150k people affected by Canvas data breach

The online learning platform Canvas experienced a data breach that impacted over 150,000 students and staff members from four educational institutions in Hong Kong. The breach was discovered by its operator, Instructure, on April 29 and was traced back to a hacking group that exploited a cross-site scripting vulnerability through a free-for-teacher account.

Personal information such as names, email addresses, usernames, and student IDs were stolen during the cyberattack. At first, seven institutions reported potential breaches, but further investigation revealed that only four – City University, Hong Kong Academy for Performing Arts, Hong Kong Institute of Construction, and Hong Kong University of Science and Technology – were actually affected.

City University disclosed that 146,969 students and staff had their data exposed, while HKAPA and HKIC had about 4,584 and 2,333 records compromised, respectively. The status of HKUST's data is still under verification. Ada Chung, the Privacy Commissioner for Personal Data, stated that the affected institutions had taken necessary precautionary measures before using Canvas, including pre-assessments, contractual safeguards, and monitoring mechanisms.

She concluded that the institutions had not violated the Personal Data (Privacy) Ordinance as there was no evidence of failing to take all practicable steps to protect the personal data in their possession. Chung emphasized the importance of thorough due diligence on data processors, regulating them through contracts, and enabling security features like multi-factor authentication.