Hong Kong privacy watchdog probes data breach at South China Athletic Association

Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) has launched an investigation into a significant data breach at the South China Athletic Association (SCAA), implicating the personal information of approximately 70,000 members. The breach, including sensitive details such as names, identity card and passport numbers, addresses, and contact information, has prompted the PCPD to urge affected individuals to remain vigilant and report suspicious activity.

The SCAA, a prominent sports club established in 1908, disclosed the breach on Monday, attributing it to an "unauthorized third-party intrusion" into its computer servers on Sunday. In response, the club promptly shut down the compromised systems and enlisted professional internet security teams to conduct a thorough examination and repairs.

While the association has reported the incident to the police, no evidence suggests that members’ data has been disseminated publicly. However, affected individuals are advised to monitor their emails for unusual logins and review their bank statements for unauthorized transactions.

The breach underscores the escalating threat of cyberattacks organizations face in Hong Kong, as highlighted by a surge in reported data breach incidents over the past year. According to the PCPD, there were 157 data breach notifications in 2023, a nearly 50% increase from the previous year. Notably, hacking-related breaches doubled, comprising approximately 41% of all recorded cases.

Francis Fong Po-kiu, honorary president of the Hong Kong Information Technology Federation, emphasized the importance of bolstering internet security measures within companies to mitigate the risk of such breaches. He cited common vulnerabilities such as virus-infected emails and inadequate network security protocols, urging companies to conduct regular assessments and software updates to safeguard against cyber threats.