Weekly Spotlight on Cyber and AI Risk: Hong Kong Incident Figures and Corporate Responses
In a nutshell: Hong Kong's reported cyber security incidents and data breaches continue to rise, and regulatory requirements have also tightened; enterprises should treat "risk assessment, incident response, and insurance coverage" as three links in the same line of defence.
This column compiles daily AI and cyber risk developments in Hong Kong and around the world. In this issue, we begin with the annual figures published by the authorities as a baseline to give enterprises a concrete sense of the scale of risk, then list three actions that can be implemented immediately.
I. Official Figures: Risk Is on the Rise
- Hong Kong Computer Emergency Response Coordination Centre (HKCERT): In 2025, it received 15,877 cyber security incident reports, up approximately 27% year-on-year; of these, phishing accounted for about 57%, remaining the most common entry point for intrusions.
- Office of the Privacy Commissioner for Personal Data (PCPD): In 2025, it recorded 246 data breach notifications, up approximately 21% year-on-year; of these, 81 involved hacking.
- Trend analysis: Phishing and credential theft are low-barrier, high-reward attacks; once inside the internal network, data exfiltration and ransomware often follow in quick succession.
The figures above are all drawn from official annual publications; when citing, please refer to the latest official version.
II. Tightening Regulation: The "Protection of Critical Infrastructures (Computer Systems) Ordinance" Has Taken Effect
The Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) took effect on 1 January 2026, imposing higher security and notification obligations on the computer systems of designated critical infrastructure operators. The knock-on effect for ordinary enterprises is that large organisations will scrutinise the cyber resilience of their supply chains and service providers more strictly, indirectly raising the bar for third-party risk management.
III. Three Things Enterprises Can Do Immediately
- Start with a risk assessment: Use the Insurance Authority's Cyber Resilience Assessment Framework (CRAF / GL20) to self-assess cyber resilience; insurers typically request similar materials before underwriting.
- Establish an incident response checklist: Clarify "who shuts down systems first, who notifies the regulator, and who contacts the insurer" to shorten the time from detection to notification.
- Review policy gaps: Confirm whether existing corporate insurance covers cyber incidents (data breaches, business interruption, ransom-related costs), and whether AI-related liabilities are excluded.
Conclusion
Cyber insurance is not a single-point tool that merely "pays out after an incident"; it is an integral part of an enterprise's overall risk governance. In the next issue, we will follow up on the latest stance of global underwriters on AI liability clauses.
The content of this column is provided for general information and educational purposes only, and does not constitute insurance, legal, or professional advice. Actual coverage is subject to the terms of individual policies.