Hong Kong Security Report — October 31, 2026

Security analysis based on open-source intelligence and web research. Period: October 24 — October 31, 2026.

Executive Summary

Hong Kong experienced an elevated security posture from October 24 to October 31, 2026, primarily driven by significant cybersecurity incidents and intensified counter-terrorism efforts. The city launched a major three-day Cybersecurity Attack and Defence Drill involving government, public, and private sectors, while simultaneously addressing critical web vulnerabilities and a data breach affecting its flag carrier, Cathay Pacific. Concurrently, an educational counter-terrorism exhibition opened, underscoring the government's focus on public awareness and preparedness against potential threats. Diplomatic tensions persisted, with Hong Kong rejecting the European Parliament's criticisms and the US proposing new investment restrictions, reflecting ongoing geopolitical scrutiny. The hosting of the APEC Finance Ministers' Meeting also necessitated heightened security measures against terror and cyberattack threats, highlighting Hong Kong's role in regional stability amidst complex international dynamics.

Key Security Developments

• Cybersecurity Attack and Defence Drill 2026 Launched
  Hong Kong initiated a comprehensive three-day Cybersecurity Attack and Defence Drill 2026, running from October 29 to October 31. This exercise, led by the Digital Policy Office (DPO) and supported by various security and industry partners, involved 51 defending teams from 28 government departments and 23 public and private enterprises. Its objective was to test cyber defence mechanisms and incident response capabilities through simulated cyber threat scenarios, marking the first time private enterprises formally joined the defending teams to enhance overall cybersecurity resilience.

• Urgent Action on Critical Web Vulnerabilities
  On October 25, Hong Kong authorities mandated urgent and comprehensive reviews across all government bureaus, departments, and public organizations due to two critical flaws, collectively known as "PHP2Shell," in a widely used web programming language. These vulnerabilities could allow remote hackers to execute code and take control of servers. The Digital Policy Office issued a security alert, urging immediate patching or temporary offline isolation of affected systems, though no related cybersecurity incidents were reported by government entities at the time.

• Cathay Pacific Data Breach Disclosure
  Hong Kong's flag carrier, Cathay Pacific, disclosed on October 30 a cybersecurity breach at an external supplier, which compromised approximately 53,000 flight booking records. This incident is part of a broader "Black October" wave of global cyberattacks affecting various institutions and corporations, highlighting the interconnected nature of cyber threats and the risks associated with third-party service providers.

• Multiple Data Leakage Incidents Reported
  In October 2026, the Office of the Privacy Commissioner for Personal Data received notifications of data breaches involving Hong Kong Airlines, YOHO Hong Kong, and Broadway Photo Supply. These incidents collectively affected the personal data of over 1,600 individuals, with exposed information including names, telephone numbers, delivery addresses, order details, and flight information, raising concerns about potential targeted phishing and fraud.

• Counter-Terrorism Education Thematic Exhibition
  An educational counter-terrorism exhibition, organised by the Inter-departmental Counter Terrorism Unit (ICTU) and co-organised by the National Security Department of the Hong Kong Police Force, opened on October 24 at the Hong Kong Museum of History. The exhibition aims to enhance public awareness of counter-terrorism (CT) and strengthen public response capabilities through multimedia displays and interactive experiences, reinforcing the government's "Three-tier Prevention Framework for CT."

• APEC Finance Ministers' Meeting Security
  Hong Kong hosted the APEC Finance Ministers' Meeting on October 20-21 at the Hong Kong Convention and Exhibition Centre in Wan Chai, attracting about 500 guests including finance ministers from 21 APEC economies. Security Secretary Chris Tang Ping-keung confirmed that comprehensive security arrangements, including contingency plans for potential terrorist attacks and cyberattack threats, were implemented to ensure the event's safety and smooth operation while minimizing disruption to daily life.

• Rejection of European Parliament's Criticisms
  On October 9 (with ongoing relevance to the reporting period), the HKSAR Government expressed strong opposition and condemnation of the European Parliament's "Recommendation on EU-China political relations," which contained criticisms regarding Hong Kong. The HKSAR Government urged the European Parliament to cease slanders, smears, and interference in Hong Kong affairs, reaffirming its commitment to safeguarding national sovereignty, security, and the independent judicial power. The European Parliament had previously adopted a resolution in September 2026 calling for targeted sanctions on Hong Kong officials over human rights concerns.

