Hack exposes data of 6,800 Hong Kong prison staff

A cyberattack has compromised a Hong Kong government system containing the personal data of thousands of prison employees, authorities confirmed, raising concerns about internal cybersecurity safeguards.

The Correctional Services Department said on Friday evening, March 28, that a hacker had gained unauthorised access to one of its IT systems earlier in the week, on Tuesday.

“After a preliminary investigation, the Correctional Services Department believes the incident involved unauthorised access to the internal Knowledge Management System by a hacker, through which the hacker then gained entry to another IT system maintaining personal data of staff,” the department said in a statement.

According to the agency, the breach affected approximately 6,800 current and former employees. The compromised data includes names, gender, dates of birth, academic qualifications, employment histories within the department, and email addresses.

Despite the scale of the breach, the department emphasized that there is currently no evidence indicating that the data has been leaked or publicly disclosed. It said all potentially affected individuals have been notified and advised to report any suspicious activity to police as soon as possible.

The case has been formally reported to the police, the Security Bureau, the city’s privacy watchdog, and the Digital Policy Office.

Officials said immediate response measures were taken following the discovery of the breach. These included isolating the internal Knowledge Management System, requiring users to change their passwords, conducting a comprehensive review of all IT systems, and instructing the outsourced service provider responsible for the system to launch an investigation.

The department said it would carry out a full review of the incident and strengthen existing security measures to prevent similar breaches in the future.

By Tamilla Hasanova