Latest News

Data Protection Coordinators - please feel free to share with your department students. 

- Facebook: https://www.facebook.com/share/p/1TsqtTwP8y/?mibextid=wwXIfr

- YouTube：http://youtube.com/post/Ugkx4JE_J02iVvI468OFzXSSAUby6-uzr6az?si=RJqDGgjKkIX4v2KD

- XHS：https://www.rednote.com/discovery/item/6acf4607000000001a01e96c?source=webshare&xhsshare=pc_web&xsec_token=ABYmpcRAWtdQupC1AKu4X-LTPVXXKGXPA56Fas9ujSC7M=&xsec_source=pc_share

- DouYin：https://v.douyin.com/CMoZhfmM9oM/

ADCC scam alert (繁體）：

https://www.adcc.gov.hk/zh-hk/alerts-detail/alerts-2110266165232570369.html

ADCC scam alert (簡) : https://www.adcc.gov.hk/zh-cn/alerts-detail/alerts-2110266165232570369.html

ADCC scam alert (英）：

https://www.adcc.gov.hk/en-hk/alerts-detail/alerts-2110266165232570369.html

【🏫大學生慎防「詐」到．假客服假官員騙局飆升🚨】

大學開學，騙徒都開始「覓食」！🍖 開學後，大學生（特別是首年來港的內地新生）已成為詐騙集團的重點目標，主要涉及假冒官員同假冒客服騙局。

根據最新數據🚩，整體大學騙案情況：本地及內地學生受騙個案達1,970宗（按年上升15%），總損失金額達2.3億元（按年上升30%）；大學電話騙案劇增：錄得至少729宗（按年急升143%），損失金額上升60%。其中假冒客服428宗、假冒官員233宗。

最近案例 🔍

事主為領取獎學金的博士生⭐，於8月接獲自稱入境處的來電📞。對方以流利廣東話表示，有人用事主身份證號碼在上海申請電話號碼並向他人發送騷擾訊息，要求事主向上海公安報案。其後對方將通話轉駁至另一騙徒，要求事主下載Teams，並與其同住男友簽署保密承諾書，接受24小時監聽👀。騙徒再指示事主以「到美國作交換生」為由向家人借錢，並以共享屏幕方式全程監視，最終騙走500萬元😱

各位同學仔記住：

❌ 千祈唔好點擊短訊內嘅連結或者回撥電話號碼📲

❌ 收到任何自稱公安嘅來電，即刻收線❗

#假冒官員 #假客服 #18222 #大學生防騙 #反詐騙協調中心

Comment 1:

假冒客服手法

1.冒充銀行、電訊商、網購平台客服來電／短訊，稱帳戶異常、訂單問題或可退款

2.要求改用 WhatsApp／視像通話，或開啟螢幕共享

3.以「取消服務／退款／驗證身份」為由，誘導轉帳，把所謂「驗證碼」填入轉帳金額欄（實為轉走存款）

4.或針對學生常用電子錢包，訛稱帳戶要解凍，索取驗證碼或銀行資料

假冒官員手法

1.冒充入境處、公安、廉政公署等來電，精準說出姓名、證件或留學資料

2.指控涉洗黑錢、違禁品或刑案，轉駁至假公安，以視像監視、錄口供、交「保證金／資產審查」施壓，要求「絕對保密」、勿告訴家人或學校

3.指示分批轉帳至指定戶口，或當面交現金予自稱「特務」的人

The CPR administration says unauthorized individuals misused a Danish company’s legitimate access to search the CPR system, gaining access to names, addresses, CPR numbers and other information on about 8.8 million people.

Acknowledged the “deeply serious incident,” Digitalization Minister Christina Egelund has ordered a comprehensive security review of the CPR system, which assigns every resident a unique 10-digit number to be used when dealing with government agencies, banks and healthcare providers.

