appConfigEntityId

bodyType

customContents

entityId

entityUuid

isVideo

articlePageQuery

article

articleSchemaContent

content

hooksArticlePageAdvertisementConfigArticle

hooksArticlePageFloatingButtonConfigArticle

appConfig

filter

json

liveArticle

Danny Mok

Hong Kong police have arrested an employee of a systems maintenance contractor hired by the Hospital Authority on suspicion of stealing the personal data of more than 56,000 patients and 1,000 staff members.
The arrest of a 30-year-old local man came just days after the authority reported on Saturday a suspected data leak involving patients in the Kowloon East group of hospitals on a third‑party platform, with police and the privacy watchdog investigating.
Police revealed on Wednesday that more than 1,000 authority employees were also affected as well as over 56,000 patients.
The information was found to be available for download on an online forum. It was still online on Wednesday night, the South China Morning Post learned.
The authority on Saturday apologised to victims – patients of hospitals in Kowloon East – for the breach that compromised names, identity card numbers, genders, dates of birth, hospital visit dates and details of surgical procedures, among other information.
It said on Wednesday that its preliminary findings showed that the leaked data involved only United Christian Hospital in Kwun Tong, with no other facilities in Kowloon East affected.
Police said that after detecting the source of the leak, officers from the force’s cyber security and technology crime bureau seized more than 60 digital devices – including servers, computers, mobile phones and storage equipment – from two offices in Kwai Chung and the Science Park belonging to the contractor. Digital forensics were conducted on the devices.
Officers then identified the suspect, who had allegedly remotely accessed and illegally downloaded patient and staff data without authorisation before the leak.
He was arrested in Tin Shui Wai on Tuesday on suspicion of accessing a computer with criminal or dishonest intent.
The suspect was employed by a systems maintenance contractor commissioned by the Hospital Authority, police said.
Superintendent Ferris Cheung Hau-yee of the bureau said investigations were under way into the suspect’s motives, whether he had obtained any financial reward and whether more people were involved.
Dr Tony Ha King‑hang, the authority’s director for strategy and planning, said the contractor was responsible for maintaining a system mainly used for operating theatres in Kowloon East.
He said the system contained some patient information, such as details of surgical procedures but was not connected to the widely known Clinical Management System (CMS), which held complete medical records of the 43 public hospitals and more than 120 outpatient clinics under the authority.
Ha said the same contractor also served other hospital groupings under the authority, but all of its authorisation to access data had now been suspended.
Access granted to all other contractors to the authority’s systems has also been halted. Any emergency maintenance must now be carried out under the authority’s approval and supervision.
As for claims that the incident was linked to a system upgrade for United Christian Hospital’s anaesthesiology department carried out by a contractor on April 1, Ha declined to comment further.
The authority last week said its monitoring system had detected suspected unauthorised retrieval of patient information and a leak on a third-party platform at around 2am on Friday, though a subsequent review of internal network systems did not indicate a cyberattack.
It said it had reported the breach to the Office of the Privacy Commissioner for Personal Data and police, pledging full cooperation. Patients were being notified through the HA Go mobile app, letters and phone calls, while a hotline was set up for inquiries. The authority urged vigilance against possible misuse of personal data.
Authority chief executive Dr Libby Lee Ha-yun had said in a letter to staff last week that the incident was “believed to involve someone illegally obtaining patient data”.
She said the leaked files were in a raw format and also included a small number of staff names and ranks. Lee added that the authority had requested the relevant third-party platforms to remove all leaked material.
The privacy watchdog said that it had received a report from the authority on Friday, and would investigate the incident in accordance with its current mechanism.
The office also urged affected patients to remain vigilant against potential misuse of their information and to exercise caution when receiving suspicious phone calls and messages.
Affected patients are advised to change the passwords of their online accounts and check for any unusual login records, as well as to consider reviewing their bank accounts for any unauthorised expenditure.


Hong Kong model Abby Choi’s former relatives admit body disposal, deny murder

Authorities may appeal engineer’s non-custodial sentence in Queen Mary Hospital lift case

Hong Kong police search for woman after man found dead outside building

Activist charged after microchipped dog caught in probe into suspected attack

Crime in Hong Kong

Police arrest man on suspicion of stealing personal data of 56,000 patients, 1,000 staff

The Hospital Authority has apologised to the victims. Photo: Felix Wong

Hong Kong Hospital Authority apologises for data breach involving 56,000 patients

The Hospital Authority building in Mong Kok. Photo: Felix Wong

The leak involved patients’ names, identity card numbers, gender, dates of birth, dates of hospital visits and medical history. Photo: Felix Wong

Hong Kong doctor axed for posting resuscitation photo faces Medical Council case

Jensen So had posted an Instagram story showing himself performing a resuscitation procedure in what appeared to be a public hospital ward. Photo: Handout

The Hospital Authority terminated the doctor’s contract. Photo: Felix Wong

News

Hong Kong

Law and Crime

Employee of Hospital Authority contractor made an unauthorised entry into system and retrieved data


Employee of Hospital Authority contractor made an unauthorised entry into system and retrieved data.


Police arrest man on suspicion of stealing personal data of 56,000 patients, 1,000 staff

.css-1c6uqr6{color:inherit;font-weight:inherit;font-size:inherit;font-family:inherit;line-height:inherit;overflow-wrap:break-word;}Employee of Hospital Authority contractor made an unauthorised entry into system and retrieved data

Employee of Hospital Authority contractor made an unauthorised entry into system and retrieved data