HKEAA: Personal Data of 16,900 Mainland Exam Applicants Leaked

"The Hong Kong Examinations and Assessment Authority (HKEAA) has confirmed that the personal data of about 16,900 people living in mainland China was leaked from one of its international examination systems. HKEAA is the…"

The Hong Kong Examinations and Assessment Authority (HKEAA) has confirmed that the personal data of about 16,900 people living in mainland China was leaked from one of its international examination systems. HKEAA is the government statutory body that runs Hong Kong's school-leaving exams and administers a range of international tests in the city. The affected people had applied for two international exams, which the authority has not named. Their names, dates of birth and email addresses were exposed. HKEAA says it found the incident on Thursday 29 October and announced it late on Friday 30 October. It has reported the case to the Hong Kong Police and the Office of the Privacy Commissioner for Personal Data (PCPD). The authority says there is so far no evidence that the Hong Kong Diploma of Secondary Education (DSE) or its other exams were affected.

What Happened

HKEAA's press release, which TVB News reproduced in full, calls the event a "cybersecurity incident" involving "some international examination information systems." The timeline below draws on that statement and on reporting from RTHK, HK01, Sing Tao and TVB:

29 October (Thursday): HKEAA finds the incident. It says it immediately "took appropriate measures" and began a full inspection and in-depth investigation of the affected system to find the cause and the full extent of the leak.
30 October (Friday): HKEAA reports the incident to police and the PCPD and tells the organisers of the affected exams. The public statement went out late in the evening. TVB timestamped its story at 23:35 HKT and HK01 at 23:36 HKT.
31 October: RTHK and Sing Tao's Hong Kong print edition carry the story the next morning.

There is one small discrepancy in the dates. China Labour Bulletin dates the announcement to "Wednesday 30 October", but 30 October 2026 was a Friday. HKEAA's own release and every other outlet give Thursday for discovery and Friday for the announcement.

HKEAA stressed that the affected system serves only "a small number of small-scale international exams." The DSE and "the vast majority" of international exams use separate registration systems. The authority has apologised, opened an enquiry hotline (3628 8787) and an email address ([email protected]), and says it is still working out how to notify the people affected. It has not said whether notification has started.

The incident comes during a run of Hong Kong data breaches. HK01 reports that the local security community has started calling the month "Black October." On the same day as HKEAA's announcement, the PCPD published its findings on a separate breach at United Christian Hospital. In that case a contractor's developer exported data on 56,243 patients and staff without authorisation, and the data appeared on the dark web. Sing Tao reported the two incidents together. Nothing reported so far connects the HKEAA leak to the hospital case or to any other October incident.

What Was Taken

Volume: About 16,900 people, according to HKEAA's statement and RTHK, China Labour Bulletin and TVB's report. Some Chinese-language headlines round this to "1.69 萬" (16,900) or "近1.7萬" / "約1.7萬" (about 17,000). These are rounded versions of the same figure, not different counts.
Who: People living in mainland China who applied for two international exams that HKEAA administers. HKEAA has not named the exams or their organisers.
Data types: Full names, dates of birth and email addresses.
Not reported as exposed: No outlet or HKEAA statement mentions ID numbers, passport details, payment data, exam results or passwords. HKEAA has not said outright that these were safe, though. Its investigation into the "scope of impact" is still running.

Taken one at a time, these data fields are fairly low in sensitivity. Taken together, they let an attacker address a specific person by name, check who they are using their date of birth, and email them directly about an exam they really did apply for.

Why It Matters

Exam-themed phishing is the obvious follow-up. The leaked data shows that each person applied for a specific international exam, which gives attackers a ready-made pretext: fake registration confirmations, "identity verification" requests, reschedule or fee notices, and fake score releases. All of these can quote the person's real name and birth date. Applicants for international exams are often preparing to study or work abroad, so they are used to official-looking emails about payments and documents, and they have strong reasons to act fast.

It crosses borders. The data controller is a Hong Kong statutory body, the people affected live on the mainland, and the exams belong to third-party international organisers. That puts the incident under Hong Kong's Personal Data (Privacy) Ordinance and could also bring in obligations under mainland China's Personal Information Protection Law, which the Hong Kong government's InfoSec guidance on data breaches cites as a key cross-border data rule. The exam organisers may also have contracts and reporting duties of their own.

Smaller systems are easier targets. HKEAA's main reassurance is that the breached platform was a separate, smaller system rather than the DSE system. That is good news for DSE candidates. It also fits a familiar pattern: secondary systems that serve a handful of partner programmes often get less security testing, monitoring and hardening than flagship platforms. The PCPD's United Christian Hospital findings, published the same day, criticised that hospital for failing to run independent risk assessments on a contractor-maintained system and for leaving it out of internal security audits.

The government sector is under pressure. Two Hong Kong public bodies disclosed breaches in one day. Defenders in Hong Kong's education and public sectors should assume they are attractive targets right now.

The Attack Technique

HKEAA has not said how the data was exposed. Its official statement uses the neutral phrase "cybersecurity incident" and says the cause is still under investigation.

Headlines in HK01 and Sing Tao say the system was "attacked" (遭攻擊), which suggests an outside intrusion. That wording comes from the headlines only. HKEAA has not confirmed an external attack, and nobody has described:

the way in (stolen credentials, an exploited web application flaw, a misconfiguration, an insider or a third-party supplier);
whether data was actively taken out or only exposed;
whether the data has appeared for sale or been posted on leak sites;
who did it. No group has claimed the breach in any reporting so far.

For context only: on 22 October, a week before discovery, HKCERT warned Hong Kong organisations about a critical PHP vulnerability it calls "PHP2Shell". It urged them to find and patch exposed PHP systems and noted that AI is shrinking the gap between disclosure and exploitation. Nothing links that advisory to the HKEAA incident. It is mentioned here because it is a live exposure that Hong Kong operators of smaller web-facing registration systems should check now.

What Organizations Should Do

List and rank every web application that holds personal data. Include low-volume, partner-specific and contractor-run systems, not just flagship platforms. Run independent risk assessments on them and include them in your internal security audits.
Patch internet-facing stacks quickly. Act on HKCERT's 22 October PHP2Shell advisory now, and set a short deadline for fixing critical flaws in any public-facing registration or application portal.
Collect less data and isolate what you keep. Keep only the applicant fields each exam or programme actually needs, purge records after the exam cycle, and keep separate systems separate. HKEAA's isolation of the DSE system appears to have limited the damage here.
Monitor for bulk data access. Alert on unusual exports, large query results and access from unexpected accounts or locations on applicant databases. Watch contractor and developer accounts especially closely, since a contractor developer's unauthorised export caused the United Christian Hospital breach.
Prepare for phishing that impersonates you. If you are HKEAA, an exam organiser, or any education body serving mainland or Hong Kong applicants, publish a clear list of the official channels you use, enforce SPF, DKIM and DMARC on your sending domains, and warn applicants that you will never ask for payment or credentials through unsolicited email.
Plan cross-border notification in advance. For data on people outside Hong Kong, know ahead of time which regulators, partner organisations and notification rules apply, so that "following up on arrangements to notify" takes days, not weeks.

For affected individuals: treat any email about your international exam registration with suspicion, especially emails asking for payment, ID documents or login details. Check such requests directly with the exam organiser, and use HKEAA's hotline (3628 8787) or [email protected] if you have questions.