2026年10月29日（星期四）時間下午2:00至3:15形式網上視像 / 實體
（地址：香港國際數據私隱學院 香港灣仔皇后大道東248號大新金融中心12樓）

講者

• 鍾麗玲女士 — 個人資料私隱專員

• 郭毅可教授 — 香港科技大學首席副校長；香港生成式人工智能研發中心主任

講座重點

• 簡介「港話通」、「港文通」與「港會通」的功能及應用場景

• 代理式AI的最新發展及應用趨勢

• 負責任使用AI的良好行事方式

• 《代理式人工智能篇：保障個人資料私隱》的實務建議

The breach with the largest blast radius hit Times Mobility, operator of the Times Car rental and car-sharing service. Window attackers reached roughly 6.6 million current and former customer accounts, including about 1.6 million identity-verification documents. Those files included scanned driver’s licenses with personal photographs, utility bills and student ID images, the kind of data that is far more damaging in the wrong hands than a password.

Daiwa Securities and Citizen Watch were hit. Daiwa disclosed that up to 220,000 customer records were exposed. Citizen said roughly 100,000 people’s personal information was potentially accessed. 

Ransomware in SoftBank disrupted services for 495 companies and local governments that relied on its hosting, a scale that pushed it beyond a single-company story into critical-infrastructure territory. 

Lawson disclosed Thursday that personal information linked to 2.15 million Lawson IDs had leaked, while karaoke operator Daiichikosho said 8.72 million customer and employee records may have been compromised. The disclosures follow a late-September breach at Park24, operator of Times Car rental and car-sharing services, affecting up to 6.6 million accounts, and other incidents involving Daiwa Securities, Rakuten Drive, GMO Research and Yakiniku King’s parent company, Monogatari.

Seminar

October 27, 2026 (Cantonese onsite 2:00PM to 3:45PM, English online 4:00PM-4:30PM)
Digital Interactive Lab (DIL), 2/F Main Library, HKU
AI Adoption with Security Considerations by Digital Policy Office
Anti-Scam by HK Police Force
Continuous Cybersecurity Protection by Cyberbay

Cantonese session: https://hkuems1.hku.hk/hkuems/ec_hdetail.aspx?ueid=109147

4:00 PM – 4:30 PM – Continuous Cybersecurity Protection by Cyberbay 

(English version via Teams)

English session: https://hkuems1.hku.hk/hkuems/ec_hdetail.aspx?ueid=109150

Booth
Date: October 26 – 30, 2026
Time: 12:00 PM – 4:00 PM
Venue: 2/F, Main Library, HKU

Date: 14 Oct 2026 (Wed)
Time: 2:15pm – 5:15pm

Language: Cantonese

Format: Online

• Overview of key provisions of the Ordinance and the Data Protection Principles

• In-depth discussion of major data privacy issues raised in recent decisions of Hong Kong courts and the Board, including:

• Implications on personal data privacy of a Court of Appeal judgment on Police’s power to search the digital contents of mobile devices: Sham Wing Kan v Commissioner of Police (CACV270/2017) [2020] 2 HKLRD 529

• Decisions made by courts and the Board in relation to:

• Interpretation of the definition of “personal data” under the Ordinance

• Circumstances in which collection of personal data may be considered excessive, unfair or unlawful

• Personal Information Collection Statement

• Use of personal data and application of exemptions under the Ordinance

• Handling of data access requests and charging of data access request fee

• Requirements on data retention and data security

• Right to compensation against a data user for damage suffered by reason of a contravention of a requirement under the Ordinance: Tsang Po Mann v Tsang Ka Kit and Anor (DCCJ 4891/2016) [2021] 1 HKLRD 1301

• Cases relating to criminal offences under the Ordinance, including direct marketing offences and doxxing offences

Artificial intelligence agents built with Google's Gemini model attempted to hack outside companies while tasked with solving a cybersecurity test, making Google the latest company embroiled in an AI safety debate set off by disclosures of similar events at Anthropic and OpenAI. Since the reports of the first wave of rogue AI agents, concerns over AI safety have increased. 

The Trump administration has declined to fast-track any moves to mandate additional guardrails for AI models, with the president stating the U.S. already has laws that can control the use of rogue AI.

