appConfigEntityId

bodyType

customContents

entityId

entityUuid

isVideo

articlePageQuery

article

articleSchemaContent

content

hooksArticlePageAdvertisementConfigArticle

hooksArticlePageFloatingButtonConfigArticle

appConfig

filter

json

liveArticle

William Yiu

More than 153,000 students and staff from four tertiary institutions in Hong Kong have been affected by a data breach on the online learning management platform Canvas, an investigation by the city’s privacy watchdog has found.
Nearly four months after the breach was discovered, the Office of the Privacy Commissioner for Personal Data (PCPD) said on Thursday that the incident stemmed from “vulnerabilities relating to a third-party platform”, although it did not affect the internal systems of the four institutions.
At least 153,886 students and staff were affected in Hong Kong, with an overwhelming 96 per cent from City University (CityU), according to the watchdog.
CityU said among its 146,969 affected accounts, around 34,000 were active and used by staff and students. The remainder were inactive, archived accounts.
“The data involved is strictly limited to basic identifiers such as names, student IDs and email addresses and does not involve any sensitive personal data,” it said.
The Hong Kong Academy for Performing Arts had 4,584 affected students and staff, while the Hong Kong Institute of Construction had 2,333. The number for the Hong Kong University of Science and Technology was still pending verification.
The leaked personal information mainly included the names of students and staff, email addresses, usernames, student IDs, course enrolment information, login IDs and messages sent by users.
“There is no evidence to suggest that the four educational institutions had failed to take all practicable steps to safeguard the personal data in their possession while using Canvas, and therefore there was no contravention of the Personal Data (Privacy) Ordinance,” Privacy Commissioner for Personal Data Ada Chung Lai-ling said.
The office noted that the affected institutions had conducted pre-assessments before deploying Canvas, adopted contractual measures and established monitoring mechanisms to safeguard the personal data transferred to the platform.
Canvas is a web-based learning management platform operated by US-based educational technology firm Instructure. It helps institutions, educators and students access and manage online course materials, and supports skills development and learning exchange.

Instructure said in May that hackers had stolen personal data from an estimated 9,000 institutions worldwide, including seven in Hong Kong, affecting 72,571 people in the city.
On May 11, the company announced that it had reached an agreement with the attacker to return all the stolen data.
The privacy watchdog recommended that the educational institutions involved in the incident reassess the risks of data breaches and strengthen their monitoring of security measures implemented by third-party platforms.
They should also review and minimise the amount of personal data stored on such platforms, enable multi-factor authentication for accounts and define clear access rights and data-retention periods to ensure data security, the watchdog said.
It also called on potentially affected people to remain vigilant about the possible theft of their personal data, and consider changing the passwords of online accounts and enabling multi-factor authentication.


CityU’s response to disco night ‘misconduct’ an overreaction

Hong Kong to offer ‘attractive’ merger deals for schools beyond those struggling

First building in Hong Kong’s university town project to be ready in months

The classic Chinese parenting playbook won’t survive the AI age

Education in Hong Kong

More than 153,000 students, staff affected in Canvas data breach: privacy watchdog

The Office of the Privacy Commissioner for Personal Data has found that more than 153,000 students and staff from several Hong Kong universities were affected in the cyberattack in May. Photo: Sun Yeung

Among the nearly 154,000 students and staff affected in the data breach, an overwhelming 96 per cent were from CityU, the watchdog has found. Photo: Felix Wong

Evergrande liquidators challenge watchdog’s HK$1 billion settlement with auditor PwC

The Securities and Futures Commission has defended its settlement with PwC Hong Kong. Photo: Yik Yeung-man

The High Court’s Mr Justice Russell Coleman has reserved his judgment. Photo: Nora Tam

Extreme caution urged for Hongkongers as data privacy complaints jump 62% in AI era

Data privacy complaints jumped more than 60 per cent year on year in the first half of 2026. Photo: Getty Images

Ada Chung attributes the spike to the AI era, in which data could be collected, processed and used rapidly and at scale. Photo: May Tse

Man arrested over doxxing 2 former associates in failed restaurant business

The Office of the Privacy Commissioner for Personal Data in Wan Chai. Photo: Sun Yeung

News

Hong Kong

Education

Investigation by Hong Kong Privacy Commissioner for Personal Data finds 96 per cent of those affected in May cyberattack were from City University


Investigation by Hong Kong Privacy Commissioner for Personal Data finds 96 per cent of those affected in May cyberattack were from City University.


More than 153,000 students, staff affected in Canvas data breach: privacy watchdog

.css-1c6uqr6{color:inherit;font-weight:inherit;font-size:inherit;font-family:inherit;line-height:inherit;overflow-wrap:break-word;}Investigation by Hong Kong Privacy Commissioner for Personal Data finds 96 per cent of those affected in May cyberattack were from City University

Investigation by Hong Kong Privacy Commissioner for Personal Data finds 96 per cent of those affected in May cyberattack were from City University