Hong Kong Cyberport defends move to not reveal hacking attack, says stolen data includes details on staff and ex-workers, credit card records
- Tech hub, which did not divulge information on incident until last week, says data leakage took place on August 18
- IT veteran says the breach is a ‘bit embarrassing’ for the hi-tech hub
Hong Kong’s Cyberport tech hub has revealed that stolen personal data of staff, former workers and job applicants, including some credit card information, has surfaced on the internet.
Cyberport on Tuesday defended its decision not to disclose it had been hacked on August 18 until last week after the data theft came to light on social media.
Hong Kong tech hub Cyberport alerts police following cybersecurity breach
In defending its disclosure decision, the fintech hub in Pok Fu Lam said at the time of the hacking, there was no evidence of any misuse of personal data and it did not want to cause any “unnecessary concern”.
It added: “We were subsequently made aware that some information available on the dark web could potentially be related to the incident and we immediately made a public announcement on [September 6] and contacted persons who may have been affected.”
Police said an investigation by the force’s cybersecurity and technology crime bureau was under way.
The Office of Privacy Commissioner for Personal Data on Tuesday said it had since received one inquiry from an affected individual. The privacy watchdog said it had launched a compliance investigation, but declined to go into further details.
The stolen data was available on the dark web, a hidden corner of the internet, but the tech hub did not mention the scale of the breach.
A ransomware group reportedly blackmailed Cyberport after hacking its computer system and stealing and encrypting the data. It demanded that a ransom of US$300,000 be paid by Tuesday to get back access to the data.
‘No system is invincible’: technology-related crimes in Hong Kong surge 47.3%
According to Cyberport, a sizeable amount of personal data was limited to individuals’ names and contact details, including phone numbers or email addresses.
Human resources-related data included identity card number, date of birth, social media accounts, and academic and bank account details, as well as health information.
Cyberport said it had engaged independent cybersecurity experts to investigate the incident and provide a remedy. The investigation and remediation were continuing.
The business park has 140 employees and is a base for 1,900 start-ups and tech companies.
The data breach was first disclosed earlier this month by cybersecurity information platform FalconFeedsio, which said on social media that ransomware group Trigona had added Cyberport to its victim list.
Hong Kong records sixfold rise in technology-based crimes in a decade
According to Palo Alto-based cyber-risk consultancy Unit 42, Trigona ransomware is relatively new and was first discovered by security researchers in late October 2022, with organisations involved in manufacturing, finance, construction, agriculture, marketing and hi-tech industries affected.
The ransomware group said it had gained access to more than 400GB of Cyberport organisational data, according to the social media post.
The hackers also offered to sell the information for US$300,000. Cyber experts estimated earlier the information of at least 400 people was involved, assuming one person’s personal data took up 1GB.
Cyberport condemned the hacking.
“We are working with our legal counsel and have been fully cooperating with law enforcement. We deeply regret any inconvenience or concern this incident may have caused,” it said.
“We would like to assure the public that we have taken proactive and decisive measures to strengthen the security of our networks.”
IT veteran Joseph Leung Wai-fung said the breach was a “bit embarrassing” for Cyberport as a hi-tech hub.
“But Cyberport is actually the same as other commercial organisations. They just have technopreneurs as their tenants,” he said.
Leung said the incident served as an alarm call for all organisations in Hong Kong that a “ransomware attack could happen any time, anywhere” and there was “no guarantee” they could be avoided.
