“There isn’t a proof that related knowledge have been launched.”
It provided “honest apologies” over the incident.
Within the fireplace service case, the info included the surnames and phone numbers of round 480 members of the general public who had reported tree collapse incidents when Tremendous Storm Saola struck on September 2 final yr.
Private info of about 5,000 fireplace service workers, together with names, phone numbers, ranks and numbers, and their postings, was additionally liable to leaks.
The division added that 960 incomplete id card numbers of workers had been additionally concerned.
It stated it had notified affected members of the general public by way of messages or telephone calls.
The outsourced contractor, whose title was not disclosed within the assertion, was instantly stripped of entry rights to the system. It was additionally ordered to droop the system operation and all of its contract jobs.
The division stated it and the contractor had been “conducting a complete overview of the incident and stepping up the protecting measures to stop related incidents”.
![Data of people who reported fallen trees during Super Typhoon Saola was also at risk. Photo: Sam Tsang](https://cdn.i-scmp.com/sites/default/files/d8/images/canvas/2024/05/06/357274ae-ee53-4ca0-8020-1a4b01e8b959_93b2a37b.jpg)
The division stated it had reported the incident to police, the Safety Bureau, the Workplace of the Authorities Chief Data Officer and the Workplace of the Privateness Commissioner for Private Information, the privateness watchdog.
Michael Gazeley, founding father of Hong Kong cybersecurity agency Community Field, stated the unauthorised change of entry was “fairly a disturbing remark”.
“As a result of in that case, if there was personal knowledge being handed over, then clearly that knowledge ought to have been supervised,” he stated. “If a contractor actually did simply change entry rights, why was it not supervised?”
Regardless of there not being sufficient particulars offered thus far for a agency touch upon the reason for the incident, the cybersecurity knowledgeable stated that with some foresight it ought to have been preventable.
Gazeley stated there have been a number of key components within the latest spate of cybersecurity points involving completely different authorities our bodies and the personal sector prior to now few weeks.
“Some are apparently attributable to human error and lack of efficient supervision; some are attributable to vulnerabilities within the sufferer’s cybersecurity programs; and a few are attributable to third-party units or software program being added to an organisation’s networks with out the wanted safety in place,” he stated.
“We simply can’t enable this to hold on.”
He stated vital modifications needed to be made in how cyberattacks and likewise cybersecurity had been dealt with.
The hearth service case was the newest of a latest string of knowledge safety incidents at main public our bodies