Breach · · 3 min read
Hong Kong’s exam authority says details of about 16,900 test applicants leaked
The HKEAA says names, birth dates and emails of about 16,900 mainland China residents who applied for two international exams leaked from one of its systems.
The Hong Kong Examinations and Assessment Authority (HKEAA) runs Hong Kong’s main school-leaving exam and also handles registration for some international exams. On October 30, 2026, it said personal details of about 16,900 people had leaked from one of its systems. If you applied for an international exam through the HKEAA from mainland China, here’s what it has said so far.
What happened
In a press release, the HKEAA says it identified a cybersecurity incident on October 29 in an information system used for a small number of international exams. The leak mainly involved about 16,900 people living in mainland China who had applied for two international exams. The details involved were:
- names
- dates of birth
- email addresses
The HKEAA hasn’t named the two exams or said how the system was breached. It reported the incident to the police and notified Hong Kong’s privacy commissioner (the PCPD). It says it has told the organisation that runs the exams and is arranging to notify the people affected.
The authority says the registration systems for the Hong Kong Diploma of Secondary Education (HKDSE) and most international exams are separate from the affected system, and that there’s no evidence so far that the HKDSE or any other exam was affected.
What this means for you
A name, birth date and email address can’t sign in to an account on their own. Together, they make it easier to send a believable message, for example one that claims to be about your exam, your results or a fee you owe, and that asks you to click a link or pay.
What you can do
- Watch your inbox for messages about your exam that you didn’t expect, especially ones asking for payment, passwords, ID documents or a quick reply. Check through the exam organiser’s own website instead of links in the message.
- Use the HKEAA’s channels if you’re unsure whether you’re affected. It has set up an enquiry hotline (3628 8787) and an email address (ie@hkeaa.edu.hk).
- Be careful with any account that uses your birth date as a security answer or as part of a password, and change it if so.
- Learn the patterns. See how scammers use leaked data.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Automatic breach lookups aren’t live yet. Frame’s email aliases also let you give each organisation its own address, so a leak at one doesn’t lead scammers straight to your main inbox. Frame never collects or stores the leaked records themselves.
Sources
- Hong Kong Examinations and Assessment Authority, HKEAA Follows Up on Cybersecurity Incident Involving Information System for International Examinations, October 30, 2026
- RTHK, HKEAA reports international exam data leak, October 31, 2026
- The Standard, Data of nearly 17,000 mainland exam candidates leaked in HKEAA cybersecurity breach, October 31, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.