Employee of Hospital Authority contractor made an unauthorised entry into system and retrieved data
1-MIN READ1-MIN ListenDanny MokPublished: 4:57pm, 8 Apr 2026Updated: 5:05pm, 8 Apr 2026Hong Kong police have arrested a man working for a contractor commissioned by the Hospital Authority on suspicion of stealing the personal data of more than 50,000 patients, the South China Morning Post has learned.
The arrest came just days after the privacy watchdog and police said they were investigating a large-scale data leak involving more than 56,000 patients served by the authority, which reported the unauthorised retrieval of various information.
The case did not involve blackmail or the sale of data on the dark web.
The authority on Saturday apologised to victims – patients of hospitals in Kowloon East – for the breach that compromised names, identity card numbers, genders, dates of birth, hospital visit dates and details of surgical procedures, among other information.
Its monitoring system detected suspected unauthorised retrieval of patient information and a leak on a third-party platform at around 2am on Friday, though a subsequent review of internal network systems did not indicate a cyberattack.
