Incidents in country:
6 incidents catalogued
Google's Mandiant and ManageEngine revealed that a threat actor tampered with AOMEI Backupper's update servers in mid-2026, pushing a backdoor to users across 11 countries.
Hong Kong's Hospital Authority disclosed that personal and surgical data of more than 56,000 patients from the Kowloon East Cluster had leaked onto a third-party platform; police later arrested a contractor's system developer accused of downloading the records during maintenance work.
A ransomware attack crippled roughly 80% of the Hong Kong Consumer Council's computer systems, with attackers exfiltrating about 65GB of data and demanding a US$500,000 ransom that the watchdog refused to pay.
A multi-year intrusion into Cathay Pacific's IT systems exposed the personal data of 9.4 million passengers worldwide, including passport and ID numbers, earning the airline the UK ICO's maximum £500,000 pre-GDPR fine.
Two laptops stored at the fallback venue for Hong Kong's 2017 Chief Executive election were stolen, exposing the personal data — including ID-card numbers — of all 3.7 million registered voters.
A SQL-injection attack against Hong Kong toymaker VTech's Learning Lodge service exposed the personal data of 6.4 million children and nearly 5 million parent accounts, becoming the first major breach to focus on data about minors.