What happened
On 1 October 2022 SCMP reported that more than 290,000 people were at risk of having personal information leaked after staying at three Hong Kong hotels: the Island Shangri-La, the Kowloon Shangri-La and the Kerry Hotel. The Office of the Privacy Commissioner for Personal Data said it had received a report of the breach from Shangri-La Group on the previous Thursday.
The commissioner's office said it was 'disappointed' that Shangri-La only formally notified it and informed customers of the incident more than two months after the company had become aware of it. A spokesman said it would launch a compliance review given the nature of the incident, and estimated that more than 290,000 people could have been affected.
What it cost
More than 290,000 people potentially affected; privacy regulator launched a compliance review.
Why it happened
Hackers gained access to personal data held for guests of three Hong Kong hotels.
Shangri-La Group became aware of the incident more than two months before it formally told the regulator or customers.
The delay left guests unaware that their data was at risk for that period, which the regulator singled out.
The lesson
Notify affected people as soon as you know. A privacy regulator treats the gap between discovery and notification as a failure in its own right.
Aftermath
The privacy commissioner's office opened a compliance review of the incident. The SCMP report does not give the outcome of the review or say what data was taken.
FOLLOW THE EVIDENCE