Ransomware Breach at Hong Kong Club Affected More Than 9,000 People
Summary
Hong Kong’s privacy watchdog found that a ransomware attack on Yau Yat Chuen Garden City Club affected more than 9,000 people and involved personal data. The club says it has no evidence the data was publicly leaked.
Key points
- The privacy commission said the breach affected more than 9,000 people, including current and former members and supplementary card holders.
- Data involved included names, identity and passport numbers, birth dates, contact details and addresses.
- The customer management system became inoperable after attackers encrypted files on a server.
- The commission cited outdated remote-access software with a known vulnerability, missing authentication for remote access, outdated antivirus and firewall protections, and weak security measures.
- The commission said the club retained some former members’ data longer than necessary and issued an enforcement notice requiring remedial action.
- The club reported upgrading security, disabling the remote-access software and changing data-retention policies. It said it had no evidence that personal data was publicly disclosed.
Article Details
- Victim Organization
- Yau Yat Chuen Garden City Club
- Incident Type
- Ransomware-related data breach involving encryption of server files
- Data Types Exposed
- Full names
- Identity card numbers
- Passport numbers
- Dates of birth
- Email addresses
- Contact numbers
- Addresses
- Affected Records
- More than 9,000 people, including 1,553 active members and supplementary card holders, former members, and former supplementary card holders
- Operational Impact
- The attack encrypted files stored on a server and rendered the club’s customer management system inoperable.
- Ransom Or Extortion
- Not disclosed
- Claim Status
- confirmed
People
Ada ChungPrivacy Commissioner who described the breach’s cause and said the club had contravened privacy law and received an enforcement notice.Alex ChanAssistant privacy commissioner who described security weaknesses linked to the breach, including outdated remote-access software and a vulnerability that enabled compromise of service-provider account credentials.