Hong Kong Watchdog Criticizes Sports Club for Lax Cybersecurity Leading to Data Breach

Hong Kong’s privacy watchdog has determined that a prominent sports club violated privacy regulations before a significant data breach involving the personal information of about 72,000 members.

On Tuesday, the Office of the Privacy Commissioner for Personal Data revealed that the South China Athletic Association (SCAA) had not taken adequate steps to safeguard its members’ data prior to the March breach.

“The SCAA’s awareness of the importance of protecting personal data was lacking,” said Privacy Commissioner Ada Chung Lai-ling during a media briefing. “As a long-established sports association with a large amount of personal data, they should have been more vigilant about cybersecurity and data protection.”

Chung expressed disappointment that the SCAA did not implement sufficient security measures to protect members’ information, which resulted in a breach of Data Protection Principle 4(1) of the Personal Data (Privacy) Ordinance.

The SCAA notified the privacy office on March 18, reporting that its servers had been compromised by ransomware and maliciously encrypted.