• US Proposed Outbound Investment Restrictions
  On October 22, the U.S. Department of the Treasury's Office of Investment Security published a Notice of Proposed Rulemaking to implement Subtitle C of the Comprehensive Outbound Investment National Security Act (COINS Act). This proposed rule would apply to U.S. persons in connection with certain investments in critical technology sectors (semiconductors, AI, quantum information technology) in the People's Republic of China, including Hong Kong and Macau, citing national security concerns.

• UK Report on Hong Kong's Autonomy and Freedoms
  The UK government's six-monthly report on Hong Kong, covering January to June 2026 and deposited in Parliament on October 22, expressed deep concern over the expanding scope and application of national security legislation. The report highlighted the increasing impact on freedom of expression, assembly, association, and the press, and specifically cited the continued imprisonment of media owner Jimmy Lai, who received a 20-year sentence in February 2026.

• Regular Military Firing Practices
  The Hong Kong Garrison of the People's Liberation Army conducted scheduled firing practices throughout October 2026 at two military sites: the San Wai/Tai Ling Firing Range and the Tsing Shan Firing Range. These are routine exercises, with public advisories issued to ensure safety by warning against entering the firing areas.

Geopolitical Impact and Regional Dynamics

Hong Kong's security developments during this period are deeply intertwined with broader geopolitical shifts and regional dynamics, particularly concerning its relationship with mainland China and major Western powers. The city's proactive stance on cybersecurity, exemplified by the "Cybersecurity Attack and Defence Drill 2026," reflects a national priority to enhance digital resilience, aligning with China's overall digital governance and national security objectives. This focus is critical given the global "Black October" cyberattacks and the reported state-sponsored hacking activities, which underscore the pervasive and sophisticated nature of modern cyber threats impacting financial and corporate sectors worldwide.

Diplomatically, Hong Kong remains a flashpoint in relations between China and Western nations. The HKSAR Government's strong rejection of the European Parliament's resolution, which called for sanctions over human rights and criticised the National Security Law, highlights the ongoing divergence in perspectives on Hong Kong's autonomy and freedoms. Similarly, the US Treasury's proposed outbound investment rules, explicitly including Hong Kong and Macau, signal a tightening of economic engagement with the Greater China region on national security grounds, potentially impacting Hong Kong's role as an international financial hub. These actions by Western powers, coupled with the UK's critical report on the erosion of freedoms, reinforce the narrative of Hong Kong being increasingly integrated into mainland China's governance framework, challenging its "one country, two systems" principle in the eyes of some international observers.

Regionally, Hong Kong's efforts to promote the wider use of the Yuan (e-CNY) in cross-border retail payments underscore its strategic role in Beijing's ambition to internationalise its currency amidst global geopolitical uncertainties. This initiative, along with the hosting of the APEC Finance Ministers' Meeting, positions Hong Kong as a key platform for China to assert its economic influence and foster regional cooperation. The APEC meeting itself, with its focus on "China's voice" in regional stability, served as a diplomatic opportunity for Beijing to showcase Hong Kong's value and integration into the national development strategy, despite the underlying geopolitical tensions. The US travel advisory for China, which extends to Hong Kong, also reflects a cautious approach from Washington regarding the legal and political environment in the SAR.

Military and Defense Analysis

Hong Kong's military and defense posture is primarily defined by the presence of the People's Liberation Army (PLA) Garrison, which is responsible for the city's defense. During the reporting period, the PLA Garrison conducted routine firing practices at the San Wai/Tai Ling Firing Range and Tsing Shan Firing Range in October 2026. These exercises are standard operational procedures and do not indicate a significant shift in force posture or an immediate escalation of military activity directly within Hong Kong. The PLA's broader modernization programs, such as the People's Liberation Army Navy (PLAN) conducting live-fire combat training drills with Type 071 Landing Platform Deck ships on October 14, are more indicative of China's expanding amphibious capabilities and regional power projection, particularly in the South China Sea and Taiwan Strait, rather than specific developments within Hong Kong's immediate defense.

