Hong Kong Security Report — November 11, 2026

Security analysis based on open-source intelligence and web research. Period: November 04 — November 11, 2026.

Security Analysis Report: Hong Kong (November 04, 2026 - November 11, 2026)

Executive Summary

Hong Kong's security landscape during this period was primarily shaped by significant cybersecurity incidents and ongoing geopolitical tensions surrounding its National Security Law. Multiple data breaches, including those affecting financial services platform MoneySmart and Cathay Pacific via its service provider Amadeus, exposed sensitive personal and booking information. Concurrently, the sentencing of pro-democracy activist Joshua Wong to an additional 10 years under the National Security Law drew strong condemnation from international bodies and governments, highlighting persistent concerns over human rights and the rule of law. The city also saw continued activity from China-aligned cyber threat actors and the widespread abuse of AI-powered hacking tools, while actively participating in cybersecurity defense drills and strengthening economic ties with Beijing.

Key Security Developments

• Cybersecurity Incident: MoneySmart Data Breach
  On November 3, MoneySmart, a financial comparison platform operating in Singapore and Hong Kong, disclosed a data breach discovered on October 29. An unauthorized third party accessed internal IT systems and copied customer data. The Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong reported that approximately 305,000 personal data records of Hong Kong individuals and 725 partial credit card numbers may have been affected. The compromised data included names, dates of birth, addresses, email addresses, phone numbers, and financial information.

• Cybersecurity Incident: Cathay Pacific via Amadeus Data Breach
  Hong Kong-based airline Cathay Pacific confirmed on November 2-4 that approximately 53,000 flight bookings were affected by a data breach involving its third-party software provider, Amadeus. Cathay Pacific was notified by Amadeus on October 28 about unauthorized access to travel reservation data in its systems, which occurred between August 2023 and September 2026. The compromised information included booking references, passenger names, flight details, and in a smaller number of cases, additional personal information such as email and phone contacts, travel documents, and frequent flyer numbers. There was no evidence that financial or payment information was accessed.

• National Security Law Sentencing of Joshua Wong
  On November 5, prominent Hong Kong pro-democracy activist Joshua Wong was sentenced to an additional 10 years in prison under the Beijing-imposed National Security Law. The High Court's Court of First Instance found Wong guilty of "conspiracy to commit collusion with foreign countries or with external elements to endanger national security." Wong, already serving a separate sentence, had been charged in 2025 for his advocacy and alleged collusion with foreign officials.

• International Condemnation of Wong's Sentencing
  The sentencing of Joshua Wong on November 5 drew immediate and strong condemnation from international entities. The United States and the United Kingdom condemned the "cruel" sentence, calling for Wong's immediate release. On November 6, the UN Human Rights Office also expressed deep concern over the harsh penalties imposed under national security legislation in Hong Kong and Macao, reiterating calls for a review of such convictions against international human rights obligations.

• China-aligned Threat Actor "SlippyNunchucks" Targeting Hong Kong
  ESET reported on November 4 that a China-aligned threat actor, SlippyNunchucks, has been actively targeting organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka since July 1, 2026. The group is attributed to a Domain Name System (DNS) hijacking operation that abuses insecure HTTP communications in Windows versions of popular Chinese applications like Sogou Input Method to deploy an implant called DarkVigil (aka FDMTP) for surveillance purposes.

• Widespread Abuse of AI-Powered Hacking Tool ARTEX
  Reports from Check Point Research and CERT-In between November 5 and 8 highlighted the increasing abuse of ARTEX, an open-source, AI-powered penetration testing platform, by cybercriminals. Hong Kong was identified as a significant location for ARTEX command-and-control (C&C) servers, hosting 295 instances (18% of observed activity). Additionally, 17 backdoored ARTEX consoles, exposing root access, were found in Hong Kong between November 2 and 4. These AI agents are used for opportunistic, financially motivated cybercrime, including stealing gaming credentials and code-signing certificates.

• Hong Kong Cybersecurity Attack and Defence Drill 2026 Concludes
  The Hong Kong Cybersecurity Attack and Defence Drill 2026, spearheaded by the Digital Policy Office (DPO), successfully concluded on October 31 (reported November 1). The three-day drill involved 51 defending teams from government departments, public organizations, and private enterprises, and 23 attacking teams from Hong Kong and Mainland cybersecurity professional organizations and tertiary institutions. The exercise aimed to identify system vulnerabilities and enhance defense mechanisms and incident response capabilities.

• Microsoft November 2026 Security Update Alert
  On November 11, the Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) issued an alert regarding Microsoft's monthly security update for November 2026. The update addressed multiple vulnerabilities, including CVE-2026-124194, a "Medium Risk" vulnerability in Microsoft Outlook that is being exploited in the wild. This vulnerability could lead to information disclosure by allowing Outlook to connect to an attacker-controlled network location without user warning.

