Computer hackers

First Macau government, now Hong Kong University falls victim to cyberattack

Hackers hit thousands of students and staff e-mail accounts and may have mined sensitive information such as salaries and exam grades

PUBLISHED : Friday, 19 July, 2013, 12:00am
UPDATED : Tuesday, 13 August, 2013, 3:51pm

The University of Hong Kong has become the latest victim of a major cyberattack after hackers targeted thousands of its online accounts belonging to staff and students.

Data such as student grades and staff salaries may have been accessed by hackers, but the full extent of the attack is still being investigated. This comes less than a week after Macau's Chief Executive Dr Fernando Chui Sai-on revealed his government's e-mail accounts had been attacked by hackers in Hong Kong and the United States.

HKU staff detected the attack on Tuesday during a routine security scan of the university's online platforms, noticing "some Trojan hacking software" that mined usernames and passwords. IT staff immediately stepped up cybersecurity efforts to halt the attack on the HKU Portal - the university's gateway to two comprehensive databases covering all its students and staff.

"We took immediate action to remove the hacking software and took measures to prevent further hacking," said an HKU spokeswoman. A total of 3,676 e-mail accounts were compromised. An e-mail alert on Wednesday afternoon was sent to the victims: 1,976 graduates, 1,261 staff, 118 students, 62 retirees. Some 259 administrative accounts were also hacked.

We took immediate action to remove the hacking software and took measures to prevent further hacking

The spokeswoman said the affected accounts were suspended and users were asked to change their passwords before they could re-activate their accounts so as to stop further unauthorised access.

The case has since been reported to the police as well as the Privacy Commissioner for Personal Data. A police spokesman said they were investigating the case as "access to computer with criminal or dishonest intent".

According to the university's website, the HKU Portal was launched in October 2010 and provided a single access point to the online databases of its students and staff. The student database - provided by PeopleSoft, an IT company owned by tech giant Oracle - manages a range of information such as admissions, timetable schedules, enrolments, grades, records and transcripts. The staff database is called the human capital management system and holds information such as salaries and department budgets.

Lingnan University and Polytechnic University said they had not detected any increase in cyberattacks this month, while Chinese University said the number of phishing e-mails and "password cracking activities" had risen recently.

IT sector lawmaker Charles Mok said that while cyberattacks on universities were not unusual, the latest incident would add to the current climate of heightened awareness of hacking.

"There is more concern about hacking because everyone has been alerted to it after the Snowden affair," he said yesterday, referring to the US whistle-blower Edward Snowden.