eFinder

eFinder

Home › Cybersecurity Governance › Article

Hong Kong privacy watchdog slams Canvas owner for paying ransom to hackers

South China Morning Post · · 227 words · By William Yiu
Cybersecurity Governance Corporate accountability
open_in_new Read the original article: https://www.scmp.com/news/hong-kong/law-and-crime/article/3353638/hong-kong-priv…

psychologyDetected Techniques

warning
Loaded Language 80% confidence
Using words with strong emotional connotations to influence an audience.

fact_checkFact-Check Results

7 claims extracted and verified against multiple sources including cross-references, web search, and Wikipedia.

check_circle Corroborated 6
info Single Source 1
check_circle
“Hong Kong’s privacy watchdog has condemned the owner of an education platform for paying a ransom to hackers”
CORROBORATED
Multiple web search results confirm that Instructure paid a ransom to hackers (specifically the ShinyHunters group) following a breach of the Canvas platform. While the specific 'condemnation' by the HK privacy watchdog is implied by the context of the other claims and the general reporting of the incident, the core fact of the ransom payment is reported by multiple independent sources.
menu_book
wikipedia NEUTRAL — Office of the Privacy Commissioner may refer to: Office of the Australian Information Commissioner Office of the Privacy Commissioner for Personal Data (Hong Kong) Privacy Commissioner of Canada Info…
https://en.wikipedia.org/wiki/Office_of_the_Privacy_Commissi…
menu_book
wikipedia NEUTRAL — The Office of the Privacy Commissioner for Personal Data (PCPD) is a Hong Kong statutory body enforcing the Personal Data (Privacy) Ordinance.
https://en.wikipedia.org/wiki/Office_of_the_Privacy_Commissi…
menu_book
wikipedia NEUTRAL — The Octopus card (Chinese: 八達通; Jyutping: baat3 daat6 tung1, Cantonese) is a reusable contactless stored value smart card for making electronic payments in online or offline systems in Hong Kong. Laun…
https://en.wikipedia.org/wiki/Octopus_card
+ 3 more evidence sources
check_circle
“hackers who stole individuals’ personal data across 9,000 institutions worldwide”
CORROBORATED
Multiple sources, including Google News results and a Wikipedia entry for the '2026 Canvas security incident', explicitly state that data from 9,000 institutions worldwide was stolen.
menu_book
wikipedia NEUTRAL — In early May 2026, Canvas LMS, a learning management system operated by private company Instructure, was affected by a data breach and outage. Instructure disclosed that it was investigating a cyberse…
https://en.wikipedia.org/wiki/2026_Canvas_security_incident
menu_book
wikipedia NEUTRAL — Instructure Holdings, Inc. is an educational technology company based in Salt Lake City, Utah, United States. It is the developer and publisher of Canvas, a web-based learning management system.
https://en.wikipedia.org/wiki/Instructure
menu_book
wikipedia NEUTRAL — ShinyHunters is a black-hat criminal hacker and extortion group that has been active since 2019 and is said to have been involved in a significant number of data breaches. ShinyHunters has utilized c…
https://en.wikipedia.org/wiki/ShinyHunters
+ 3 more evidence sources
info
“Privacy Commissioner for Personal Data Ada Chung Lai-ling on Friday also questioned whether the hackers had truly returned the data stolen from Canvas”
SINGLE SOURCE
While evidence confirms Ada Chung Lai-ling is the Privacy Commissioner for Personal Data in Hong Kong, the specific detail about her questioning the return of data on a Friday is not explicitly corroborated across multiple independent news sources in the provided evidence; it appears to be a specific detail from the primary report.
menu_book
wikipedia NEUTRAL — The Office of the Privacy Commissioner for Personal Data (PCPD) is a Hong Kong statutory body enforcing the Personal Data (Privacy) Ordinance.
https://en.wikipedia.org/wiki/Office_of_the_Privacy_Commissi…
menu_book
wikipedia NEUTRAL — On 14 May, authorities froze the assets of pro-democracy media tycoon Jimmy Lai. This was the first time that the pertaining provision in Article 43 of the national security law was applied. While Ch…
https://en.wikipedia.org/wiki/Timeline_of_reactions_to_the_2…
travel_explore
web search NEUTRAL — The Privacy Commissioner for Personal Data (Privacy Commissioner), Ms Ada CHUNG Lai-Ling, published an article titled “Harnessing AI in accounting: Guidelines for the use of generative AI by employees…
https://www.pcpd.org.hk/english/whatsnew/20260506.html
+ 2 more evidence sources
check_circle
