Cybersecurity in the Education Sector Can No Longer Remain at the Level of “Recommended Measures”
- 秘書處
- 5 days ago
- 13 min read
Chris Chan
CEO, Dracosec Research Limited | Founder, BSides Hong Kong | OffSec Hong Kong Chapter Ambassador
The Hong Kong Baptist University Ransomware Incident
On 10 August, the ransomware group The Gentlemen added Hong Kong Baptist University (HKBU), together with eleven other organizations, to its dark web leak site. According to the threat intelligence platform Ransomware.live, the attack was estimated to have occurred on 9 August.
The same platform recorded 1,908 exposed credentials associated with the domain hkbu.edu.hk. Data published by Hudson Rock indicated that approximately 130 staff accounts, 1,778 user accounts, and 260 third-party credentials were linked to infostealer infections.
It should be noted that these figures originated from third-party monitoring platforms. As of the time of writing, HKBU had not confirmed that any systems had been compromised or that any personal data had been leaked.
The timeline of public communications was as follows. On 12 August, the Office of the Privacy Commissioner for Personal Data stated that it had not received any data breach notification from the university and had proactively contacted HKBU regarding the incident. On 16 August, the university announced that the relevant web content had been removed and that an independent professional organization had been engaged to conduct a comprehensive review of the security of its information technology systems and personal data. The university further stated that any confirmed data leakage would be disclosed as appropriate.
Drawing on his experience in Digital Forensics and Incident Response (DFIR), the author notes that limited information during the first 72 hours following a cyber incident is common. However, he argues that the incident raises a broader question: if a publicly funded university with a dedicated IT team and cybersecurity resources requires more than a week to establish the basic facts of an incident, the preparedness of smaller educational institutions deserves closer examination.
The author also notes that this is not an isolated case.
In May, Instructure, the parent company of the learning management platform Canvas, experienced a breach attributed to the threat actor ShinyHunters. According to publicly available reports, approximately 3.65 TB of data was involved, affecting around 275 million users across approximately 8,800 educational institutions worldwide.
In Hong Kong, seven educational institutions reported being affected, including:
The Hong Kong Polytechnic University
The Hong Kong University of Science and Technology
City University of Hong Kong
The Hong Kong Academy for Performing Arts
Hong Kong Art School
Hong Kong Institute of Construction
Hong Kong Education City
More than 72,000 individuals were reported to have been affected.
HKBU itself also experienced a separate incident in 2025 involving a compromised Moodle student account that resulted in personal data exposure.
According to the author, these incidents illustrate three different attack paths:
Malware infections on personal devices leading to credential theft
Third-party SaaS supply-chain compromise
Account takeover of institution-managed platforms
The author argues that the challenge facing the education sector extends beyond any single vulnerability and involves multiple attack vectors across the broader technology environment.
The Education Sector Has Become a Frequent Target
According to monthly reports published by Check Point Research, educational institutions have consistently ranked among the most frequently targeted sectors globally.
In July 2026, the education sector experienced an average of 4,848 cyberattacks per week, representing a 14% year-on-year increase. This exceeded the government sector (3,044 attacks per week) and the telecommunications sector (2,927 attacks per week) and was more than twice the global cross-industry average of 2,336 attacks per week.
The same report identified The Gentlemen and Qilin as the most active ransomware groups during the month, each accounting for approximately 14% of publicly disclosed ransomware incidents. The former is also the group that listed HKBU as a victim.
The author further references two threat intelligence reports published in late July.
On 23 July, threat intelligence company Group-IB published research concerning a threat actor known as JadeProx. According to the report, investigators obtained operational records after identifying a relay server with directory browsing enabled.
The report stated that the threat actor scanned a dataset containing 14,653 education-related URLs in Hong Kong, identified 13 vulnerabilities, and attempted to exploit four vulnerabilities with a CVSS score of 9.8.
The report did not specify how many exploitation attempts were successful.
The same infrastructure was reportedly used in operations targeting a public hospital in Vietnam and the Ministry of Foreign Affairs in Malaysia.
On the following day, HKCERT issued a high-risk advisory titled “Multiple Vulnerabilities Affecting Internet-Facing Systems in Hong Kong's Education Sector.”
According to HKCERT, threat actors were actively scanning and exploiting internet-facing systems operated by educational institutions in Hong Kong. The vulnerabilities could allow:
Remote code execution
Backdoor installation
Credential theft
Lateral movement within affected environments
HKCERT also noted that the vulnerabilities listed in the advisory dated from 2018 to 2022. According to the advisory, patches were available for all of the vulnerabilities, and some had appeared in the U.S. Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities catalogue for several years.
