Hong Kong’s privacy watchdog says a cyberattack affecting the online learning platform Canvas in May has exposed personal data of more than 153,000 students and staff. The Office of the Privacy Commissioner for Personal Data (PCPD) reports that people from four educational institutions in Hong Kong are among those affected.
In its Thursday findings, the PCPD says the incident traces to vulnerabilities connected to a third-party component of Canvas. According to the investigation, the breach does not extend to the institutions’ internal systems. Outlets also note that the watchdog’s conclusions are published nearly four months after the data breach was discovered, reflecting an extended review process.
While both reports focus on the affected population and the scope of the incident, they describe the same core conclusion: the breach originates from third-party vulnerabilities in the platform rather than breaches of institutions’ own systems. The watchdog’s investigation also frames the case as a privacy and data-protection incident linked to global platform infrastructure used for learning.
