Over 1,600 impacted as data leaks hit HK Airlines, Yoho, and Broadway

Hong Kong Airlines is among three companies facing scrutiny in Hong Kong after personal data leaks were linked to suspected scam calls targeting more than 1,600 customers.

Hong Kong's Office of the Privacy Commissioner for Personal Data (PCPD) said it has launched investigations into data breach incidents involving the airline, electronics retailer Yoho and Broadway Photo Supply.

The watchdog received Hong Kong Airlines' data breach notification on 2 October. Preliminary findings showed that 815 passengers with flights departing between 29 September and 22 October had received suspected scam calls. Information potentially affected included passengers' names, phone numbers, flight dates, flight numbers and travel routes.

Don't miss: HKMA unveils AI-generated music video to combat scams

The incident has also been linked to significant financial losses. Citing police information, the Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) said a retiree was cheated out of HK$1.2 million in one scam related to the airline, according to the South China Morning Post (SCMP).

In a statement seen by MARKETING-INTERACTIVE, Hong Kong Airlines said it takes the privacy and security of passengers' personal data "very seriously" and apologised for the distress caused. The airline said that after receiving reports of suspected calls from individuals impersonating its staff, it immediately reported the matter to the police and proactively notified the PCPD.

The airline has since engaged an independent cybersecurity consultant to establish the cause of the incident, with the review ongoing. It added that it will remain in contact with the relevant authorities and cooperate with their investigations.

Hong Kong Airlines also urged passengers to remain vigilant against suspicious calls claiming that flights have been cancelled or offering compensation, refunds or alternative flight arrangements. It advised passengers to verify such communications through its official channels and not to disclose personal, banking or payment information, including passwords and one-time passwords.

Meanwhile, the PCPD received a separate data breach notification from Yoho on 5 October. Its preliminary findings showed that 790 customers who placed orders between 29 September and 12 October had received suspected scam calls. Potentially affected information included names, phone numbers, delivery addresses, order numbers and details of products purchased.

Broadway also notified the watchdog of its own data breach on 26 October after customers reported receiving suspected scam calls. Potentially affected information included names, phone numbers, products purchased and payment amounts.

As of 26 October, the PCPD had received 23 complaints and 20 inquiries relating to the three incidents. Of these, Hong Kong Airlines accounted for 10 complaints and 11 inquiries, while Yoho accounted for 12 complaints and nine inquiries. One complaint was related to Broadway.

The PCPD has urged consumers not to assume a call is legitimate simply because the caller can provide accurate personal information. It advised consumers to verify callers through companies' official websites, customer service hotlines or physical stores before providing further personal information or making payments.

The watchdog also warned that businesses handling compensation or refunds would generally not ask customers to pay deposits or processing fees in advance, or transfer money to verify a bank account. Consumers were advised against disclosing sensitive information such as online banking credentials and to retain records of suspicious calls for potential reports to the authorities.

MARKETING-INTERACTIVE has reached out to Yoho and Broadway for a statement. 

The incident comes amid continued scrutiny over how brands safeguard customer information. Last year, luxury fashion house Dior apologised after an unauthorised external party accessed data belonging to some of its customers in China. The brand said at the time that the affected database did not contain financial information.

Related articles: 
Nike investigates alleged data breach following leak claims   
InvestHK opens probe into potential data leak following ransomware attack     
HK privacy watchdog uncovers security issues in Oxfam HK data leak