The personal data of nearly 17,000 mainland Chinese-based students who applied to take two international exams through the Hong Kong Examinations and Assessment Authority (HKEAA) has been leaked after its information system was compromised. The authority said the leaked data included the names, dates of birth and email addresses of about 16,900 students. It added that there was no evidence that the Hong Kong Diploma of Secondary Education Examination (HKDSE) or any other examinations had been affected.
“The HKEAA apologises to the affected individuals and will take all feasible measures to minimise the impact of the incident on them,” it said. The authority said the cybersecurity incident, identified on Thursday, involved an information system used for a small number of international examinations. It had reported the incident to police and notified the Office of the Privacy Commissioner for Personal Data.
It stressed that the registration systems for the HKDSE and most international examinations were separate from and independent of the compromised system. The authority said it immediately took protective measures and launched a comprehensive investigation to determine the cause of the incident and the extent of its impact. It had also notified the relevant examination organisation and was arranging to notify those affected.
“The HKEAA will continue to conduct a comprehensive review of the security measures for its information systems, strengthen system protection and monitoring, and take appropriate follow-up measures in light of the investigation findings,” it said. The privacy commissioner said it had launched an investigation into the incident in accordance with established procedures.
