Bankers' institute draws fire for handling of hacking, leak
Hong Kong's privacy watchdog yesterday slammed the Hong Kong Institute of Bankers for failing to protect the personal information of more than 113,000 people in a data leakage after the institute was held to ransom by hackers who got into six servers.
The Office of the Privacy Commissioner for Personal Data has also followed up on 2,128 cases of doxxing up till the end of last year since legislation criminalizing such behavior came into force in October 2021.
Commissioner Ada Chung Lai-ling said there were "serious deficiencies" within the institute in its handling of the matter and that it had violated the Personal Data Ordinance.
The hack occurred on December 30, 2021, when ransomware was used to block off the six servers containing personal data and the institute's computers and backup data.
The leaked data included names, contact information, titles, and names of employers of some 13,000 members and 100,000 non-members of the institute.
Some people even had their identity card and credit card numbers leaked.
An investigation by the watchdog found the institute failed to update its Secure Sockets Layer Virtual Private Network after purchasing the system in 2018, while the institute didn't enable multifactor authentication to enhance the security of the system.
"If it had enabled multifactor authentication, it will not be so easy for the hacker to get access," Chung said.
"We have urged the institute to enhance the security of its data management system to prevent similar incidents from happening again," she added.
The office has served an enforcement notice, directing the institute to remedy and prevent a recurrence.
The watchdog received a total of 3,848 complaints last year, up 15 percent, with more than half involving doxxing allegations.
"It is because we have carried out a series of promotional and publicity and educational activities in relation to the new anti-doxxing regime," Chung said.
She said 95 percent of the complaints were about private organizations or individuals, while the rest were targeted at public organizations or government departments.
Under the new law, the office is empowered to carry out criminal investigations, institute prosecutions and issue cessation notice to stop doxxing.
Chung said the office handled 2,128 doxxing cases last year, and initiated 114 criminal probes, with 32 cases referred to the police for further follow-up actions.
A total of 12 arrests were made as of December 31, with five people having been charged.
Three of them were convicted as of so far this month, with one sentenced to eight months, while the rest are still winding their way through the legal process.
A total of 1,500 cessation notices to 26 online platforms were issued, requesting the removal of 17,703 doxxing messages, with a compliance rate of over 90 percent.
Commissioner Ada Chung Lai-ling said there were "serious deficiencies" within the institute in its handling of the matter and that it had violated the Personal Data Ordinance.
The hack occurred on December 30, 2021, when ransomware was used to block off the six servers containing personal data and the institute's computers and backup data.
The leaked data included names, contact information, titles, and names of employers of some 13,000 members and 100,000 non-members of the institute.
Some people even had their identity card and credit card numbers leaked.
An investigation by the watchdog found the institute failed to update its Secure Sockets Layer Virtual Private Network after purchasing the system in 2018, while the institute didn't enable multifactor authentication to enhance the security of the system.
"If it had enabled multifactor authentication, it will not be so easy for the hacker to get access," Chung said.
"We have urged the institute to enhance the security of its data management system to prevent similar incidents from happening again," she added.
The office has served an enforcement notice, directing the institute to remedy and prevent a recurrence.
The watchdog received a total of 3,848 complaints last year, up 15 percent, with more than half involving doxxing allegations.
"It is because we have carried out a series of promotional and publicity and educational activities in relation to the new anti-doxxing regime," Chung said.
She said 95 percent of the complaints were about private organizations or individuals, while the rest were targeted at public organizations or government departments.
Under the new law, the office is empowered to carry out criminal investigations, institute prosecutions and issue cessation notice to stop doxxing.
Chung said the office handled 2,128 doxxing cases last year, and initiated 114 criminal probes, with 32 cases referred to the police for further follow-up actions.
A total of 12 arrests were made as of December 31, with five people having been charged.
Three of them were convicted as of so far this month, with one sentenced to eight months, while the rest are still winding their way through the legal process.
A total of 1,500 cessation notices to 26 online platforms were issued, requesting the removal of 17,703 doxxing messages, with a compliance rate of over 90 percent.
AI Disclaimer: An advanced artificial intelligence (AI) system generated the content of this page on its own. This innovative technology conducts extensive research from a variety of reliable sources, performs rigorous fact-checking and verification, cleans up and balances biased or manipulated content, and presents a minimal factual summary that is just enough yet essential for you to function as an informed and educated citizen. Please keep in mind, however, that this system is an evolving technology, and as a result, the article may contain accidental inaccuracies or errors. We urge you to help us improve our site by reporting any inaccuracies you find using the "Contact Us" link at the bottom of this page. Your helpful feedback helps us improve our system and deliver more precise content. When you find an article of interest here, please look for the full and extensive coverage of this topic in traditional news sources, as they are written by professional journalists that we try to support, not replace. We appreciate your understanding and assistance.
