Canvas data breach affects 153,000 students and staff in Hong Kong

An investigation by the Office of the Privacy Commissioner for Personal Data (PCPD) has revealed that a data breach on the Canvas online learning management platform affected more than 153,000 students and staff at four tertiary institutions in Hong Kong.

The affected institutions include City University (CityU), which accounted for 96 per cent of the impact with 146,969 affected accounts; the Hong Kong Academy for Performing Arts with 4,584 individuals; and the Hong Kong Institute of Construction with 2,333. The number of affected individuals at the Hong Kong University of Science and Technology is still being verified.

The breach originated from vulnerabilities in a third-party platform rather than the internal systems of the universities. The leaked information primarily consisted of basic identifiers, including names, student IDs, email addresses, usernames, course enrolment details, login IDs, and user messages. City University noted that while many accounts were affected, approximately 34,000 were active, with the remainder being inactive or archived accounts. The PCPD stated that the leaked data did not include sensitive personal information and found no evidence that the institutions failed to take reasonable steps to protect data under the Privacy Ordinance.