Latest News

The breach with the largest blast radius hit Times Mobility, operator of the Times Car rental and car-sharing service. Window attackers reached roughly 6.6 million current and former customer accounts, including about 1.6 million identity-verification documents. Those files included scanned driver’s licenses with personal photographs, utility bills and student ID images, the kind of data that is far more damaging in the wrong hands than a password.

Daiwa Securities and Citizen Watch were hit. Daiwa disclosed that up to 220,000 customer records were exposed. Citizen said roughly 100,000 people’s personal information was potentially accessed. 

Ransomware in SoftBank disrupted services for 495 companies and local governments that relied on its hosting, a scale that pushed it beyond a single-company story into critical-infrastructure territory. 

Lawson disclosed Thursday that personal information linked to 2.15 million Lawson IDs had leaked, while karaoke operator Daiichikosho said 8.72 million customer and employee records may have been compromised. The disclosures follow a late-September breach at Park24, operator of Times Car rental and car-sharing services, affecting up to 6.6 million accounts, and other incidents involving Daiwa Securities, Rakuten Drive, GMO Research and Yakiniku King’s parent company, Monogatari.

Seminar

October 27, 2026 (Cantonese onsite 2:00PM to 3:45PM, English online 4:00PM-4:30PM)
Digital Interactive Lab (DIL), 2/F Main Library, HKU
AI Adoption with Security Considerations by Digital Policy Office
Anti-Scam by HK Police Force
Continuous Cybersecurity Protection by Cyberbay

Cantonese session: https://hkuems1.hku.hk/hkuems/ec_hdetail.aspx?ueid=109147

4:00 PM – 4:30 PM – Continuous Cybersecurity Protection by Cyberbay 

(English version via Teams)

English session: https://hkuems1.hku.hk/hkuems/ec_hdetail.aspx?ueid=109150

Booth
Date: October 26 – 30, 2026
Time: 12:00 PM – 4:00 PM
Venue: 2/F, Main Library, HKU

Date: 14 Oct 2026 (Wed)
Time: 2:15pm – 5:15pm

Language: Cantonese

Format: Online

• Overview of key provisions of the Ordinance and the Data Protection Principles

• In-depth discussion of major data privacy issues raised in recent decisions of Hong Kong courts and the Board, including:

• Implications on personal data privacy of a Court of Appeal judgment on Police’s power to search the digital contents of mobile devices: Sham Wing Kan v Commissioner of Police (CACV270/2017) [2020] 2 HKLRD 529

• Decisions made by courts and the Board in relation to:

• Interpretation of the definition of “personal data” under the Ordinance

• Circumstances in which collection of personal data may be considered excessive, unfair or unlawful

• Personal Information Collection Statement

• Use of personal data and application of exemptions under the Ordinance

• Handling of data access requests and charging of data access request fee

• Requirements on data retention and data security

• Right to compensation against a data user for damage suffered by reason of a contravention of a requirement under the Ordinance: Tsang Po Mann v Tsang Ka Kit and Anor (DCCJ 4891/2016) [2021] 1 HKLRD 1301

• Cases relating to criminal offences under the Ordinance, including direct marketing offences and doxxing offences

Artificial intelligence agents built with Google's Gemini model attempted to hack outside companies while tasked with solving a cybersecurity test, making Google the latest company embroiled in an AI safety debate set off by disclosures of similar events at Anthropic and OpenAI. Since the reports of the first wave of rogue AI agents, concerns over AI safety have increased. 

The Trump administration has declined to fast-track any moves to mandate additional guardrails for AI models, with the president stating the U.S. already has laws that can control the use of rogue AI.

《人工智能安全治理框架3.0》TC260 published four guidelines on AI application security on September 15, 2026

https://www.tc260.org.cn/tc260/xwdt1/202609/e879077a3caa4722b2206d1bcaed5a6c/files/%E3%80%8A%E4%BA%BA%E5%B7%A5%E6%99%BA%E8%83%BD%E5%AE%89%E5%85%A8%E6%B2%BB%E7%90%86%E6%A1%86%E6%9E%B63.0%E3%80%8B.pdf.pdf

• General Principles: Guidelines cover planning, risk classification, design, development, verification, deployment, operation, and decommissioning.

• Sector-Specific Guidance: Guidelines include specific recommendations for education, healthcare, and broadcasting and online audiovisual services.

• Personal Information Security: Emphasis on obtaining consent, conducting impact assessments, and ensuring data security.

