Hong Kong’s privacy watchdog has condemned the owner of an education platform for paying a ransom to hackers who stole individuals’ personal data from 9,000 institutions worldwide, arguing that the money should have been spent on strengthening cybersecurity.
Privacy Commissioner for Personal Data Ada Chung Lai-ling on Friday also questioned whether the hackers had truly returned the data stolen from Canvas and urged affected users to stay alert for suspicious calls or messages claiming to be from the platform.
Instructure, the parent company of Canvas, said earlier this week that hackers had stolen personal data from an estimated 9,000 institutions around the world – including seven organisations in Hong Kong involving 72,571 people – before reaching an agreement with the hackers to return the compromised data.
“We condemned its way of handling as it is a hacking incident, which is illegal. Resources should not be given to these hackers, but should be invested in protecting the platform or improving its security. Does paying the ransom actually guarantee the recovery of all data?” Chung told the media.
In a statement posted on its website on Wednesday, Instructure said the hackers had returned all compromised personal data after both sides “reached an agreement”.
The company said it had received digital confirmation of data destruction and was informed that none of its customers would be extorted as a result of the incident.
Chung pointed out that this was the second time the platform had been hacked.
The local organisations affected were the Hong Kong University of Science and Technology, Polytechnic University, City University, the Hong Kong Academy for Performing Arts, the Hong Kong Art School, the Hong Kong Institute of Construction and the government’s subsidiary, Hong Kong Education City.
The privacy commissioner urged affected users to remain vigilant against suspicious calls, messages or emails claiming to be from the platform or its technicians, and to avoid viewing attachments and clicking on links indiscriminately.
“Do not further offer your information [to the platform] and I would suggest changing your login and password, and activating multi-factor authentication,” Chung said.
She said the leaked information consisted of users’ names, email addresses, login IDs and study disciplines, but noted that there was no evidence of actual losses from the leak.
She also urged institutions to comprehensively review the platform’s information system security, delete old information and continually track daily logs to detect any unusual logins. -- SOUTH CHINA MORNING POST
