed. Black Basta is believed to be an offshoot of the notorious Conti ransomware gang and has raked in at least over $100 million in Bitcoin ransom payments since its inception in early 2022, according to a November 2023 report by Elliptic and Corvus Insurance.

The computer servers of the Faculty of Education (“Faculty”), HKU were under cyberattack on January 30. Upon the Faculty’s preliminary evaluation, the personal data in the files might include information on around 400 academic visitors, around 3,000 students’ study status, and around 4,000 applicants of research degree programmes. At the moment, there is no evidence suggesting that salary information, bank account details, or HKID numbers of any individuals have been exfiltrated.

A company employee in the Chinese finance hub received “video conference calls from someone posing as senior officers of the company requesting to transfer money to designated bank accounts”, police told AFP.

Police received a report of the incident on January 29, at which point some HK$200 million (US$26 million) had already been lost via 15 transfers.

The PIPL sets out seven legal bases for processing personal information, and medical institutions and pharmaceutical companies can process personal information in Part One.

Part two introduces the specific protection obligations to be fulfilled by medical institutions and pharmaceutical companies in the key contexts of processing personal information.

The Office of the Privacy Commissioner for Personal Data provides recommendations and suggestions to the food and beverage industry, regarding protecting customers' personal data privacy when using electronic food ordering services. Recommendations for Food Ordering with Mobile Apps and for Scanning QR Codes for Food Ordering. https://www.pcpd.org.hk/english/resources_centre/publications/files/foodordering_leaflet.pdf