While Hong Kong does not maintain its own independent military, its internal security capabilities are robust, particularly in counter-terrorism and cybersecurity. The Inter-departmental Counter Terrorism Unit (ICTU), comprising members from six law enforcement agencies, actively works to strengthen the HKSAR Government's overall CT capability through intelligence exchange, inter-departmental exercises, and public awareness campaigns. The "STEALTHNET" Counter Cyber and Physical Terrorism Joint Exercise 2026, conducted earlier in April by the Hong Kong Police Force in collaboration with international partners, demonstrated a proactive approach to safeguarding critical infrastructure and enhancing operational resilience against complex threats. Defense spending trends are not publicly detailed for the Hong Kong Garrison, as it falls under the overall PLA budget, but the continuous investment in internal security and cybersecurity infrastructure, as evidenced by the recent drills and initiatives, reflects a commitment to maintaining stability and order within the SAR.

Outlook and Forecast

Short-term trends (1-3 months): In the immediate future, Hong Kong is likely to continue its heightened focus on cybersecurity resilience, with the lessons learned from the recent Attack and Defence Drill and responses to critical vulnerabilities being integrated into policy and practice. The ongoing global "Black October" cyberattacks and the Cathay Pacific breach will maintain pressure on both government and private sectors to strengthen digital defenses. Counter-terrorism awareness campaigns and inter-agency cooperation will also remain a priority, especially given the public exhibition and the government's stated commitment to enhancing CT capabilities. Diplomatic tensions with Western powers, particularly the EU and US, are expected to persist, with continued scrutiny over national security legislation and human rights.

Critical flashpoints and risk areas:
* Cyberattacks: The pervasive nature of cyber threats, including state-sponsored activities and vulnerabilities like PHP2Shell, poses a continuous risk to critical infrastructure, financial institutions, and public services.
* Geopolitical friction: Hong Kong's status as a Special Administrative Region under "one country, two systems" will remain a point of contention in international relations, potentially leading to further diplomatic condemnations or economic measures from Western nations.
* Internal security incidents: While counter-terrorism efforts are robust, the potential for isolated security incidents, whether cyber or physical, remains a concern, particularly in a city that hosts numerous international events.

Indicators to monitor:
* Effectiveness of cybersecurity measures: Observe reports on successful cyberattack mitigations, patching rates for vulnerabilities, and the outcomes of ongoing cybersecurity drills.
* Statements and actions from international bodies: Monitor resolutions, reports, and policy changes from the EU, US, and UK concerning Hong Kong's autonomy, human rights, and economic status.
* Economic indicators related to foreign investment: Track any shifts in foreign direct investment or trade patterns, especially from countries implementing new restrictions or fees.
* Public engagement in security initiatives: Assess the public's participation and feedback on counter-terrorism and national security awareness campaigns.

Strategic recommendations:
* Enhance public-private cybersecurity collaboration: Foster deeper partnerships between government agencies and private enterprises to share threat intelligence, best practices, and resources, building on the success of the recent drill.
* Proactive diplomatic engagement: While rejecting external interference, Hong Kong could explore avenues for constructive dialogue with international partners to clarify its legal framework and address concerns, aiming to mitigate the impact of geopolitical tensions on its international standing.
* Continuous infrastructure protection: Prioritise investment in advanced cybersecurity technologies and training for critical infrastructure operators to defend against evolving threats.
* Strengthen legal and regulatory frameworks: Continuously review and update laws and regulations related to cybersecurity and data privacy to align with international standards and best practices, enhancing trust among international businesses.
* Promote regional security cooperation: Leverage platforms like APEC to foster greater regional cooperation on cybersecurity and counter-terrorism, positioning Hong Kong as a key contributor to regional stability.

Sources

• opengovasia.com
• info.gov.hk
• bastillepost.com
• thestar.com.my
• cybersecurity.hk
• thestandard.com.hk
• hkcert.org
• news.gov.hk
• info.gov.hk
• hk.history.museum
• scmp.com
• scmp.com
• info.gov.hk
• jurist.org
• europa.eu
• whitecase.com
• www.gov.uk
• info.gov.hk
• scmp.com
• ice.it
• chinadailyhk.com
• usembassy-china.org.cn
• aei.org
• understandingwar.org
• police.gov.hk
• opengovasia.com
• hktdc.com