• Human Oversight: Recommendations for human intervention measures, including emergency shutdowns and version rollbacks.

Things to Consider

• Implement AI security measures: Organizations should establish clear accountability, conduct annual security testing, and reassess systems when risks or application scenarios change.

A significant number of victims received their first fraudulent call within only a few days of arriving in Hong Kong. 

Call for Actions - Please circulate a clear and prominent warning via your individual department to ALL students as soon as possible, emphasising the following:

• Do not trust unsolicited calls claiming to be from the police, government departments, Mainland authorities, banks, courier companies, or telecommunications providers.

• Do not disclose personal information, identity document details, bank account information, passwords, one-time verification codes, photographs, or other sensitive material to unverified callers, messaging accounts, websites, or video-call participants.

• Do not transfer money, install unknown applications, share a mobile-phone or computer screen, open bank accounts, receive or deliver documents, or meet a person because of an unsolicited call.

• No genuine officer will demand secrecy, request payment or bank account details through an unsolicited call, require a student to transfer funds for “investigation”, or ask for intimate photographs.

• If students are uncertain, worried, or believe that they may be encountering a scam, they should call the Anti-Scam Helpline 18222 immediately for advice.

Call for Actions
Please circulate a clear and prominent warning to students in your departments as soon as possible, emphasising the following:

• Do not trust unsolicited calls claiming to be from the police, government departments, Mainland authorities, banks, courier companies, or telecommunications providers.

• Do not disclose personal information, identity document details, bank account information, passwords, one-time verification codes, photographs, or other sensitive material to unverified callers, messaging accounts, websites, or video-call participants.

• Do not transfer money, install unknown applications, share a mobile-phone or computer screen, open bank accounts, receive or deliver documents, or meet a person because of an unsolicited call.

• No genuine officer will demand secrecy, request payment or bank account details through an unsolicited call, require a student to transfer funds for “investigation”, or ask for intimate photographs.

• If students are uncertain, worried, or believe that they may be encountering a scam, they should call the Anti-Scam Helpline 18222 immediately for advice.

Call for Actions: 

Please circulate a clear and prominent warning to students in your departments as soon as possible, emphasising the following:

• Do not trust unsolicited calls claiming to be from the police, government departments, Mainland authorities, banks, courier companies, or telecommunications providers.

• Do not disclose personal information, identity document details, bank account information, passwords, one-time verification codes, photographs, or other sensitive material to unverified callers, messaging accounts, websites, or video-call participants.

• Do not transfer money, install unknown applications, share a mobile-phone or computer screen, open bank accounts, receive or deliver documents, or meet a person because of an unsolicited call.

• No genuine officer will demand secrecy, request payment or bank account details through an unsolicited call, require a student to transfer funds for “investigation”, or ask for intimate photographs.

• If students are uncertain, worried, or believe that they may be encountering a scam, they should call the Anti-Scam Helpline 18222 immediately for advice.

Shortly before Berlin's state parliamentary election, the hacker group Rhysida stole data, tried to extort the Berlin Senate and published the data on the dark web after their attempt failed. It was a story that almost went unnoticed amid all the clamor surrounding the closely watched state election in Saxony-Anhalt on September 6. This highly alarming story is one of many recent reports that have detailed attacks on infrastructure or drone attacks on airports carried out by hostile foreign powers. Incidents like this one in the German capital highlight just how vulnerable Germany's data networks are.

The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has confirmed that its DAVID driver database suffered a data breach after the ShinyHunters extortion gang claimed to have compromised the system.

The disclosure comes after the ShinyHunters extortion group claimed it breached the DAVID database and stole more than 200,000 driver records.

12:00–14:00: ADCC Anti-scam Coordination Centre Ice-Cream Van for ALL staff & students
12:00–16:00: ADCC Promotion Truck with online games for ALL staff & students, 

Dem Campaign for HKU students Registration - https://cmhk.la/Ljjzvr, more info please refer here https://cmhk-try.feishu.cn/share/base/form/shrcnnDMgGNf2qkUoLdyO2vXWEF

The private data of about 33,000 customers of TVB-owned group-buying platform Neigbuy has been compromised in a suspected cyberattack, with police saying they have received six reports of scammers posing as staff.

The Office of the Privacy Commissioner for Personal Data confirmed on Tuesday that it had received a data breach notification from the company on Sunday, and had initiated a formal investigation.

News in Chinese 

- https://inews.hket.com/article/4186854/neigbuy-data-leak-police-receive-scam-report-2026

Two major healthcare businesses, Boston Scientific and McKesson - separate cyberattacks disrupted global operations and resulted in stolen patient data, respectively.

