Baptist University has said it is reviewing the security of its information technology (IT) systems after a ransomware group claimed online to have illegally accessed the Hong Kong institution’s data.
The allegations were made by “The Gentlemen”, an advanced cybercrime group that first appeared in the middle of last year.
Cybersecurity monitoring platforms reported that about 1,900 credentials linked to the university may have been compromised.
The purported data reportedly included roughly 130 staff accounts, about 1,770 other user accounts and 260 third‑party employee credentials.
Researchers say The Gentlemen operates on a revenue-sharing model – renting its extortion software to other hackers – and has expanded rapidly across global networks.
In a statement released on Tuesday night, the university said it had noted a webpage alleging that its IT systems were unlawfully breached and was closely reviewing the security of its systems and personal data.
It added that it would take appropriate action under established mechanisms and remain in contact with local regulators and law enforcement.
The Office of the Privacy Commissioner for Personal Data said it had not received any official breach notification from the university.
“The office has proactively contacted the institution to understand the incident,” a spokesman said.
Francis Fong Po-kiu, honorary president of the Hong Kong Information Technology Federation, urged the institution to immediately notify the privacy watchdog, launch comprehensive forensic and system checks, and verify whether stolen credentials had been used to infiltrate core systems or cause data leakage.
He recommended the university enforce a campuswide password reset, mandate multi-factor authentication, contact regulators and police, and communicate transparently with staff and students about the investigation’s progress to prevent further social-engineering attacks. -- SOUTH CHINA MORNING POST