The author concludes from these observations that the education sector in Hong Kong is currently facing systematic scanning activity, while some of the vulnerabilities being exploited have had available remediation measures for a number of years.
Two Real-World Cases
Case 1: E-learning Consortium School Pentest Project
In 2019, while working as a penetration tester at UDomain, I participated in a project known as the E-learning Consortium School Pentest Project, which involved conducting penetration tests on designated systems used by ten local schools.
The engagement was conducted under significant time constraints. Ten schools, each with its own defined scope, shared a limited testing window. This was not a long-term red team engagement in which systems could be examined in depth over an extended period.
Even under those conditions, the team identified multiple serious vulnerabilities within a shared e-learning platform used by numerous schools. Following responsible disclosure and remediation by the vendor, two vulnerabilities were assigned CVE identifiers.
One involved a lack of access controls on an administrative path. By sending a GET request directly to /admin, a user could bypass the login page (CVE-2019-9884).
The second involved the absence of parameterized queries in a student information lookup function, allowing SQL injection attacks against the database (CVE-2019-9885).
The significance of these findings does not lie in their technical sophistication. They involve weaknesses covered in the introductory chapters of most web application security textbooks. The issue was not that an advanced defense mechanism had been bypassed; rather, there was effectively no meaningful defense mechanism in place.
Because the barriers to exploitation were low, the vulnerabilities could be identified within a limited testing window. An attacker would likely encounter the same conditions.
The broader risk arises from scale:
One vulnerability × hundreds of schools using the same platform = a single compromise with sector-wide consequences.
The Canvas incident referenced earlier illustrates the same principle on a larger scale. The education sector relies heavily on shared platforms, creating concentration risk. In the author's view, concentrated risk is precisely the type of risk that warrants regulatory attention.
The author further notes that the two published CVEs did not represent the full number of vulnerabilities identified during the project.
Only two CVEs were ultimately submitted, largely due to project constraints and the practical limitations associated with responsible disclosure. As a result, the public record reflects only a portion of the vulnerabilities identified during testing.
The author also describes another vulnerability discovered within a commonly used interface adopted by multiple schools. The weakness required manual analysis of business logic and was not the type of issue that would normally be discovered through automated scanning. It presented a potential path to access personal information stored within the system.
However, the vulnerability never entered a formal disclosure process.
The reason was contractual rather than technical. The school commissioned the assessment, not the vendor. The report was delivered to the school, and the school did not forward the findings to the vendor. Due to confidentiality obligations, the testing team was unable to disclose the issue directly.
As a result:
The vendor was never informed of the vulnerability.
According to the author, all parties involved acted within their contractual responsibilities. However, the vulnerability remained unresolved because the testing party, the reporting party, and the remediation party were separate entities operating without a mandatory reporting mechanism linking them together.
Seven years later, the author does not know whether the issue remains unresolved. In his view, that uncertainty is itself part of the problem.
The author further argues that the relatively low number of publicly known education-sector vulnerabilities may not necessarily indicate strong security, but may instead reflect weaknesses in vulnerability reporting and disclosure processes.
He contrasts this with the financial sector, where cyber assessments are incorporated into governance and regulatory processes. In the education sector, a security assessment report may remain internal to an institution without creating any broader sector-wide awareness or remediation obligation.
Case 2: Security Assessment of a Primary School System
In another engagement, the client was a local primary school that relied on three systems to support its website and administrative operations.
The systems contained years of student information, including residential addresses, academic records, parental occupation data, employee salary information, and attendance records.
All testing and remediation work had to be completed during the summer holiday period because systems could not be taken offline after the new academic year began.
The results were straightforward.
Although password protection existed, the assessment team was able to obtain administrative privileges, access sensitive information, modify database content, and ultimately gain control of the underlying server.
The implication was clear: had a ransomware operator reached the system before the assessment team, the school could have lost access to its student records shortly before the start of the academic year.
Following the assessment, the school's IT manager commented that even personnel working in IT roles might not identify such issues during daily operations.
The author argues that this does not necessarily reflect an individual capability issue. Rather, it reflects structural limitations in role design.
In many schools, a single individual may be responsible for managing networks, hardware, learning platforms, parent applications, and day-to-day operational support. Under those conditions, it is unrealistic to expect the same person to perform the role of a dedicated cybersecurity specialist.
