Cyber Incident Victim: Web-based School Administrative and Management System
Date:
Dec 2019
Location:
Hong Kong
Summary
A cyberattack targeted a Hong Kong school administration system, compromising eight schools and resulting in data leaks at three institutions. The breach exposed sensitive personal information including student addresses, birth dates, contact details, parental names, academic records, staff data, financial reports, and school allocation records. The Education Bureau deployed specialists to investigate, issued security updates, and advised affected parties to report to authorities. Police launched an investigation under computer crime laws, though no arrests were made. One affected school confirmed unauthorized data retrieval and suspended system operations, while concerns persisted about potential misuse of stolen information. System security vulnerabilities prompted broader scrutiny of the platform's protections.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On December 5-6, 2019, Hong Kong’s Education Bureau confirmed a cyberattack targeting WebSAMS (Web-based School Administrative and Management System), a government-developed application used by most public and direct subsidy scheme schools for administrative operations. Eight schools experienced breaches, with three confirming data leaks. The incident came to light following media reports that La Salle Primary School in Kowloon City was compromised on December 5, prompting its principal to notify stakeholders that hackers had illegally retrieved server data. The Education Bureau dispatched specialists to affected schools to inspect IT systems, strengthen security, and provide support, though it did not disclose specific details regarding stolen data or all impacted institutions. Schools were advised to report incidents to police and the Privacy Commissioner for Personal Data.
WebSAMS stored highly sensitive information, including student addresses, birth dates, contact details, parent names, birth certificates, academic results, staff records, financial reports, and school allocation data. La Salle Primary suspended the system’s use and cooperated with law enforcement. Kowloon City Police Station initiated an investigation under Section 161 of the Crimes Ordinance for unauthorized computer access with dishonest intent, though no arrests were made. Affected parents expressed concern over potential misuse of personal data, while an IT professional speculated constant internet connectivity might have exposed vulnerabilities. The Education Bureau released a security update for WebSAMS and urged schools to install it. Education sector lawmaker Ip Kin-yuen called for government scrutiny of system loopholes and full disclosure to victims, warning the breach’s severity might be underestimated if hackers targeted additional schools.