《人工智能安全治理框架3.0》TC260 published four guidelines on AI application security on September 15, 2026

https://www.tc260.org.cn/tc260/xwdt1/202609/e879077a3caa4722b2206d1bcaed5a6c/files/%E3%80%8A%E4%BA%BA%E5%B7%A5%E6%99%BA%E8%83%BD%E5%AE%89%E5%85%A8%E6%B2%BB%E7%90%86%E6%A1%86%E6%9E%B63.0%E3%80%8B.pdf.pdf

• General Principles: Guidelines cover planning, risk classification, design, development, verification, deployment, operation, and decommissioning.

• Sector-Specific Guidance: Guidelines include specific recommendations for education, healthcare, and broadcasting and online audiovisual services.

• Personal Information Security: Emphasis on obtaining consent, conducting impact assessments, and ensuring data security.

• Human Oversight: Recommendations for human intervention measures, including emergency shutdowns and version rollbacks.

Things to Consider

• Implement AI security measures: Organizations should establish clear accountability, conduct annual security testing, and reassess systems when risks or application scenarios change.

A significant number of victims received their first fraudulent call within only a few days of arriving in Hong Kong. 

Call for Actions - Please circulate a clear and prominent warning via your individual department to ALL students as soon as possible, emphasising the following:

• Do not trust unsolicited calls claiming to be from the police, government departments, Mainland authorities, banks, courier companies, or telecommunications providers.

• Do not disclose personal information, identity document details, bank account information, passwords, one-time verification codes, photographs, or other sensitive material to unverified callers, messaging accounts, websites, or video-call participants.

• Do not transfer money, install unknown applications, share a mobile-phone or computer screen, open bank accounts, receive or deliver documents, or meet a person because of an unsolicited call.

• No genuine officer will demand secrecy, request payment or bank account details through an unsolicited call, require a student to transfer funds for “investigation”, or ask for intimate photographs.

• If students are uncertain, worried, or believe that they may be encountering a scam, they should call the Anti-Scam Helpline 18222 immediately for advice.

Call for Actions
Please circulate a clear and prominent warning to students in your departments as soon as possible, emphasising the following:

• Do not trust unsolicited calls claiming to be from the police, government departments, Mainland authorities, banks, courier companies, or telecommunications providers.

• Do not disclose personal information, identity document details, bank account information, passwords, one-time verification codes, photographs, or other sensitive material to unverified callers, messaging accounts, websites, or video-call participants.

• Do not transfer money, install unknown applications, share a mobile-phone or computer screen, open bank accounts, receive or deliver documents, or meet a person because of an unsolicited call.

• No genuine officer will demand secrecy, request payment or bank account details through an unsolicited call, require a student to transfer funds for “investigation”, or ask for intimate photographs.

• If students are uncertain, worried, or believe that they may be encountering a scam, they should call the Anti-Scam Helpline 18222 immediately for advice.

Call for Actions: 

Please circulate a clear and prominent warning to students in your departments as soon as possible, emphasising the following:

• Do not trust unsolicited calls claiming to be from the police, government departments, Mainland authorities, banks, courier companies, or telecommunications providers.

• Do not disclose personal information, identity document details, bank account information, passwords, one-time verification codes, photographs, or other sensitive material to unverified callers, messaging accounts, websites, or video-call participants.

• Do not transfer money, install unknown applications, share a mobile-phone or computer screen, open bank accounts, receive or deliver documents, or meet a person because of an unsolicited call.

• No genuine officer will demand secrecy, request payment or bank account details through an unsolicited call, require a student to transfer funds for “investigation”, or ask for intimate photographs.

• If students are uncertain, worried, or believe that they may be encountering a scam, they should call the Anti-Scam Helpline 18222 immediately for advice.

Shortly before Berlin's state parliamentary election, the hacker group Rhysida stole data, tried to extort the Berlin Senate and published the data on the dark web after their attempt failed. It was a story that almost went unnoticed amid all the clamor surrounding the closely watched state election in Saxony-Anhalt on September 6. This highly alarming story is one of many recent reports that have detailed attacks on infrastructure or drone attacks on airports carried out by hostile foreign powers. Incidents like this one in the German capital highlight just how vulnerable Germany's data networks are.

