HKBN Rapped Over Personal Data Leak

One of the SAR's leading internet and telecom providers, Hong Kong Broadband Network, has been criticised by the Privacy Commissioner in a report that looked into the hacking of one of the company's old databases last April. The incident resulted in the personal data of 380,000 customers being leaked. The commissioner has now served an enforcement notice on HKBN, telling it to improve.

At the time HKBN stored customer data in three databases. The database in question was inactive and contained information from 2012. It included names, email addresses, correspondence addresses, phone numbers, Hong Kong Identity Card numbers and credit card information.

The investigation found that the old database should have been deleted after a system migration in 2012. But it was kept and remained connected to the internal network due to human oversight. There was then no subsequent updating of security patches or encryption.

The commissioner said HKBN had failed to conduct a comprehensive review following the migration, and this had led to the failure to delete the database. It also said the company had kept the data of past customers for far too long.

The report said HKBN had since adopted the good practice of notifying the Privacy Commissioner and the affected customers, though this was not a requirement under the Personal Data (Privacy) Ordinance.

______________________________