Citybus reports unauthorised access to tour ticket system, no data leak found
Citybus says a third-party ticket redemption system for its City Sightseeing service was accessed without authorisation. The system holds basic data for about 53,000 users, but no information was leaked. Citybus has notified Hong Kong's privacy watchdog.
Citybus has reported that a third-party ticket redemption system for its City Sightseeing tour service may have been accessed without authorisation, although no data leak has been detected. The company has notified Hong Kong’s Office of the Privacy Commissioner for Personal Data.
According to a statement from Citybus, preliminary investigations found that a system used to redeem and authenticate City Sightseeing tour tickets was subject to suspected unauthorised access. The system contained basic information for about 53,000 users, limited to names and email addresses. Citybus said there is currently no evidence of any data leak.
The company stressed that the affected system is not involved in ticket purchasing or payment processing, meaning no customer credit card, bank account or electronic payment data was exposed. Citybus also emphasised that its core bus operations system is completely independent from the third-party ticket redemption system, and that the affected system has no connection to the payment platforms passengers use for regular bus fares, such as Octopus cards or other electronic payments.
Citybus said daily operations for its regular services and City Sightseeing tours have not been affected. The company said it takes customer data privacy and information security seriously, and that upon being notified of the incident it immediately instructed the service provider to conduct a thorough investigation and submit a detailed report. Citybus expressed its apologies for any concern or inconvenience caused to users.