Canvas Cyberattack: Over 153,000 HK Students and Staff Affected by Data Breach

<>

Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) confirmed on Thursday that a global cyberattack on the learning management platform Canvas compromised the personal information of over 153,000 students and staff across four local institutions. The breach, occurring in May, significantly exceeds initial estimates of 72,000 affected individuals.

The Scope of the Canvas Data Compromise

The investigation, finalized by the PCPD, identifies four specific Hong Kong institutions as the primary victims of the breach: City University of Hong Kong (CityU), the Hong Kong Academy for Performing Arts (HKAPA), the Hong Kong Institute of Construction (HKIC), and the Hong Kong University of Science and Technology (HKUST). The hacker group ShinyHunter, which was behind the breaches, reportedly targeted nearly 9,000 institutions globally.

CityU sustained the most significant impact. According to the privacy watchdog, the leaked data for approximately 147,000 students and staff includes names, email addresses, usernames, student IDs, and course enrollment records. The breach at HKAPA and HKIC impacted 4,500 and 2,300 individuals, respectively, while the total number of affected persons at HKUST remains under verification by the platform’s operator, Instructure.

Other institutions originally suspected of involvement—Hong Kong Art School, Hong Kong Polytechnic University, and Hong Kong Education City Limited—were cleared by the investigation, which found no evidence of their data being compromised in this specific attack.

Infrastructure Security and Third-Party Risks

A critical finding from the PCPD is that the breach was isolated to the Canvas platform itself. “The Affected Institutions confirmed that their internal systems (i.e. systems other than Canvas) have not been affected by the Incident,” the commission stated. There is no evidence suggesting the universities failed in their duty to safeguard data; rather, the vulnerability originated within the third-party infrastructure managed by Instructure.

Regulatory Recommendations for Digital Safeguards

In response to the rising frequency of cyber incidents, the PCPD has issued a series of directives aimed at hardening the data security posture of local organizations. The watchdog recorded 246 data breach notifications in 2025, marking a 21 percent year-on-year increase. To mitigate future risks, the commission recommends that institutions:

• Conduct rigorous due diligence and background checks on all third-party data processors.
• Review and minimize the volume of personal data stored on external cloud platforms.
• Implement mandatory multi-factor authentication (MFA) across all integrated services.
• Develop comprehensive incident reporting mechanisms and clear data retention policies.

The Evolving Landscape of Institutional Cyber Liability

While the PCPD found that the affected institutions had taken necessary steps to protect data, the scale of the breach underscores the limitations of traditional contractual protection when a global platform is compromised.