eTVonline Data Breach Exposes 41,842 Hong Kong Education Accounts

HEROIC's DarkHive intelligence system discovered the eTVonline data breach, exposing 41,842 records in August 2018. eTVonline is a government-operated educational television platform based in Hong Kong, serving students and educators with Chinese-language educational content. The compromised data included email addresses and password hashes, putting registered users of this government education service at risk of credential-based attacks.

Why This Is Dangerous

Government-operated educational platforms attract users who may register with official or work email addresses, increasing the value of exposed credentials to targeted attackers. The phpBB3 and SHA256 password hashes used by eTVonline are more resistant than MD5, but advanced cracking techniques can still recover weak or commonly used passwords. Compromised government platform accounts may also be leveraged for social engineering campaigns targeting educational institutions and government employees.

What Was Exposed

• Email Address
• Password Hash (MD5/PHPBB3)

Why This Matters

Educational platform credentials are frequently reused across other government services, professional accounts, and personal email platforms. Attackers who crack these password hashes can attempt access to a broad range of services where the same credentials were used. The exposure of Hong Kong educator and student email addresses also enables highly targeted phishing campaigns in Chinese language, which are more likely to succeed because they match the victims' native language and cultural context.

How Database Breaches Work

A database breach at a government educational platform typically results from vulnerabilities in the web application layer, such as SQL injection flaws or unpatched forum software. Government websites running legacy systems often have longer update cycles, making them more vulnerable to known exploits. Once the database is accessed, attackers extract the user credential tables and distribute the data through dark web marketplaces and Telegram channels, where it is used for credential stuffing and targeted phishing campaigns.

Check If You Are Affected

HEROIC offers a free identity scanner searching over 400 billion records including data from the eTVonline breach. Visit heroic.com to check if your information was exposed.