Release Date: 30 Oct 2026
554 Views
(Image generated by generative AI and reviewed under professional human supervision.)
Recent data security incidents serve as an important reminder that the impact of a data leak does not end when unauthorised access is contained. Once personal, transaction or travel information is exposed, scammers may use it to construct highly convincing phishing messages, impersonate customer service staff and target affected individuals.
In October 2026, the Office of the Privacy Commissioner for Personal Data received notifications concerning data breaches involving Hong Kong Airlines, YOHO Hong Kong and Broadway Photo Supply. The available information indicated that the three incidents collectively affected the personal data of more than 1,600 people. The exposed information included combinations of names, telephone numbers, delivery addresses, order details and flight information.
Separately, Cathay Pacific announced a personal data security incident involving its third-party service provider, Amadeus IT Group, S.A. According to the information announced by Cathay Pacific, approximately 53,000 Cathay Pacific-related booking records were accessed without authorisation.
These incidents highlight two closely related cybersecurity concerns:
- Leaked data may be weaponised for targeted phishing and fraud.
- An organisation’s exposure extends to the vendors and service providers that process or access its data.
Why leaked information makes scams more convincing
A name or telephone number may appear harmless in isolation. However, the risk increases when several pieces of information are combined. Flight numbers, departure dates, destinations, booking references, order numbers, delivery addresses and purchase records provide scammers with the context needed to make an approach appear genuine.
Recent scams in Hong Kong have involved fraudsters impersonating airline customer service staff. They claimed that a flight had been cancelled and offered a refund, alternative flight or insurance compensation. Victims were then directed to fraudulent websites, asked to enable screen sharing or instructed to transfer money for supposed verification.
Possession of accurate personal or transaction information is not proof of identity.
Third-party access creates first-party consequences
The Cathay Pacific-related incident illustrates the importance of third-party cybersecurity risk management. According to the information released, the incident involved unauthorised use of system-account credentials to access travel reservation information held within an Amadeus system.
The affected information mainly included booking references, passenger names and flight details. A smaller number of records might also have included contact email addresses and telephone numbers, travel-document information and frequent-flyer programme numbers.
Organisations commonly rely on external providers to support reservations, cloud services, payment processing, customer communications, logistics and other business functions. Outsourcing a service does not outsource its consequences. A supplier incident can expose customers to phishing, impersonation and identity-related risks, while the organisation may face operational disruption, financial loss, reputational damage, and legal or regulatory responsibilities.
Cybersecurity practices for the public to reduce data leakage and scam risks
- Treat unexpected contact with caution
Be suspicious of unsolicited calls, messages or emails that refer to a refund, compensation, account problem, damaged parcel or cancelled flight, particularly when the sender creates a sense of urgency.
- Verify independently
Do not use the telephone number, link or contact method supplied by the caller or message. Open the organisation’s official website or application yourself, or call its published customer service hotline.
- Do not disclose authentication information
Never provide passwords, online banking credentials, credit card information or one-time passwords. Legitimate organisations generally do not request such information through an unsolicited call or message.
- Do not enable screen sharing
If an unknown person asks you to share your screen, install software or grant remote access, stop the interaction.
- Pause before making a payment
Requests for a transfer described as “refund verification”, “account validation” or another urgent procedural requirement should be treated as warning signs. Stop, think and verify through an independent official channel.
If you suspect your personal data has been misused
- Change the passwords for affected accounts and enable multi-factor authentication (MFA).
- Contact the relevant bank, airline, retailer or service provider.
- Monitor your accounts for unusual logins or transactions.
- Stop screen sharing and remove any unfamiliar remote-access software.
- Scan affected devices with security software.
- If you suspect you have fallen victim to a scam, report it to the Police immediately and call the Anti-Scam Helpline on 18222.
- If you suspect your personal data has been misused, seek assistance from the Office of the Privacy Commissioner for Personal Data.
Cybersecurity practices for organisations to reduce data leakage and third-party risks
All organisations should adopt comprehensive third-party risk management, this should extend throughout the business relationship and cover data access, account security, monitoring, incident reporting and termination arrangements.
- Minimise the data held
Collect and retain only personal data needed for service delivery and business operations. Apply defined retention periods and securely delete information that is no longer required.
- Limit the data provided to suppliers
Only provide a service provider with the minimum information necessary to perform its contracted function.
- Maintain visibility of third-party access
Understand which suppliers can access customer or sensitive information, which systems and accounts provide that access, what level of privilege has been granted, and whether the access remains necessary. Apply least privilege and revoke unused or outdated permissions.
- Assess suppliers before and during the engagement
Assess the supplier’s data protection, account security, access control and incident-response arrangements before it processes or stores personal data, and review these arrangements periodically.
- Establish clear incident-notification arrangements
Contracts and operating procedures should set out how and when a supplier must report unauthorised access or a suspected data leak. Promptly identify affected data types, scope and individuals, and assess possible phishing or fraud risks.
- Monitor for abnormal activity
Centralise and analyse authentication, system, network and data-access records. Monitor unusual logins, large data downloads, unexpected privilege changes and suspicious external transfers.
Security is only as strong as the connected ecosystem
Data leakage is not merely a privacy or compliance issue. Leaked information can be converted into persuasive social-engineering material. Organisations should protect customer data wherever it is processed, stored or accessed. Data minimisation, least-privilege access, continuous supplier assessment and rapid incident notification can reduce both the likelihood and consequences of a third-party incident.
To report an information security incident to HKCERT, please call the 24-hour hotline on (852) 8105 6060. For other enquiries, please contact HKCERT by email at [email protected].
