bodyType

customContents

entityId

entityUuid

articlePageQuery

filter

article

articleBaseAdvertisingInfoArticle

articleListArticle

articleSeoArticle

helpersCheckIsPostiesArticle

hooksArticleAcknowledgementGateOverlayArticle

hooksTrackPageViewArticle

hooksContentInterestArticle

articleLinkingDataContent

articleSchemaContent

liveArticle

advertZone

sentiment

contentLock

topics

types

sections

moreOnThisArticles

urlAlias

commentCount

authorLocations

authors

paywallTypes

corrections

sponsorType

displaySlideShow

multimediaEmbed

printHeadline

seriesContainer

socialHeadline

headline

flag

firstTopic

glossary

flattenTypeIds

publishedDate

additionalInfoBoxes

images

image

relatedLinks

relatedNewsletters

__typename

createdDate

sponsor

factSheets

seriesReverseOrder

series

disableOffPlatformContent

published

updatedDate

summary

subHeadline

body

keywords

copyrighted

customTimezone

liveContents

Fiona Sun

Hong Kong’s privacy watchdog has launched an investigation after the local branch of the charity Oxfam suffered a breach that potentially compromised the personal data of more than 470,000 people, surpassing the scale of a cyberattack on a cultural body last year.
The Office of the Privacy Commissioner for Personal Data said on Wednesday that it received a report of the hack from Oxfam Hong Kong on July 13.
It added that the charity had notified more than 470,000 potentially affected people, but noted the actual number had yet to be determined. Personal data that might have been exposed included names, addresses, email addresses, mobile phone numbers, Hong Kong identity card numbers and payment information.
“The office has launched an investigation into the incident in accordance with established procedures,” the watchdog said.
Last month, Oxfam Hong Kong revealed that it discovered a cyberattack on July 10, which had affected “certain of its systems, including the Oxfam Trailwalker system”.
The Trailwalker is a renowned 100km (62 miles) trail race held annually in the city to help raise funds for the charity.
The organisation said it had immediately launched an investigation and engaged independent cybersecurity experts to look at the affected systems to assess the effect of the attack and offer remedies.

In a reply to Post inquiries on Wednesday, Oxfam Hong Kong said: “We have already strengthened our digital defence to safeguard our information and systems according to the cybersecurity experts’ advice.”
Separately, the watchdog also revealed more details of another incident at ImagineX Management Co. Limited, a brand management and distribution company.
It said it received a report from the company on May 31 and that the incident affected more than 127,000 members and employees, including about 100,000 of the company’s ICARD members and 27,000 Brooks Brothers members.
The personal data compromised might include names, email addresses, phone numbers, passport numbers, dates of birth, gender, nationalities and photos.
The watchdog said the company had notified those affected and an investigation was under way.
Several major public bodies and private organisations have been hit by large-scale cyberattacks in recent years with hackers stealing personal information and demanding large sums of money, raising concerns over how authorities would step up protection of personal information.
Earlier this month, the privacy watchdog revealed that a data breach at Hong Kong Ballet last year compromised the personal information of 37,840 people.
The watchdog also investigated an incident at the Council of the Hong Kong Laureate Forum, which affected the names, email addresses and other information of more than 8,000 people.
IT experts urged authorities to strengthen cybersecurity of government departments and also offer support to smaller, non-governmental and private organisations.
Francis Fong Po-kiu, honorary president of the Hong Kong Information Technology Federation, said various cybersecurity deficiencies could lead to successive data breach incidents, such as a lack of regular updates on server operating systems and security software.
He said breaches could also occur when employees clicked on links in phishing emails and downloaded malware such as Trojan horses and ransomware, which enabled hackers to access victims’ networks and encrypt databases.
He urged organisations to invest more resources in information security to prevent attacks.
Fong, who is also a member of Oxfam Hong Kong’s governing council, said the charity had taken measures after the breach, including recovering the database, strengthening security and conducting security audits.
Lawmaker Duncan Chiu, who represents the technology and innovation sector, noted that organisations in highly developed economies such as Hong Kong and Singapore, where personal data was deemed more valuable by hackers, were facing a growing number of cyberattacks.
He urged authorities to speed up legislation to improve the cybersecurity of the city’s critical infrastructure by regulating operators to ensure adequate security measures and guidelines for data processing were in place.
Chiu also called for the Hong Kong Internet Registration Corporation, Hong Kong Productivity Council and the Digital Policy Office to support smaller organisations which lacked the capacity to withstand cyberattacks on their own.
The Digital Policy Office said it had worked closely with stakeholders to promote cybersecurity information sharing among public and private organisations, and supported the Hong Kong Computer Emergency Response Team. which offered cybersecurity incident response services, preventive guidelines and security education.


How Hong Kong deepfake scam group taught recruits to pass as rich, single women

Amount of drugs found on air passengers in Hong Kong last year up by 244% over 2019

Hong Kong police arrest 31 over deepfakes used to scam victims in Singapore, Malaysia

5 arrested over sale of fake tickets for Hong Kong star Andy Lau’s concerts

Crime in Hong Kong

Probe launched after 470,000 people potentially affected in Oxfam Hong Kong data breach

An investigation has been launched into a potential data breach at Oxfam Hong Kong. Photo: Shutterstock

Oxfam Trailwalker 2023. The charity said earlier this month it discovered a cyberattack that affected “certain of its systems” on July 10. Photo: Dickson Lee

Privacy watchdog finds ‘glaring deficiency’ in Hong Kong Ballet’s cybersecurity

Both organisations failed to take steps to protect their computer systems and contravened security requirements under the Personal Data (Privacy) Ordinance. Photo: Shutterstock

The privacy commissioner for personal data, Ada Chung, warned of escalating risks and urged all organisations to boost their cybersecurity measures. Photo: Yik Yeung-man

Hong Kong government under fire over ‘unacceptable’ data breaches affecting 130,000 people, as lawmaker urges disciplinary action

Hong Kong government headquarters. Authorities have been urged to take a more centralised approach to cybersecurity. Photo: Jelly Tse

The Companies Registry has said the personal information of about 110,000 people was leaked because of a fault in its digital platform. Photo: Companies Registry

Probe launched after 470,000 people potentially affected in Oxfam Hong Kong data breach

Privacy watchdog says Oxfam Hong Kong reported incident on July 13