BMW reveals personal data of 14,000 HK customers leaked

BMW Concessionaires Hong Kong has confirmed that the personal data of 14,000 customers have been leaked following a cybersecurity attack.   

According to its official statement, BMW said the cybersecurity incident involved information that was handled by a third-party agency containing customer data such as salutations, names, mobile numbers and SMS opt-out preferences.   

The company said it had immediately reported the incident to the Hong Kong Police Force and the Office of the Privacy Commissioner for Personal Data (PCPD). An external cybersecurity expert will be engaged to launch a comprehensive investigation into the incident.   

“We take the privacy of our customers very seriously and have intensified our security measures to further safeguard our system. We urge our customers to remain vigilant about their personal data,” the company said.  

Meanwhile, the PCPD received a data breach notification from BMW regarding the incident on 18 July and has advised BMW to notify the affected consumers as soon as possible.  

The PCPD further received a data breach notification from Sanuker, the contractor of BMW, regarding the incident on 24 July. The PCPD has commenced an investigation into the incident in accordance with established procedures. 

The PCPD has not received any enquiries or complaints regarding the incident. 

Don't miss: HK privacy watchdog mulls penalty mechanism for institutions’ data breaches

The PCPD has recorded 97 data breach incidents in the first half of the year. The ratio between the public and private sectors experiencing these breaches is 3:7, while the number of incidents increased by 70% in the second quarter. 

Speaking on i-CABLE’s programme Let's Talk (有理有得傾), Ada Chung, the privacy commissioner for personal data, said there is a lack of security awareness among institutions when it comes to protecting personal data.  

The PCPD is studying amendments to the legislation that will allow it to directly penalise non-compliant institutions, thereby increasing the deterrent effect. 

Related articles:

BMW signs media agency in ID, renews contracts in SG and China
SmarTone debunks claims of data leak on users' personal information
HKTVmall reports data leak with 4.38 million customer data accessed