# Ransomware Attack on the Servers of The Hong Kong Institute of Bankers

Investigation Report
Published under Section 48(2) of the Personal Data (Privacy) Ordinance (Chapter 486, Laws of Hong Kong)
Ransomware Attack on the Servers of The Hong Kong Institute of Bankers
Executive Summary
Background
* On 11 January 2022, The Hong Kong Institute of Bankers (HKIB) notified the Office of the Privacy Commissioner for Personal Data (the PCPD) of a data breach incident, stating that six servers of HKIB containing personal data (the Servers) had been attacked by ransomware and maliciously encrypted, and that a hacker had threatened to upload the files in the Servers to the internet and demanded HKIB to pay a ransom to unlock the encrypted files (the Incident).
* On receipt of the aforesaid data breach notification, the PCPD immediately commenced a compliance check against HKIB to ascertain the relevant facts relating to the Incident. Upon receiving further information from HKIB, the Privacy Commissioner for Personal Data (the Commissioner) believed that HKIB's acts or practices in the Incident might have contravened the requirements of the Personal Data (Privacy) Ordinance, Chapter 486, Laws of Hong Kong (the Ordinance). In May 2022, the Commissioner commenced an investigation in relation to the Incident against HKIB pursuant to section 38(b) of the Ordinance.
Information Obtained from the Investigation
The Incident and the Associated Security Vulnerability
* HKIB stated that it purchased a firewall (the Firewall) from a service provider (the Service Provider) in June 2018 and installed and activated the Firewall in June and July of the same year respectively to enhance network security.
* In May 2019, the Firewall manufacturer issued a security advisory (the Advisory) on its website stating that it was aware of a vulnerability in its operating systems (the Vulnerability) disclosed by a hacker. The Vulnerability would enable an attacker to bypass security restrictions and directly obtain Secure Sockets Layer Virtual Private Network (SSL VPN) account names and passwords to execute any programme in the target system. According to the Advisory, the Firewall manufacturer urged users to disable SSL VPN immediately until the operating systems were upgraded and all account passwords were reset. Meanwhile, users were recommended to enable multi-factor authentication.
* In August 2019, the Government Computer Emergency Response Team Hong Kong issued a high threat security alert on the Vulnerability, advising organisations to patch any affected systems immediately. If no patch could be deployed immediately, users should disable SSL VPN until the vulnerable systems have been patched. Subsequently, in December 2020, the Hong Kong Computer Emergency Response Team Coordination Centre also reminded the corresponding local network providers and organisations to take appropriate remedial measures against the Vulnerability as soon as possible.
* In January 2021, HKIB implemented work-from-home arrangements in response to the local outbreak of COVID-19 pandemic, and activated the SSL VPN of the Firewall to allow some of its employees to remotely access the systems during the work-from-home period. However, the Vulnerability remained unpatched before the Incident.
* On the morning of 30 December 2021, frontline staff of HKIB discovered that the Servers could not be accessed as usual. After being notified, the Information Technology (IT) Department discovered that the files in the Servers had been maliciously encrypted by ransomware. After preliminary investigation, it was believed that the Servers suffered from cyberattack. It was subsequently found that in addition to the Servers, computers and backup data of HKIB were also encrypted by ransomware.
Affected Personal Data
The Consultant's Investigation Findings
Responses from HKIB to the Incident
* HKIB stated to the PCPD that the Firewall was maintained by the Service Provider and both HKIB and the Service Provider were not aware of the Vulnerability until the Incident occurred. In addition, since the installation of the Firewall in 2018, HKIB had not been informed by the Service Provider of the need to install patches for the Firewall. HKIB also stated that the purchase of the Firewall included technical support services provided by the Firewall manufacturer but no information about the Vulnerability had been received from the Firewall manufacturer prior to the Incident
* HKIB explained that although there were four employees in its IT Department (including one department head, two senior managers and one senior officer) before the Incident, due to heavy workload in daily operation and user support, and that lack of experience of the IT Department in maintaining critical network infrastructure, the relevant maintenance work was therefore outsourced to the Service Provider.