• Deepening Beijing-Hong Kong Economic Cooperation
  Chief Executive John Lee attended the 29th Beijing-Hong Kong Economic Cooperation Symposium on November 4. He emphasized deepening collaboration in financial opening-up, innovation, and technology, and leveraging Hong Kong's role as a "super connector" to empower Chinese enterprises globally. This aligns with China's 15th Five-Year Plan (2026-2030), which aims to support Hong Kong in enhancing its competitive advantages.

• Global Financial Leaders' Investment Summit
  Hong Kong hosted the Global Financial Leaders' Investment Summit from November 2 to 4. Chinese Vice Premier He Lifeng addressed the summit via video, expressing confidence in Hong Kong's ability to consolidate its competitive advantages through its first five-year plan, aligned with the national 15th Five-Year Plan. Discussions at the summit also touched upon geopolitical fractures and the race for artificial intelligence dominance.

• Upcoming US-China Hong Kong Forum
  The 7th US-China Hong Kong Forum is scheduled to take place from November 15 to 17. The forum aims to provide a platform for dialogue, connecting high-level diplomacy with broader discussions among businesses, academia, and communities, particularly concerning US-China relations and their impact on Hong Kong.

Cyber Threat Landscape

Hong Kong faced a dynamic cyber threat landscape during this period, marked by significant data breaches and the active presence of both state-aligned and financially motivated actors. The financial services sector was directly impacted by the MoneySmart data breach, discovered on October 29 and publicly reported on November 3, which potentially exposed over 300,000 Hong Kong customer records, including sensitive financial and personal identification information. Similarly, the travel industry saw a major incident with the Cathay Pacific data breach, reported between November 2 and 4, stemming from a vulnerability in its third-party service provider Amadeus's systems, affecting 53,000 bookings with passenger names, flight details, and some contact information exposed.

A notable state-aligned actor, SlippyNunchucks (China-aligned), was reported by ESET on November 4 to be actively targeting organizations and Chinese-speaking individuals in Hong Kong since July 1, 2026. This group utilizes DNS hijacking and deploys the DarkVigil implant through popular Chinese applications like Sogou Input Method for surveillance. Furthermore, the widespread abuse of ARTEX, an AI-powered penetration testing platform, by cybercriminals for financially motivated attacks was highlighted in reports from November 5-8. Hong Kong was identified as a significant hub for ARTEX operations, hosting 295 C&C servers and 17 backdoored consoles, indicating a local presence in the infrastructure supporting these autonomous hacking campaigns.

In terms of vulnerabilities, HKCERT issued an alert on November 11 regarding Microsoft's monthly security update, noting that CVE-2026-124194, a "Medium Risk" vulnerability in Microsoft Outlook, is being actively exploited in the wild for information disclosure. While outside the immediate reporting period, the Hong Kong Digital Policy Office had also issued an "extremely high risk" warning in late October for two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, collectively known as "PHP2Shell"), urging urgent patching for government and public bodies. HKCERT's Q3 2026 report, published on November 5, indicated a 15% increase in cybersecurity incidents compared to the previous year, with phishing accounting for approximately 61% of all incidents, and noted that AI is accelerating the production of phishing lures and reconnaissance.

Background: Threat actors known to target Hong Kong include Lazarus Group (North Korea-linked), APT40 (China-linked), APT3 (China-linked), Earth Lusca (China-linked), LOTUS PANDA (China-linked), BRONZE HIGHLAND (China-linked), TEMPER PANDA (China-linked), and Aoqin Dragon (China-linked).

Geopolitical Impact and Regional Dynamics

The period saw Hong Kong navigating complex geopolitical currents, primarily influenced by its relationship with mainland China and international reactions to its governance. The sentencing of pro-democracy activist Joshua Wong to an additional 10 years under the National Security Law on November 5 triggered strong condemnation from the United States, the United Kingdom, and the UN Human Rights Office. This event underscores the ongoing international scrutiny of Hong Kong's autonomy and human rights situation, further solidifying perceptions of a tightening grip from Beijing and potentially impacting diplomatic relations with Western powers. The Hong Kong government, through its Secretary for Security, Tang Ping-keung, defended the judicial proceedings as fair and open, condemning "malicious attacks and smears launched by external forces."

Economically and strategically, Hong Kong continued to deepen its integration with mainland China. Chief Executive John Lee's participation in the 29th Beijing-Hong Kong Economic Cooperation Symposium on November 4 highlighted efforts to expand collaboration in financial services, innovation, and technology, aligning Hong Kong's development with China's 15th Five-Year Plan (2026-2030). This strategic alignment aims to leverage Hong Kong's role as a "super connector" and "super value-adder" for Chinese enterprises going global. The Global Financial Leaders' Investment Summit (November 2-4) also served as a platform for Chinese Vice Premier He Lifeng to express confidence in Hong Kong's future under the national plan, despite discussions at the summit acknowledging geopolitical fractures.

