{
  "id": 2075417,
  "title": "150k people affected by Canvas data breach",
  "url": "https://urgent.news/2026/08/20/150k-people-affected-by-canvas-data-breach-2075417",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-20T04:44:05.000Z",
  "source": {
    "name": "RTHK English",
    "slug": "rthk-english",
    "url": "https://news.rthk.hk/rthk/en/component/k2/1866848-20260820.htm"
  },
  "original_language": "en",
  "account": "A data breach on the online learning platform Canvas exposed the personal information of over 150,000 students and staff across four educational institutions in Hong Kong, according to an investigation by the Office of the Privacy Commissioner for Personal Data. The breach was discovered on April 29 when a hacking group exploited a cross-site scripting vulnerability through a free-for-teacher account. The cyberattack stole sensitive data such as names, email addresses, usernames, and student IDs from the institutions. Initially, seven institutions reported possible breaches, but investigations revealed that only four – City University, the Hong Kong Academy for Performing Arts, the Hong Kong Institute of Construction, and the Hong Kong University of Science and Technology – were actually affected. City University reported the largest number of exposed records, with 146,969 students and staff affected. The Hong Kong Academy for Performing Arts and the Hong Kong Institute of Construction had 4,584 and 2,333 records exposed, respectively. The data status of the Hong Kong University of Science and Technology remains pending verification. Privacy Commissioner Ada Chung stated that the institutions had performed pre-assessments, adopted contractual safeguards, and established monitoring mechanisms before using Canvas. There is no evidence suggesting that the institutions failed to take all necessary measures to protect the personal data in their possession while using the platform. The commissioner urged organizations to conduct due diligence on data processors, regulate them through contracts, and enable security features like multi-factor authentication.",
  "summary": "More than 150,000 students and staff of four educational institutions were affected by a data breach on the online learning platform Canvas, an investigation by the Office of the Privacy Commissioner for Personal Data has found. The breach, discovered by platform operator Instructure on April 29, involved a hacking group using a \"Free-For-Teacher\" account to exploit a cross-site scripting…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "RTHK News",
        "title": "150k people affected by Canvas data breach",
        "url": "https://urgent.news/2026/08/20/150k-people-affected-by-canvas-data-breach",
        "published": "2026-08-20T04:44:05.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}