The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has confirmed that its DAVID driver database suffered a data breach after the ShinyHunters extortion gang claimed to have compromised the system.

The disclosure comes after the ShinyHunters extortion group claimed it breached the DAVID database and stole more than 200,000 driver records.

12:00–14:00: ADCC Anti-scam Coordination Centre Ice-Cream Van for ALL staff & students
12:00–16:00: ADCC Promotion Truck with online games for ALL staff & students, 

Dem Campaign for HKU students Registration - https://cmhk.la/Ljjzvr, more info please refer here https://cmhk-try.feishu.cn/share/base/form/shrcnnDMgGNf2qkUoLdyO2vXWEF

The private data of about 33,000 customers of TVB-owned group-buying platform Neigbuy has been compromised in a suspected cyberattack, with police saying they have received six reports of scammers posing as staff.

The Office of the Privacy Commissioner for Personal Data confirmed on Tuesday that it had received a data breach notification from the company on Sunday, and had initiated a formal investigation.

News in Chinese 

- https://inews.hket.com/article/4186854/neigbuy-data-leak-police-receive-scam-report-2026

Two major healthcare businesses, Boston Scientific and McKesson - separate cyberattacks disrupted global operations and resulted in stolen patient data, respectively.

Medical-device maker Boston Scientific, whose IT systems were hacked by unknown intruders last week, said the cyberattack remains ongoing. The impact applies to all new cardiac rhythm management implants other than insertable cardiac monitors (ICM).

Pharmaceutical and medical supply giant McKesson over the weekend confirmed an intrusion after ShinyHunters on Friday told The Register it broke into the company’s Snowflake and Salesforce instances and stole millions of patients’ data. McKesson admit breach as ShinyHunters demands $55.2M.  

About 700 ​AI agents spun up by ⁠the company OpenAI ​participated in breach. The number, ​which has not previously been reported, was disclosed in ​a report published on ​27 August by METR and Redwood ‌Research, ⁠two organizations brought in to do an independent investigation into ​the breach.

More than 153,000 students and staff from four tertiary institutions in Hong Kong have been affected by a data breach on the online learning management platform Canvas.

- 96% from City University (CityU) (146,969 affected accounts, around 34,000 were active)

- The data involved is strictly limited to basic identifiers such as names, student IDs and email addresses and does not involve any sensitive personal data.

- Others affected include The Hong Kong Academy for Performing Arts, the Hong Kong Institute of Construction, the Hong Kong University of Science and Technology.

US House Democrats have decided that AI agents breaking loose from their test environments is a matter for Congress, and on Monday they put that view in writing.

Two letters went out, one to OpenAI and one to Anthropic, each demanding an account of how the companies’ own systems slipped their leashes during security testing, and each treating the episodes as something closer to a national security problem than a laboratory curiosity.

OpenAI is pressed to explain how it monitored its agents during testing and whether rogue models managed to evade the safety controls meant to contain them.

And Anthropic is asked to spell out the protocols it has introduced since its own breaches, with both firms questioned on precisely how their systems escaped containment in the first place.

Similar post in Chinese - 【AI+威脅】美參議員桑德斯致函OpenAI、Anthropic及Meta　促遵守承諾暫停開發AI　警告國會將強制介入 - https://inews.hket.com/article/4175069/%E3%80%90AI-%E5%A8%81%E8%84%85%E3%80%91%E7%BE%8E%E5%8F%83%E8%AD%B0%E5%93%A1%E6%A1%91%E5%BE%B7%E6%96%AF%E8%87%B4%E5%87%BDOpenAI%E3%80%81Anthropic%E5%8F%8AMeta%E3%80%80%E4%BF%83%E9%81%B5%E5%AE%88%E6%89%BF%E8%AB%BE%E6%9A%AB%E5%81%9C%E9%96%8B%E7%99%BCAI%E3%80%80%E8%AD%A6%E5%91%8A%E5%9C%8B%E6%9C%83%E5%B0%87%E5%BC%B7%E5%88%B6%E4%BB%8B%E5%85%A5?mtc=20064