The upcoming 7th US-China Hong Kong Forum (November 15-17) indicates Hong Kong's continued, albeit delicate, role as a bridge for dialogue between major powers. However, China's broader stance on cybersecurity, as evidenced by its response to a UK report accusing Beijing of intending AI operations against critical infrastructure, suggests a defensive and often confrontational approach to Western accusations, which could indirectly affect Hong Kong's cyber policy and international cooperation. Overall, Hong Kong's geopolitical trajectory during this period reinforced its increasing integration with mainland China's strategic objectives, while simultaneously facing sustained international pressure regarding its political freedoms.

EU Relations and Implications

During this specific reporting period, there were no direct news reports detailing new developments in Hong Kong's relations with the European Union. The EU relationship outlook, as assessed in August 2026, remains "Stable" according to the provided reference data, with existing cooperation projects in Trade & Investment, Education & Skills, and Development Cooperation.

However, the security and cyber developments outlined above carry indirect implications for EU interests in Hong Kong. The sentencing of Joshua Wong under the National Security Law and the subsequent condemnation from the UN Human Rights Office, the US, and the UK, are likely to be viewed with concern by the EU, which often emphasizes human rights and the rule of law in its external relations. Such events could strain diplomatic engagement and potentially influence the EU's assessment of the business and political environment in Hong Kong, impacting trade and investment confidence for EU companies. Furthermore, the significant data breaches affecting MoneySmart and Cathay Pacific, coupled with the active presence of state-aligned cyber threat actors and the widespread abuse of AI-powered hacking tools, pose direct risks to EU citizens' data and EU businesses operating in Hong Kong. These cybersecurity concerns could necessitate enhanced digital security cooperation or revised risk assessments for EU-funded projects and investments in the region.

Military and Defense Analysis

During the period of November 04, 2026, to November 11, 2026, there were no reported military activities, defense policy shifts, defense acquisitions, or significant defense industry developments specifically concerning Hong Kong. The city's defense is primarily the responsibility of the People's Liberation Army Hong Kong Garrison, and news coverage during this week focused predominantly on cybersecurity, political security, and economic integration with mainland China rather than conventional military matters. Therefore, there is no significant information to report regarding force posture, modernization programs, or defense spending trends for Hong Kong within this timeframe.

Outlook and Forecast

Short-term trends (1-3 months): Hong Kong is likely to continue experiencing a high volume of cybersecurity incidents, particularly data breaches and phishing attacks, exacerbated by the increasing use of AI in offensive operations. The financial and travel sectors will remain prime targets. The government will likely continue its efforts to strengthen cybersecurity defenses, as demonstrated by the recent Attack and Defence Drill. Politically, international scrutiny over the implementation of the National Security Law will persist, especially following high-profile sentencings. Hong Kong will further deepen its economic and technological integration with mainland China, aligning with the 15th Five-Year Plan.

Critical flashpoints and risk areas: The primary risk areas include the financial sector (due to high-value data and potential for direct financial gain), critical infrastructure (given the reported intent of nation-states to use AI cyber against such targets), and any organizations handling large volumes of personal data. The ongoing political tensions stemming from national security cases could lead to further diplomatic friction with Western countries, potentially affecting Hong Kong's international standing and business environment. The proliferation and abuse of AI-powered hacking tools like ARTEX represent a significant and evolving threat, capable of accelerating attack chains and increasing the scale of cybercrime.

Indicators to monitor: Key indicators to monitor include the frequency and sophistication of reported cyberattacks and data breaches, particularly those attributed to state-aligned actors or involving AI tools. Observe any new legislative or policy developments related to cybersecurity and data protection, as well as the outcomes and follow-up actions from the recent cybersecurity drill. On the political front, monitor international reactions to national security law enforcement, any changes in diplomatic engagement with major powers (including the EU), and the progress of economic integration initiatives with mainland China. The rhetoric and outcomes of upcoming dialogues, such as the US-China Hong Kong Forum, will also be important.

Strategic recommendations: Hong Kong organizations should prioritize robust cybersecurity measures, including advanced threat detection, incident response planning, and employee training on phishing awareness. Given the prevalence of AI-driven attacks, investing in AI-powered defense mechanisms and staying updated on emerging AI-related threats is crucial. Enhanced collaboration between government, public, and private sectors on threat intelligence sharing and joint defense exercises should be a continuous effort. From a governance perspective, transparent communication regarding national security law implementation and its impact on business and civil liberties could help mitigate international concerns and maintain Hong Kong's appeal as an international hub.

Sources

• cybersecurityasean.com
• channelnewsasia.com
• buttondown.com
• odixpay.com
• wwconemedia.com
• idnfinancials.com
• travelnews.co.za
• cathaypacific.com
• shieldworkz.com
• techwireasia.com
• cfpublic.org
• ishr.ch
• theguardian.com
• news.gov.hk
• youtube.com
• thehackernews.com
• checkpoint.com
• securityaffairs.com
• whysecurity.it
• thehackernews.com
• info.gov.hk
• hkcert.org
• news.gov.hk
• www.gov.cn
• scmp.com
• chinadailyasia.com
• scmp.com
• infosec.gov.hk
• hkcert.org
• thestandard.com.hk