Four Recurring Issues
Drawing from these experiences, the author identifies four recurring issues within the education sector.
1. Lack of Asset Visibility
In many cases, asset inventories either do not exist or consist of outdated spreadsheets that have not been updated for years. Servers created for specific projects, cloud environments deployed by academic departments, and storage systems installed by contractors may remain online and externally accessible even though ownership and responsibility have long since become unclear. According to the author, many of the URLs referenced in the Group-IB report likely fall into this category.
2. Third-Party Providers Become the Weakest Link
A significant proportion of educational systems, including administrative platforms, websites and parent applications, are outsourced. However, contracts often lack requirements relating to patch management timelines, incident notification obligations, subcontracting disclosure, and independent security assessments. The author cites the commonly repeated principle that work may be outsourced, but responsibility cannot.
3. Silent Data Exposure Through Misconfiguration
This category includes issues such as publicly accessible directory indexes, misconfigured cloud storage buckets, internal documents indexed by search engines, and forgotten backup files within development environments. Such exposures may contain student records, identification documents, examination results, contact information and special educational needs records. No intrusion may be necessary for the information to become accessible.
4. The Identity Perimeter Has Disappeared
According to the author, incidents such as the HKBU case may involve compromised credentials obtained through infostealer malware rather than direct attacks against institutional infrastructure. Under BYOD environments, schools often have limited visibility or control over personal devices used by staff and students without measures such as Multi-Factor Authentication (MFA), monitoring of anomalous logins, and credential exposure intelligence.
We Are Not Without Guidelines, but They Remain Voluntary
To be fair, Hong Kong is not operating in the absence of guidance.
The Education Bureau first issued the IT Security Guidelines for Schools in 2007 and subsequently updated the document in September 2019 as Information Security in Schools – Recommended Measures. In April 2025, the Digital Policy Office published the Baseline IT Security Policy. HKIRC, together with AiTLE, the Cyber Security and Technology Crime Bureau of the Hong Kong Police Force, and PwC Hong Kong DarkLab, also launched the Hong Kong School Cybersecurity Guide in August 2025, accompanied by the Cybersec One platform, which provides free security assessment and risk evaluation services.
The author acknowledges that these initiatives have value. However, he argues that they share one common characteristic: All of them are voluntary.
According to the author, there are currently no mandatory baseline requirements, no verification mechanism, no statutory reporting obligations, no designated accountability structure, and no linkage between cybersecurity performance and funding support.
Whether a school adopts these measures, and to what extent, often depends on the awareness and priorities of individual school leaders and IT staff.
The author points to a broader observation.
Since the publication of the first security guideline in 2007, Hong Kong's education sector has spent eighteen years operating under a voluntary approach and has received four separate guidance documents. During that period, educational institutions have remained among the most frequently targeted sectors globally and continue to account for a significant proportion of local data breach notifications. At the same time, threat actors continue to conduct large-scale scanning activities against education-sector systems.
The author does not argue that the guidance documents themselves are poorly written. Rather, he argues that eighteen years of experience suggests that voluntary adoption alone has not been sufficient.
By comparison, the financial sector operates under regulatory frameworks such as the HKMA Cyber Resilience Assessment Framework (C-RAF), while the insurance sector is subject to the Insurance Authority's GL20 requirements. Since January 2025, the Protection of Critical Infrastructure (Computer Systems) Ordinance has also introduced statutory obligations for operators in sectors such as energy, banking, healthcare and telecommunications. Educational institutions are not currently included within those regulated sectors.
According to the author, the distinction is not necessarily that educational institutions face fewer threats. Rather, the difference lies in whether organizations are legally required to implement controls and whether independent oversight exists to verify compliance.
The author further notes that while the disruption of educational services may not present the same immediate public safety implications as the failure of an electrical grid or hospital system, the consequences of personal data exposure remain significant. Student records may contain identity numbers, dates of birth, residential addresses, family information, academic records and special educational needs information. Unlike a compromised credit card, many of these personal data elements cannot simply be replaced once exposed.
The author also identifies two structural gaps:
The first relates to the absence of a mandatory data breach notification regime. While the Privacy Commissioner has proposed amendments to the Personal Data (Privacy) Ordinance, the relevant provisions have not yet been enacted. The Privacy Commissioner recorded 246 reported data breach cases in 2025, representing a year-on-year increase of 21%, with schools and non-profit organizations accounting for approximately 37% of those reports.
