More than 153,000 students, staff affected in Canvas data breach: privacy watchdog
More than 153,000 students and staff from four tertiary institutions in Hong Kong have been affected by a data breach on the online learning management platform Canvas, an investigation by the city’s privacy watchdog has found. Nearly four months after the data breach was discovered, the Office of the Privacy Commissioner for Personal Data (PCPD) said on Thursday that the incident stemmed from…
A data breach on the learning management platform Canvas has affected over 153,000 students and staff from four tertiary institutions in Hong Kong, according to an investigation by the city’s privacy watchdog. The breach, which occurred nearly four months ago, was caused by vulnerabilities in a third-party platform but did not impact the internal systems of the affected institutions.
Of the 153,866 individuals affected, 96% were from City University of Hong Kong (CityU), with around 34,000 of their accounts being active. The remaining accounts were inactive and archived.
The data breach involved basic identifiers such as names, student IDs, and email addresses, but did not include any sensitive personal information. The affected institutions – CityU, the Hong Kong Academy for Performing Arts, the Hong Kong Institute of Construction, and the Hong Kong University of Science and Technology – did not appear to have failed to take all practicable steps to safeguard personal data while using Canvas. Therefore, there was no contravention of the Personal Data (Privacy) Ordinance.
Privacy Commissioner Ada Chung Lai-ling noted that the affected institutions had conducted pre-assessments, adopted contractual measures, and established monitoring mechanisms to protect personal data transferred to Canvas. Instructure, the company that operates Canvas, reported that hackers had stolen personal data from an estimated 9,000 institutions worldwide, including seven in Hong Kong, impacting a total of 72,571 people.
In May, Instructure reached an agreement with the attacker to return all stolen data. The PCPD recommended that the educational institutions reassess data breach risks, strengthen monitoring of third-party platform security measures, review and minimize stored personal data, enable multi-factor authentication, and define clear access rights and data retention periods to ensure data security.
Written by urgent.news from South China Morning Post's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
