WhatsApp accounts of Hong Kong schools and service hacked

Ddata belonging to approximately 900 individuals in Hong Kong was exposed after hackers breached WhatsApp accounts linked to social services and schools.

The attackers targeted five social services and schools, compromising sensitive information including names and mobile phone numbers of users, parents, and pupils. The Privacy Commissioner's office confirmed the breach and mentioned that the affected organizations have already informed the individuals impacted.

The hackers exploited WhatsApp accounts through impersonation, attempting to deceive people listed in the compromised address books for fraudulent activities.

This development coincided with a warning from the Hong Kong Computer Emergency Response Team Coordination Centre about a surge in phishing traps specifically targeting instant messaging platforms like WhatsApp. The affected individuals include service users, school staff, parents, and students.

The modus operandi involved:

1. the hackers impersonating friends or relatives or setting up fake WhatsApp websites to obtain telephone numbers and app registration codes. Once access was gained, the fraudsters attempted to extort money or access personal information by communicating with the victim’s contacts.
2. creating counterfeit login web pages featuring QR codes to infiltrate victims’ accounts. These deceptive pages were promoted using paid advertisements to ensure they ranked high on search engine pages. Scanning the QR code provided access to the victim’s account, including sensitive data like photos, videos, documents, chat records, and contact book details.
3. After hacking one account the hackers mpersonated the victim and utilize the account to send messages, including requests for fund transfers.

To mitigate risks, individuals were advised to regularly check their accounts for unknown devices linked to them and inspect archive folders for any suspicious records. If concerned about possible personal data leaks, individuals were encouraged to file a complaint with the Privacy Commissioner's office.