Oxfam Hong Kong data leak: charity violated data protection law

Hong Kong’s Privacy Commissioner ruled that Oxfam Hong Kong violated data protection law after a July leak that potentially affected 550,000 individuals, citing poor security controls. The investigation attributed the breach to outdated firewalls with critical vulnerabilities, failure to enable multi-factor authentication, excessive data retention, and vague information security policies.