* HKIB also admitted that it had not conducted any vulnerability scans on all internet-facing servers, applications and endpoint devices before the Incident and pointed out that the Service Provider did not advise HKIB to perform vulnerability scans. Nevertheless, HKIB reiterated that it did continuously monitor the service level of the Service Provider. Before renewal of the services agreement each year, the manager of the IT Department would conduct an annual assessment which would be endorsed and approved by the General Manager and the Chief Executive Officer.
Findings and Contravention
HKIB being the Data User
The Commissioner's understanding of the Cause of the Incident
HKIB Contravened DPP4(1)
* DPP4(1) stipulates that all practicable steps shall be taken to ensure that any personal data held by a data user is protected against unauthorised or accidental access, processing, erasure, loss or use.
* Having considered the facts of the Incident and the evidence obtained during the course of investigation, the Commissioner found that there were apparent deficiencies in risk awareness about data security and in the personal data security measures of HKIB, which led to the avoidable intrusion of the Servers and access to personal data stored therein by the hacker through exploitation of the Vulnerability:-
** Inadequacies in Management of Data Security Risk: Although HKIB stated that its IT Department lacked experience in maintaining critical network infrastructure and therefore outsourced the relevant work to the Service Provider, the Commissioner considered the fact that HKIB did not stipulate any risk management mechanism for data security and did not request service providers to act in accordance with such a mechanism before the Incident reflected a lack of effective monitoring on the data security measures of its service providers. If HKIB had exercised prudence and due diligence to clearly stipulate the risk management mechanism for data security in the services agreement and request the service providers to conduct regular security checks and vulnerability scans in compliance with such mechanism, it could have identified the serious potential risk posed by the Vulnerability to its system and could have patched the Vulnerability as early as possible to prevent the Incident from happening.
** Deficiencies in Information System Management: The Commissioner noted that HKIB had the following deficiencies in the security measures of its information system at the time of the Incident:-​ The Commissioner considered that all of the above showed that the personal data security management of HKIB was unsatisfactory, lacked stringent measures to regulate staff behaviour and review system settings timely, so that the security of information system which contained personal data was ineffective in addressing risks and threats.
*** The regular penetration test conducted by HKIB did not cover network infrastructure and defence capabilities against specific cyberattack;
*** The antivirus software installed in its system only had basic protection capabilities and could not effectively defend against ransomware attacks;
*** Data loss prevention system was not installed in the system to detect and prevent sensitive data from being stored in external storage devices, or transmitted to external parties through email systems or the internet;
*** Passwords strength of some accounts in the system was insufficient and the passwords were not changed regularly, which made the relevant accounts vulnerable to attacks or intrusions by hackers; and
*** Other deficiencies in information security.
** Prolonged Implementation of Multi-factor Authentication: Back in May 2019, the Firewall manufacturer noted that attackers could bypass security restrictions and directly obtain SSL VPN account names and passwords to execute any programme in the target system through exploiting the Vulnerability. The Firewall manufacturer therefore urged users to immediately disable SSL VPN until the operating system was updated and all account passwords were reset. It also recommended that multi-factor authentication be enabled. ​However, from the activation of SSL VPN in January 2021 to the time of the Incident, HKIB still had not implemented multi-factor authentication to prevent hackers from using the leaked passwords to attack its system.
* Having considered all the evidence of this investigation, the Commissioner considered that HKIB:-
** failed to effectively manage data security risks, including failing to formulate patch management procedures, which resulted in the failure to patch the Vulnerability in a timely manner, thus allowing the hacker to successfully intrude into the system through the Vulnerability and encrypt the Servers;
** failed to properly manage the information system which contained personal data, including insufficient coverage of penetration tests and lack of effective antivirus software, which resulted in the system being unable to guard against hackers from attacking the Servers through the use of ransomware; and
** failed to implement multi-factor authentication for SSL VPN as recommended by the Firewall manufacturer before the implementation of work-from-home arrangements to prevent hackers from attacking the system using the passwords acquired.
* In this case, the Commissioner found that there were apparent deficiencies in the data security risk management and the personal data security measures of HKIB, which led to the ransomware attack on its Servers which contained personal data. The Commissioner considered that HKIB lacked effective data security risk management mechanism and adopted a lax approach towards service providers in the maintenance of critical network infrastructure. As a result, the security measures of the information system which contained personal data were ineffective in addressing cybersecurity risks and threats. To conclude, the Commissioner considered that HKIB had not taken all ​practicable steps to ensure that the personal data involved was protected from unauthorised or accidental access, processing, erasure, loss or use, thereby contravening DPP4(1) concerning the security of personal data.
