Data Breach on Canvas Platform Affects Over 153,000 Students and Staff in Hong Kong

More than 153,000 students and staff from four tertiary institutions in Hong Kong have been affected by a data breach on the online learning management platform Canvas, an investigation by the city’s privacy watchdog has found.

Nearly four months after the breach was discovered, the Office of the Privacy Commissioner for Personal Data (PCPD) said on Thursday that the incident stemmed from “vulnerabilities relating to a third-party platform”, although it did not affect the internal systems of the four institutions.

At least 153,886 students and staff were affected in Hong Kong, with an overwhelming 96 per cent from City University (CityU), according to the watchdog.

CityU said among its 146,969 affected accounts, around 34,000 were active and used by staff and students. The remainder were inactive, archived accounts.

“The data involved is strictly limited to basic identifiers such as names, student IDs and email addresses and does not involve any sensitive personal data,” it said.

The Hong Kong Academy for Performing Arts had 4,584 affected students and staff, while the Hong Kong Institute of Construction had 2,333. The number for the Hong Kong University of Science and Technology was still pending verification.

The leaked personal information mainly included the names of students and staff, email addresses, usernames, student IDs, course enrolment information, login IDs and messages sent by users.