The second concerns cybersecurity workforce capacity. According to records of the Legislative Council Panel on Information Technology and Broadcasting in July 2026, Hong Kong had approximately 112,000 information technology practitioners, of whom only 1,587 worked primarily in cybersecurity roles, representing less than 1.5% of the total workforce.
How Other Jurisdictions Address Education Cybersecurity
The author cites the United Kingdom as a reference case.
Primary and Secondary Education
The UK Department for Education (DfE) issued its Cyber Security Standards for Schools and Colleges in 2022 and updated the document in 2024. The standards establish minimum requirements covering areas such as MFA, access control, asset inventories, vulnerability and patch management, and offline backups.
According to the author, an important characteristic of the framework is its connection to education funding, inspection processes and assurance requirements. As a result, Cyber Essentials certification has effectively become a minimum expectation for many institutions. The guidance functions not merely as advice, but as a prerequisite linked to accountability.
Higher Education
For universities, the UK has adopted a different approach.
Rather than relying on legislative requirements, the sector works through Jisc, which provides shared cybersecurity services and sector-wide coordination.
In 2025, Jisc established a dedicated Security Operations Centre (SOC) for the higher education community. It also conducts annual cybersecurity posture assessments based on the National Cyber Security Centre's Cyber Assessment Framework, enabling institutions to compare their maturity levels against sector peers.
From these examples, the author concludes that:
Schools require clearly defined minimum requirements.
Universities require shared defensive capabilities and common benchmarks.
More importantly, both approaches are linked to funding structures and accountability mechanisms rather than relying solely on voluntary adoption.
Conclusion: The Sector Does Not Need Another Guideline. It Needs a Regulatory Framework.
The author begins by revisiting a commonly asked question:
Should the education sector establish a cybersecurity guideline?
According to the author, the question itself may no longer be the right one.
Hong Kong's education sector, he argues, does not lack guidance. What it lacks is a framework with statutory force. A fifth guidance document would likely sit alongside the previous four without fundamentally changing implementation outcomes.
The author therefore proposes moving from a voluntary guidance model to a regulatory framework supported by statutory authority.
In his view, a cybersecurity framework for the education sector should include six core elements:
1. Tiered Regulation Based on Institutional Size and Risk
Different educational institutions face different levels of risk and possess different levels of resources.
The author proposes:
Tier 1 – Mandatory requirements
Tier 2 – Comply or explain requirements
Tier 3 – Recommended best practices
This approach would establish minimum standards while maintaining proportionality.
2. Verifiable Security Baselines
Requirements should be measurable and auditable.
Examples include:
MFA for external systems and administrative accounts
Critical vulnerability remediation within 14 days
Offline backups with annual restoration testing
Security log retention for at least 180 days
According to the author, requirements can only be effectively audited if they are clearly defined.
3. Third-Party Risk Requirements Embedded in Contracts
Standard contractual clauses should address:
Patch management timelines
Incident reporting obligations
Subcontractor disclosure
Data residency
Exit and data migration arrangements
Independent security assessments
The author identifies third-party platforms as a recurring source of systemic risk.
4. Distinguishing Between Security Scanning and Security Testing
The author argues that vulnerability scanning alone is insufficient.
He suggests:
Annual penetration testing and red team exercises for universities
Periodic security reviews for primary and secondary schools
Shared procurement models to reduce assessment costs
The author notes that some vulnerabilities involving business logic cannot be identified through automated scanning tools alone.
5. Mandatory Reporting and Information Sharing
The author considers this one of the most important recommendations.
Educational institutions should be required to:
Report vulnerabilities affecting third-party systems
Notify relevant stakeholders within defined timelines
Participate in sector-wide information-sharing mechanisms
He proposes an Education-ISAC-style model to facilitate the rapid dissemination of indicators and lessons learned across the education sector.
6. Linking Cybersecurity to Funding and Governance
The author proposes incorporating cybersecurity baseline requirements into existing funding programmes and requiring governing bodies to review cyber risk reports annually.
In his view, cybersecurity becomes a priority only when it is integrated into governance structures and funding decisions.
Chris Chan is the CEO of Dracosec Research Limited, Founder of BSides Hong Kong, OffSec Hong Kong Chapter Ambassador, and former Head of Cybersecurity at UDomain. Holding multiple offensive security certifications including OSCE3, he has accumulated 10 CVE vulnerability identifiers and previously reported vulnerabilities to vendors such as Apple, Yahoo, eBay, and ASUS. He has extensive professional experience in penetration testing, red team engagements, incident response, and critical infrastructure compliance.
