Investigation by Hong Kong Privacy Commissioner for Personal Data finds 96 per cent of those affected in May cyberattack were from City University
2-MIN READ2-MIN ListenWilliam YiuPublished: 3:35pm, 20 Aug 2026Updated: 3:49pm, 20 Aug 2026More than 153,000 students and staff from four tertiary institutions in Hong Kong have been affected by a data breach on the online learning management platform Canvas, an investigation by the city’s privacy watchdog has found.
Nearly four months after the data breach was discovered, the Office of the Privacy Commissioner for Personal Data (PCPD) said on Thursday that the incident stemmed from “vulnerabilities relating to a third-party platform”, although it did not affect the internal systems of the four institutions.
Among the at least 153,866 students and staff affected in Hong Kong, an overwhelming 96 per cent were from City University of Hong Kong (CityU), according to the watchdog.
CityU said among its 146,969 affected accounts, around 34,000 were active accounts used by staff and students, while the remainder were inactive archived accounts.
“The data involved is strictly limited to basic identifiers such as names, student IDs and email addresses and does not involve any sensitive personal data,” it said.
The Hong Kong Academy for Performing Arts had 4,584 affected students and staff, while the Hong Kong Institute of Construction had 2,333. The number for the Hong Kong University of Science and Technology was still pending verification.
The leaked personal information mainly included names of students and staff, email addresses, usernames, student IDs, course enrolment information, login IDs and messages sent by users.
