Nearly 900 affected as five welfare organizations and schools report hijacked WhatsApp accounts

Hong Kong’s privacy watchdog has received data breach notifications from five social welfare organizations and schools over the past month, reporting that their accounts on WhatsApp used for communicating with service users, students and parents were hijacked. 

The Office of the Privacy Commissioner for Personal Data (PCPD) said fraudsters impersonated the organizations and used the hijacked WhatsApp accounts to send messages to the contacts in the address books, attempting to swindle them. 

The incidents involved the personal data of nearly 900 people and the affected data included names and mobile phone numbers of service users, students and parents, and staff members. 

The watchdog said the organizations concerned have notified the affected individuals on its advice. 

The PCPD explained that “WhatsApp account hijacking” generally refers to fraudsters impersonating victims’ friends and relatives and sending messages to them requesting them to forward the registration codes of their WhatsApp accounts. 

It can also refer to using fake WhatsApp websites to obtain the victims’ telephone numbers and the registration codes of their WhatsApp accounts. 

The PCPD reminded the public to enable two-factor authentication function on WhatsApp, to regularly check linked devices in WhatsApp settings and log out any devices that are no longer in use. 

Users should never disclose any passwords or registration codes to others, and be careful with the links and do not click on fake WhatsApp web versions by mistake. 

Users also shouldn’t download and use the WhatsApp application from unofficial sources, and should authenticate the identity of the senders first when receiving messages about borrowing or remittance requests or asking for personal data. 

Users are also reminded to be alert when receiving unsolicited or suspicious text messages and not to click the links or disclose personal data arbitrarily.