Hong Kong Institute of Construction and Hong Kong Academy for Performing Arts: More than 153,000 students, staff affected in Canvas data breach: privacy watchdog

Hong Kong Data Breach Exposes Over 153,000 Students and Staff Across Four Universities

A data breach affecting Hong Kong’s online learning management platform, Canvas, has compromised the personal information of over 153,000 students and staff from four tertiary institutions. The incident, investigated by the city’s privacy watchdog, the Office of the Privacy Commissioner for Personal Data (PCPD), was traced to vulnerabilities in a third-party platform rather than the institutions’ internal systems.

The breach, disclosed four months after its discovery, impacted 96% of affected individuals from City University (CityU), totaling 146,969 accounts of which around 34,000 were active. The remaining accounts were inactive or archived. CityU confirmed that the exposed data was limited to basic identifiers, including names, student IDs, and email addresses, with no sensitive personal information compromised.

Other affected institutions included the Hong Kong Academy for Performing Arts (4,584 individuals) and the Hong Kong Institute of Construction (2,333 individuals). The Hong Kong University of Science and Technology’s figures were still under verification at the time of the report.

Leaked data primarily consisted of names, email addresses, usernames, student IDs, course enrollment details, login credentials, and user messages. The PCPD’s findings underscore the risks associated with third-party platform vulnerabilities in educational institutions.

Source: https://www.scmp.com/news/hong-kong/education/article/3364668/more-153000-students-staff-affected-canvas-data-breach-privacy-watchdog

City University of Hong Kong Press cybersecurity rating report: https://www.rankiteo.com/company/city-university-of-hong-kong-press

Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) 香港個人資料私隱專員公署 cybersecurity rating report: https://www.rankiteo.com/company/privacy-commissioner-for-personal-data-hong-kong

"id": "CITPRI1787433349",
"linkid": "city-university-of-hong-kong-press, privacy-commissioner-for-personal-data-hong-kong",
"type": "Breach",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '146,969 accounts (34,000 '
                                              'active)',
                        'industry': 'Education',
                        'location': 'Hong Kong',
                        'name': 'City University (CityU)',
                        'type': 'University'},
                       {'customers_affected': '4,584 individuals',
                        'industry': 'Education',
                        'location': 'Hong Kong',
                        'name': 'Hong Kong Academy for Performing Arts',
                        'type': 'Academy'},
                       {'customers_affected': '2,333 individuals',
                        'industry': 'Education',
                        'location': 'Hong Kong',
                        'name': 'Hong Kong Institute of Construction',
                        'type': 'Institute'},
                       {'customers_affected': 'Under verification',
                        'industry': 'Education',
                        'location': 'Hong Kong',
                        'name': 'Hong Kong University of Science and '
                                'Technology',
                        'type': 'University'}],
 'attack_vector': 'Third-party platform vulnerability',
 'data_breach': {'number_of_records_exposed': '153,000+',
                 'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'Basic identifiers (no sensitive '
                                        'personal information)',
                 'type_of_data_compromised': ['Names',
                                              'Email addresses',
                                              'Usernames',
                                              'Student IDs',
                                              'Course enrollment details',
                                              'Login credentials',
                                              'User messages']},
 'description': 'A data breach affecting Hong Kong’s online learning '
                'management platform, Canvas, has compromised the personal '
                'information of over 153,000 students and staff from four '
                'tertiary institutions. The incident was traced to '
                'vulnerabilities in a third-party platform rather than the '
                'institutions’ internal systems.',
 'impact': {'data_compromised': 'Personal information of over 153,000 students '
                                'and staff',
            'identity_theft_risk': 'Potential risk due to exposed personal '
                                   'identifiers',
            'systems_affected': 'Online learning management platform (Canvas)'},
 'investigation_status': 'Completed',
 'lessons_learned': 'Risks associated with third-party platform '
                    'vulnerabilities in educational institutions',
 'post_incident_analysis': {'root_causes': 'Vulnerabilities in a third-party '
                                           'platform (Canvas)'},
 'references': [{'source': 'Office of the Privacy Commissioner for Personal '
                           'Data (PCPD)'}],
 'regulatory_compliance': {'regulatory_notifications': 'Investigated by the '
                                                       'Office of the Privacy '
                                                       'Commissioner for '
                                                       'Personal Data (PCPD)'},
 'title': 'Hong Kong Data Breach Exposes Over 153,000 Students and Staff '
          'Across Four Universities',
 'type': 'Data Breach'}