Hong Kong

Hong Kong faced a dynamic cyber threat landscape during this period, characterized by a significant increase in overall incidents and the growing sophistication of attacks. HKCERT reported a 15% rise in security incidents in Q3 2026 compared to the previous year, with phishing remaining the dominant threat, accounting for 61% of all cases. These phishing campaigns are becoming more targeted and effective, leading to unauthorized credit-card transactions and substantial financial losses, as evidenced by over 700 reports of suspected credit-card misuse in mid-September 2026, totaling approximately HK$14.7 million in losses.

Ransomware attacks also saw a notable increase, rising by 17.6% in the first three quarters of 2026. This surge is largely attributed to the use of Artificial Intelligence (AI) by attackers, which enables them to probe corporate computer systems for vulnerabilities more efficiently and at reduced costs. Several data breaches were reported or under investigation, including a newly discovered breach at CITIC Pacific Limited on November 10, 2026, claimed by the threat actor KRYBIT. Additionally, the Office of the Privacy Commissioner for Personal Data (PCPD) continued investigating breaches affecting major airlines (Cathay Pacific, Hong Kong Airlines, Malaysia Airlines Berhad) and retailers (YOHO Hong Kong, Broadway), where leaked customer data was exploited for post-breach fraud, resulting in individual losses up to HK$1.5 million.

In response to these threats, the Hong Kong government is actively enhancing its cyber policy and response. The Digital Policy Office (DPO) launched the "Secure AI@Work Enablement Campaign" in mid-2026 to help organizations adopt AI securely and responsibly. The Hong Kong police have also developed an AI-powered system, "Rapid," which was used in a year-long joint operation with Interpol to detect and remove over 51,000 phishing links. Furthermore, the "Hong Kong Cybersecurity Attack and Defence Drill 2026," which concluded on October 31, involved 51 defending teams from government, public, and private sectors, and 23 attacking teams, showcasing collaboration between Hong Kong and Mainland cybersecurity organizations to enhance overall resilience. Hong Kong's Protection of Critical Infrastructures Bill, effective January 1, 2026, introduces a comprehensive cybersecurity framework for essential services, mandating formal risk assessments, continuous monitoring, and supplier oversight. Background: Threat actors known to target Hong Kong include Lazarus Group, SAMURAI PANDA, APT40, APT3, Earth Lusca, LOTUS PANDA, BRONZE HIGHLAND, and TEMPER PANDA.