Privacy watchdog reveals 110,000-person data leak and over 2,000 doxxing cases

Hong Kong’s privacy watchdog announced on Thursday a personal information leakage involving over 110,000 people by the Hong Kong Institute of Bankers, saying an execution notice has been issued to the institute for the accident.

In a press conference today, Ada Chung Lai-ling, the privacy commissioner for personal data, said her office has investigated the institute for the data leak, finding over 13,000 institute members and 100,000 non-members suffered their personal data being illegally hacked.

"We learned from the Institute that their six servers containing personal data were attacked and encrypted, with a hacker threatening to upload files from the servers onto the Internet and blackmailing the Institute to pay a ransom for unlocking the encrypted files," said Chung.

"We have urged the Institute to enhance the security of its data management system to prevent similar incidents from happening again," she added.

Besides, the Office of the Privacy Commissioner for Personal Data has followed 2,128 cases of doxxing until December 31 last year after the legislation enforced in October 2021 to criminalize such behavior.

"Twelve people were arrested for doxxing, with five charged and two sentenced," Chung said, "The Office has also issued over 1,500 concession notices to 26 social media platforms to delete around 17,000 messages posted which were considered to be doxxing."