* While the Incident reveals room for improvement on HKIB's part, the Commissioner is pleased to note that HKIB made a timely data breach notification, cooperated with the PCPD's investigation, and is committed to learning from the Incident. After the Incident, HKIB has implemented various organisational and technical measures and fixed the Vulnerability to enhance the overall system security for the protection of personal data privacy.
Enforcement Action
Recommendations
Other Comments
* Following the Commissioner's investigation report published in November 2022 in relation to a ransomware attack on a database, this report is the second investigation on data breach caused by the Vulnerability. This shows that if organisations fail to identify and handle security ​vulnerabilities in a timely manner, information systems containing personal data would become easy targets of hacker attacks.
* The Commissioner opines that organisations, large or small, should learn a lesson from HKIB's data breach, keep abreast of the latest update on information system security, and put in place patch management procedures to ensure timely deployment of security patches issued by software suppliers. The Commissioner appeals to organisations to comply with the data security requirements under the Ordinance by taking all the practicable steps to safeguard the personal data held by them, such as conducting regular scans on internet-facing servers to check for vulnerabilities, and paying attention to potential data security risks posed by vulnerabilities on information systems containing personal data so as to take appropriate remedial actions as early as possible.
* Through this report, the Commissioner wishes to point out that a robust data security system is an essential element of good data governance. The Commissioner is mindful that as the steps required of a data user to protect personal data may vary from case to case, data users should consult their own data security experts and legal advisers on whether the relevant requirements under the Ordinance are met. Reference may also be made to the "Guidance Note on Data Security Measures for Information and Communications Technology" published by the PCPD, so as to understand the proposed ICT-related data security measures and good practices in enhancing data security systems.
— End —
* ↑ Under section 38(b) of the Ordinance, where the Commissioner has reasonable grounds to believe that an act or practice relates to personal data, has been done or engaged in, or is being done or engaged in, by a data user may be a contravention of a requirement under the Ordinance, the Commissioner may carry out an investigation in relation to the relevant data user to ascertain whether the act or practice is a contravention of a requirement under the Ordinance.
* ↑ www.fortiguard.com/psirt/FG-IR-18-384
* ↑ The affected operating systems included FortiOS 5.4.6 to 5.4.12, FortiOS 5.6.3 to 5.6.7 and FortiOS 6.0.0 to 6.0.
* ↑ According to the Security Bulletin of the Hong Kong Computer Emergency Response Team Coordination Centre, the identifier of the Vulnerability was CVE-2018-13379. (www.hkcert.org/security-bulletin/fortinet-fortos-multiple-vulnerabilities)
* ↑ SSL VPN allows users to use an Internet browser to connect their virtual private network devices through an encrypted communication channel. (www.infosec.gov.hk/en/best-practices/business/vpnsecurity)
* ↑ www.govcert.gov.hk/en/alerts_detail.php?id=414
* ↑ www.hkcert.org/blog/patch-fortios-ssl-vpn-vulnerability-cve-2018-13379-immediately
* ↑ HKIB stated that only 10 out of 60 employees were authorised to access the systems remotely through SSL VPN of the Firewall at the time of the Incident.
* ↑ HKIB stated that after the Incident, it was found that the staff responsible for data backup had not followed its data backup policy by conducting offline backup for the files in the Servers, resulting in the backup data being encrypted by ransomware and could not be accessed as usual.
* ↑ Under section 2(1) of the Ordinance, a data user, in relation to personal data, means "a person who, either alone or jointly or in common with other persons, controls the collection, holding, processing or use of the data".
* ↑ The details have been omitted to protect sensitive information on the security of the relevant information systems.
* ↑ www.pcpd.org.hk/english/enforcement/commissioners_findings/files/r22_18947_e.pdf
* ↑ www.pcpd.org.hk//english/resources_centre/publications/files/guidance_datasecurity_e.pdf
This work is released under the Creative Commons Attribution 4.0 International license, which allows free use, distribution, and creation of derivatives, so long as the license is unchanged and clearly noted, and the original author is attributed.
Public domainPublic domainfalsefalse