Hong Kong Hospital Authority breach exposes data of 56,243 patients and staff
Patient information was stolen from the Hong Kong Hospital Authority’s Kowloon East Cluster in April 2026 and illegally uploaded to an external platform. An employee of a contractor leaked personal information belonging to 56,243 patients and hospital staff on the dark web, and the regulator found inadequate monitoring of contractor access, access controls, and security audits for United Christian Hospital’s surgical patient records system. The Hospital Authority accepted the investigation findings, while police arrested the employee and continued their investigation.
Key facts
- Affected organization
- Hospital Authority (Hong Kong)
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- Personal information of 56,243 patients and hospital staff
- Cause / method
- Data theft by a contractor’s employee and inadequate system access monitoring, access controls, and security audits
- Location
- Hong Kong SAR China
If your data was exposed
Exposed dataHealth & medical data
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organization’s official website or app.
Timeline
- The Hong Kong Hospital Authority accepted the privacy regulator’s investigation findings on the patient information theft that occurred in April.
- Problems with managing a maintenance contractor employee’s system access were identified, and the employee’s arrest by police was disclosed.
- The number of people affected was disclosed as 56,243 patients and hospital staff, and the regulator found inadequate monitoring of contractor access, access controls, and security audits.
4 related reports
- Hospital Authority accepts Privacy Commissioner’s findings on suspected patient data theft
- Hong Kong Hospital Authority Accepts Privacy Commissioner's Findings Following Health Data Breach Investigation
- Hong Kong hospital authority breached privacy law in data leak, regulator says
- Fresenius Confirms Patient Health Data Breach From August Attack
Other incidents at Hospital Authority (Hong Kong)
Hong Kong Hospital Authority patient data leak sparks reporting controversy
Impact: Patient information
Patient information was leaked at Hong Kong's Hospital Authority. A patient advocate pointed to the Hospital Authority's passive approach to reporting as the cause of the leak, and the specific circumstances of the breach and its scale have not been confirmed.
Read on Hong Kong Free Press HKFP ↗
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.