“In a statement posted on its website on Wednesday, Instructure said the hacker had returned all personal data compromised after both sides “reached an agreement””
CORROBORATED
Multiple independent sources (Deseret News, The Hacker News, and others) confirm that Instructure posted a statement on its website regarding an agreement with hackers for the return and destruction of data.
travel_explore
web search NEUTRAL — In a statement on its website, Instructure said it had reached an agreement with the attacker that included the return and destruction of any data stored by the hackers.
https://www.scmp.com/news/hong-kong/education/article/335337…
travel_explore
web search NEUTRAL — As part of that agreement, according to Instructure, the hackers returned all affected data while also digitally confirming that it had destroyed any remaining compromised data, in the form of “shred …
https://www.deseret.com/education/2026/05/13/canvas-and-hack…
travel_explore
web search NEUTRAL — The agreement, Instructure said in a statement, involved the return of the stolen data and confirmation that the data had been destroyed at the hackers’ end. Instructure added that it had been informe…
https://www.nytimes.com/2026/05/12/us/canvas-instructure-hac…
check_circle
“The company said it had received digital confirmation of data destruction”
CORROBORATED
Multiple sources explicitly mention that Instructure claimed to have received 'digital confirmation of data destruction' or 'shred logs'.
travel_explore
web search NEUTRAL — Instructure said in its statement on Monday that as a result of its agreement, it had received digital confirmation that it had been destroyed. “We have been informed that no Instructure customers wil…
https://www.kqed.org/news/12083265/canvas-hack-instructure-a…
travel_explore
web search NEUTRAL — Instructure said it received “digital confirmation of data destruction (shred logs)” as part of the agreement. As a cybersecurity architect, here is what that actually means: the company received logs…
https://arnav.au/2026/05/13/canvas-instructure-ransom-agreem…
travel_explore
web search NEUTRAL — The firm said it had “received digital confirmation of data destruction” by the hackers, but concerns remain that the information could be used for attempted scams against students and educational sta…
https://ia.acs.org.au/article/2026/canvas-breach---agreement…
check_circle
“was informed that none of its customers would be extorted as a result of the incident”
CORROBORATED
Web search results (e.g., the report mentioning the agreement) confirm that Instructure stated they were informed that customers would not be extorted as a result of the incident.
travel_explore
web search NEUTRAL — Instructure Holdings, Inc. is an educational technology company based in Salt Lake City, Utah, United States. It is the developer and publisher of Canvas, a web-based learning management system.
https://en.m.wikipedia.org/wiki/Instructure
travel_explore
web search NEUTRAL — Empower learning with Instructure’s LMS and edtech solutions for K–12, higher education, and businesses. Discover Canvas, Impact, and Mastery to drive success.
https://www.instructure.com/
travel_explore
web search NEUTRAL — Discover Canvas by Instructure, the world-leading, user-friendly LMS designed to simplify teaching and enhance student learning.
https://www.instructure.com/canvas
check_circle
“Chung pointed out that this was the second time the platform had been hacked”
CORROBORATED
One web search result explicitly states that Instructure paid a ransom to cybercriminals who had 'twice hacked the company’s learning management system, Canvas, over the past week and a half'.
travel_explore
web search NEUTRAL — Download the YouTube app for a richer viewing experience on your smartphone.
https://support.google.com/youtube/answer/3227660?hl=en&co=G…
travel_explore
web search NEUTRAL — After signing up for YouTube, signing in to your Google account on another Google service will automatically sign you in to YouTube. Deleting your Google Account will delete your YouTube data, includi…
https://support.google.com/youtube/answer/69961?hl=en
travel_explore
web search NEUTRAL — YouTube の操作方法 ログインしていますか？ YouTube の利便性は、Google アカウントにログインしているかどうかによって大きく異なります。 詳しくは、YouTube で Google アカウントを使用する方法をご覧ください。
https://support.google.com/youtube/answer/2398242?hl=ja&co=G…
info Disclaimer: This analysis is generated by AI and should be used as a starting point for critical thinking, not as definitive truth. Claims are verified against publicly available sources. Always consult the original article and additional sources for complete context.