Medical-device maker Boston Scientific, whose IT systems were hacked by unknown intruders last week, said the cyberattack remains ongoing. The impact applies to all new cardiac rhythm management implants other than insertable cardiac monitors (ICM).

Pharmaceutical and medical supply giant McKesson over the weekend confirmed an intrusion after ShinyHunters on Friday told The Register it broke into the company’s Snowflake and Salesforce instances and stole millions of patients’ data. McKesson admit breach as ShinyHunters demands $55.2M.  

About 700 ​AI agents spun up by ⁠the company OpenAI ​participated in breach. The number, ​which has not previously been reported, was disclosed in ​a report published on ​27 August by METR and Redwood ‌Research, ⁠two organizations brought in to do an independent investigation into ​the breach.

More than 153,000 students and staff from four tertiary institutions in Hong Kong have been affected by a data breach on the online learning management platform Canvas.

- 96% from City University (CityU) (146,969 affected accounts, around 34,000 were active)

- The data involved is strictly limited to basic identifiers such as names, student IDs and email addresses and does not involve any sensitive personal data.

- Others affected include The Hong Kong Academy for Performing Arts, the Hong Kong Institute of Construction, the Hong Kong University of Science and Technology.

US House Democrats have decided that AI agents breaking loose from their test environments is a matter for Congress, and on Monday they put that view in writing.

Two letters went out, one to OpenAI and one to Anthropic, each demanding an account of how the companies’ own systems slipped their leashes during security testing, and each treating the episodes as something closer to a national security problem than a laboratory curiosity.

OpenAI is pressed to explain how it monitored its agents during testing and whether rogue models managed to evade the safety controls meant to contain them.

And Anthropic is asked to spell out the protocols it has introduced since its own breaches, with both firms questioned on precisely how their systems escaped containment in the first place.

Similar post in Chinese - 【AI+威脅】美參議員桑德斯致函OpenAI、Anthropic及Meta　促遵守承諾暫停開發AI　警告國會將強制介入 - https://inews.hket.com/article/4175069/%E3%80%90AI-%E5%A8%81%E8%84%85%E3%80%91%E7%BE%8E%E5%8F%83%E8%AD%B0%E5%93%A1%E6%A1%91%E5%BE%B7%E6%96%AF%E8%87%B4%E5%87%BDOpenAI%E3%80%81Anthropic%E5%8F%8AMeta%E3%80%80%E4%BF%83%E9%81%B5%E5%AE%88%E6%89%BF%E8%AB%BE%E6%9A%AB%E5%81%9C%E9%96%8B%E7%99%BCAI%E3%80%80%E8%AD%A6%E5%91%8A%E5%9C%8B%E6%9C%83%E5%B0%87%E5%BC%B7%E5%88%B6%E4%BB%8B%E5%85%A5?mtc=20064

A recent incident report described an AI agent exhibiting unsanctioned behaviour during a cyber testing exercise.

The most interesting takeaway is not the specific incident itself. It's the realization that AI agents can pursue goals in ways we didn't anticipate, even without being explicitly instructed to do so. The report also highlights that traditional security fundamentals such as monitoring, governance, human oversight, and least privilege remain critical as AI capabilities advance.

"The most effective response remains standard cyber hygiene"

The takeaways
🔷 Capability without controls creates risk
🔷 Human oversight remains essential
🔷 Governance must scale as fast as AI innovation

Baptist University has said it is reviewing the security of its information technology (IT) systems after a ransomware group claimed online to have illegally accessed the Hong Kong institution’s data.

The allegations were made by “The Gentlemen”, an advanced cybercrime group that first appeared in the middle of last year.

The purported data reportedly included roughly 130 staff accounts, about 1,770 other user accounts and 260 third‑party employee credentials.

PCPD has launched a series of guidelines since 2021, including the "Ethical Standards for the Development and Use of Artificial Intelligence," "Artificial Intelligence (AI): A Model Framework for Personal Data Protection" (the "Model Framework"), the "Guidelines for Employees Using Generative AI" ("Guidelist"), "Combating the Misuse of AI Deepfake Technology: A Tip for Schools and Parents" ("Tip Pack"), and "Ten Tips for Self-Protection with AI Chatbots." Among them, the Model Framework, Guidelist List, and Tips have all won the Asia-Pacific GovMedia Award, recognizing them as influential public sector projects in the Asia-Pacific region and globally.