Hong Kong Correctional Services Department: Hong Kong prison department’s IT system hacked, 6,800 employees’ data compromised

Hong Kong Prison System Hack Exposes Personal Data of 6,800 Employees

A cyberattack on a Hong Kong Correctional Services Department (CSD) IT system has compromised the personal data of 6,800 current and former prison staff. The breach occurred on Tuesday when a hacker gained unauthorized access to the department’s internal Knowledge Management System, subsequently infiltrating another system containing employee records.

The exposed data includes names, gender, dates of birth, academic qualifications, employment history, and email addresses. While the CSD stated there is no evidence the information has been leaked or publicly disclosed, it has notified all affected individuals and urged them to report any suspicious activity to authorities.

The incident was reported to Hong Kong police, the Security Bureau, the city’s privacy watchdog, and the Digital Policy Office for further investigation. The CSD is conducting a preliminary review to assess the scope and impact of the breach.

Source: https://www.scmp.com/news/hong-kong/law-and-crime/article/3348230/hong-kong-prison-departments-it-system-hacked-6800-employees-data-compromised

Hong Kong Police Force cybersecurity rating report: https://www.rankiteo.com/company/hong-kong-police-force

"id": "HON1774672125",
"linkid": "hong-kong-police-force",
"type": "Breach",
"date": "3/2026",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'customers_affected': '6,800 current and former '
                                              'employees',
                        'industry': 'Public Safety',
                        'location': 'Hong Kong',
                        'name': 'Hong Kong Correctional Services Department '
                                '(CSD)',
                        'type': 'Government Agency'}],
 'attack_vector': 'Unauthorized Access',
 'customer_advisories': 'Notified all affected individuals and urged them to '
                        'report suspicious activity',
 'data_breach': {'data_exfiltration': 'No evidence of public disclosure',
                 'number_of_records_exposed': '6,800',
                 'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Names',
                                              'Gender',
                                              'Dates of birth',
                                              'Academic qualifications',
                                              'Employment history',
                                              'Email addresses']},
 'date_detected': '2023-10-24',
 'description': 'A cyberattack on a Hong Kong Correctional Services Department '
                '(CSD) IT system has compromised the personal data of 6,800 '
                'current and former prison staff. The breach occurred when a '
                'hacker gained unauthorized access to the department’s '
                'internal Knowledge Management System, subsequently '
                'infiltrating another system containing employee records.',
 'impact': {'data_compromised': 'Personal data of 6,800 employees',
            'identity_theft_risk': 'High',
            'systems_affected': ['Knowledge Management System',
                                 'Employee records system']},
 'investigation_status': 'Ongoing',
 'references': [{'source': 'Cyber Incident Description'}],
 'regulatory_compliance': {'regulatory_notifications': ['Hong Kong police',
                                                        'Security Bureau',
                                                        'Privacy watchdog',
                                                        'Digital Policy '
                                                        'Office']},
 'response': {'communication_strategy': 'Notified all affected individuals and '
                                        'urged them to report suspicious '
                                        'activity',
              'law_enforcement_notified': 'Yes'},
 'title': 'Hong Kong Prison System Hack Exposes Personal Data of 6,800 '
          'Employees',
 'type': 'Data Breach'}