5,000 people linked to HKMU may have had personal data leaked in cyber breach

About 5,000 people linked to a university in Hong Kong may have had their personal data compromised in a cybersecurity incident, with information allegedly being offered for sale on the dark web.

Data advertised by dark web sellers reportedly included the names of Hong Kong Metropolitan University (HKMU) students, Hong Kong identity card numbers, telephone numbers, addresses and grade point averages (GPAs).

In response to South China Morning Post inquiries, the university confirmed on Sunday that it had discovered an information security incident on November 4 and notified all staff and students by email the following day.

The university said a preliminary investigation indicated that about 5,000 individuals could be affected. It said the personal data of some of those individuals might have been compromised.

The data involved included names, dates of birth, telephone numbers, residential addresses and email addresses, as well as records of tuition fee payments, including payment dates and amounts.

But it added that the data breach did not involve bank account numbers.

HKMU said it immediately activated its emergency response mechanism, including disabling functions of the affected system to prevent further attacks and conducting a thorough investigation and maintenance work.

The university, whose main campus is located in Ho Man Tin, said it had also engaged an independent third-party cybersecurity consultant to assess the impact and risks and to review system security.

“HKMU strongly condemns any attempt to gain unauthorised access to the university’s system and any claim of selling data obtained without authorisation,” a spokesman said.

The institution, which had more than 13,000 full-time undergraduate degree students in the 2025-26 academic year, said it had reported the case to police and notified the Office of the Privacy Commissioner for Personal Data.

HKMU said potentially affected individuals had been contacted directly and provided with security advice, while staff and students were urged to reset their university account passwords and remain vigilant against phishing attempts and suspicious communications.

It said it had recently contacted potentially affected individuals again by email, providing further details of the incident and additional security advice. HKMU also urged users not to click on unknown links or provide personal data to unverified sources.

It said it would continue to follow up on the incident and provide further updates as appropriate.

The university apologised for the inconvenience and concern caused, adding that it was conducting a comprehensive review of its cybersecurity framework and security measures to strengthen protection of personal data and information systems.

The privacy watchdog said it received a data breach notification from HKMU on November 9, five days after the university discovered the unauthorised access to its systems.

The watchdog said the number of affected individuals and the personal data involved were still being verified, and that an investigation had been launched in accordance with established procedures.