Hong Kong’s OT&P Healthcare exposes the medical history of 100,000 patients

Hong Kong group OT&P Healthcare, which has eight clinics in Central, Repulse Bay, and Clear Water Bay, and employs over 200 staff across multiple specialties, exposed the personal data and medical history of 100,000 patients in a cyber attack last Thursday.

On Monday, OT&P Healthcare CEO Robin Green said the cyberattack occurred within the clinic’s IT systems, which stored both patient identity and medical records.

On Thursday afternoon, the group’s internal IT department noticed significant “system instability” and called in third-party experts to assess the situation. They recommended that the system be turned off immediately.

The group stated that it had been informed by experts that there had been a cyberattack and that the system was currently being forensically examined to determine the scope of the attack. Green stated that those responsible could not access the patients’ financial or bank account information.

The police, the Department of Health, and the Office of the Privacy Commissioner for Personal Data were all notified about the incident. On Friday, all patients were notified of the attack via email. It also stated that services would continue as usual and advised patients to report any suspicious emails purporting to be from OT&P.