Global Markets
Home›Global Markets›Asia›Canvas data breach exposes personal data for 153,866 i…
Canvas data breach exposes personal data for 153,866 in Hong Kong
The Hong Kong privacy watchdog said the incident was linked to vulnerabilities in a third-party platform, and the exposed information did not include sensitive personal data.
More than 153,000 students and staff in Hong Kong were affected by a data breach on the online learning management platform Canvas, according to an investigation by the city’s privacy watchdog.
The Office of the Privacy Commissioner for Personal Data said the near four-month gap from discovery reflected that the breach stemmed from vulnerabilities related to a third-party platform, while it did not impact the internal systems of the four affected tertiary institutions.
An overwhelming 96.0% of the at least 153,866 affected accounts were from City University of Hong Kong, totaling 146,969 accounts, including about 34,000 active staff and student accounts and the rest archived inactive accounts. The Hong Kong Academy for Performing Arts reported 4,584 affected accounts, and the Hong Kong Institute of Construction had 2,333.
The exposed information was described as limited to basic identifiers such as names, student IDs, and email addresses, and it included items like usernames, course enrolment information, login IDs, and messages sent by users, with CityU saying it did not involve any sensitive personal data. The figure for the Hong Kong University of Science and Technology was pending verification, the report said.