appConfigEntityId

bodyType

customContents

entityId

entityUuid

isVideo

articlePageQuery

article

articleSchemaContent

content

hooksArticlePageAdvertisementConfigArticle

hooksArticlePageFloatingButtonConfigArticle

appConfig

filter

json

liveArticle

Fiona Sun

A data breach at Yau Yat Chuen Garden City Club has compromised the personal information of more than 9,000 people, Hong Kong’s privacy watchdog has found, urging organisations to review security measures and update software to close loopholes.
The Office of the Privacy Commissioner for Personal Data on Thursday also released a guide for parents and teachers to safeguard children’s online privacy amid increasing risks facing youngsters online.
Revealing the data breach, Privacy Commissioner for Personal Data Ada Chung Lai-ling said the private recreational club notified the office on October 31 last year that a ransomware attack had rendered its club management system inoperable by encrypting the information system’s files stored on a server.
The management system was provided and maintained by an external service provider, which was able to remotely access the server via dedicated software to offer technical support.
The office’s investigation revealed that the software was operating on an outdated version containing a known security vulnerability at the time of the data breach. This enabled the “threat actor” to compromise the account credentials used by the service provider and gain direct entry to the server where personal data was stored.
The server was also left in a logged-in state without the implementation of additional authentication controls, while the club’s antivirus software and firewall were outdated, making them unable to detect and prevent hacking activities.
The breach affected 9,045 people, including active and former members and supplementary cardholders of the club, a private, non-profit social and recreational organisation.
The compromised personal data included full names, Hong Kong identity card numbers, passport numbers, dates of birth, email addresses, contact numbers and addresses.
Chung said the club was found to have several deficiencies that led to the breach, including using outdated remote access software with a security vulnerability, lacking user authentication measures for remote access to the server, and using outdated antivirus software and firewall.
It also lacked organisational measures for information security and retained personal data for a prolonged period of time, she said.
“Membership and customer data is a valuable asset of an organisation and can be said to be a high-risk target of cyberattacks,” she added.
“Organisations should adopt a proactive strategy, regularly review the effectiveness of the security measures of their information systems, and allocate sufficient resources to protect such personal data.”

Chung said the club had contravened the Personal Data (Privacy) Ordinance and had been served an enforcement notice requiring it to take measures to remedy the breach and prevent similar contraventions in the future.
She also recommended organisations take steps to protect their information systems, such as updating software and firewalls in a timely manner, implementing effective user authentication for data access and conducting regular security risk assessments.
Separately, the watchdog also released practical tips for parents and teachers to safeguard children’s online privacy.
“As children’s cognitive abilities and physical and mental health are more vulnerable than adults, their privacy needs to be protected,” Chung said.
The guide suggested parents and teachers join in children’s online activities, including discussing with youngsters the things to be aware of online and using parental controls provided by online platforms to monitor children’s activities.
It called for safeguarding children’s online privacy, including reminding youngsters not to excessively share personal data when using online platforms or interacting with artificial intelligence (AI) tools, while parents and teachers should review and change default privacy settings.
Parents and teachers should become role models by setting good examples, protecting their own personal data and respecting others’ data privacy, the guide said.
It also suggested that children should be reminded of risks such as online scams, cyberbullying, abuse of AI deepfakes and doxxing.


To understand where Hong Kong is going, start with Tung Chee-hwa

How Hong Kong’s old businesses are adapting to new times

Woman arrested over child abuse in Hong Kong after dashcam video shows boy shoved

Mid-Autumn light show in Yuen Long panned online over stench and execution

Hong Kong society

Personal info of 9,045 people compromised in Hong Kong private club data breach

Yau Yat Chuen Garden City Club notified the privacy watchdog on October 31 last year that its club management system was rendered inoperable due to a ransomware attack. Photo: Jelly Tse

The watchdog has also released practical tips for parents and teachers to safeguard children’s online privacy. Photo: Shutterstock

Hong Kong Hospital Authority apologises for data breach involving 56,000 patients

The Hospital Authority building in Mong Kok. Photo: Felix Wong

The leak involved patients’ names, identity card numbers, gender, dates of birth, dates of hospital visits and medical history. Photo: Felix Wong

Hong Kong prison department’s IT system hacked, 6,800 employees’ data compromised

Hong Kong prison authorities have reported the hack to police, the Security Bureau, the city’s privacy watchdog and the Digital Policy Office. Photo: Sun Yeung

News

Hong Kong

Society

Yau Yat Chuen Garden City Club’s management system rendered inoperable due to ransomware attack that encrypted information system files


Yau Yat Chuen Garden City Club’s management system rendered inoperable due to ransomware attack that encrypted information system files.


Personal info of 9,045 people compromised in Hong Kong private club data breach

.css-1c6uqr6{color:inherit;font-weight:inherit;font-size:inherit;font-family:inherit;line-height:inherit;overflow-wrap:break-word;}Yau Yat Chuen Garden City Club’s management system rendered inoperable due to ransomware attack that encrypted information system files

Yau Yat Chuen Garden City Club’s management system rendered inoperable due to ransomware attack that encrypted information system files