Hong Kong exams authority reports breach of data on nearly 17,000 mainland applicants

On 31 October 2026, the Hong Kong Examinations and Assessment Authority (HKEAA) — the statutory body that administers public and international examinations in Hong Kong — disclosed that a cybersecurity breach had exposed the personal data of roughly 16,900 mainland-resident applicants who had registered for two small-scale international tests. The authority said the leaked fields were limited to candidate names, dates of birth, and email addresses.

The HKEAA confirmed the breach on the Friday evening of 30 October 2026, having uncovered the incident around a day earlier. It stressed that the compromised platform was used only for certain small-scale international examinations and ran independently of the systems that handle the Hong Kong Diploma of Secondary Education Examination (HKDSE) and the large majority of other tests, saying there was no indication that the HKDSE or other services had been affected.

Response

The authority reported the matter to the police and formally notified the Office of the Privacy Commissioner for Personal Data, pledging full cooperation with the investigation; the privacy commissioner said it had opened its own inquiry in line with established procedures. The HKEAA issued an apology, alerted the overseas examination boards involved, and began arranging direct notifications to affected candidates, while setting up a dedicated telephone hotline and an email inquiry channel to assist the public.

Cause under investigation

At the time of disclosure, the HKEAA had not identified the cause of the breach, saying its technical teams were working to establish the root cause and that a full security sweep and review of its IT infrastructure were under way, with monitoring protocols being reinforced. With the origin unresolved and the investigation ongoing, the incident's status is ongoing.