Over 153,000 students, staff affected in Canvas data breach, Hong Kong privacy watchdog says

Hong Kong's privacy watchdog, the Office of the Privacy Commissioner for Personal Data (PCPD), has revealed that over 153,000 students and staff from four educational institutions were affected by a data breach on the online learning platform Canvas in May. The PCPD's findings, based on investigations into the global cyberattack on Canvas, were published on Thursday.

The four institutions in Hong Kong that were affected are the City University of Hong Kong (CityU), the Hong Kong Academy for Performing Arts (HKAPA), the Hong Kong Institute of Construction (HKIC), and the Hong Kong University of Science and Technology (HKUST). The breach exposed sensitive personal information, including names, email addresses, usernames, student IDs, and course enrolment details.

CityU was the most impacted, with nearly 147,000 students and staff having their personal data leaked. HKAPA and HKIC each had around 4,500 and 2,300 individuals' information stolen, respectively. The number of affected individuals at HKUST is still being verified by Instructure, the company that operates Canvas.

The PCPD stated that internal systems of the affected institutions, apart from Canvas, were not compromised. The data breach occurred due to vulnerabilities in a third-party platform, and there is no evidence to suggest that the institutions failed to take adequate measures to protect personal data. However, the PCPD recommended that the institutions reassess data breach risks, strengthen monitoring of third-party platforms, minimize the amount of personal data stored on such platforms, and enhance data security measures.

The watchdog also advised organizations handling large volumes of personal data to conduct due diligence on third-party data processors, use on-premises servers, develop incident reporting mechanisms, and enable security features like multi-factor authentication provided by third-party platforms.

Hong Kong has experienced a rise in data security incidents in recent years, with public institutions being frequent targets of hackers. In 2025, the PCPD recorded 246 data breach notifications, a 21% increase compared to the previous year.