Daily AI and Cyber Risk: Hong Kong Airlines and YOHO Breaches Under PCPD Probe, FortiBleed 2.0, and PHP2Shell Shakes the Globe
In a nutshell: Hong Kong has seen another large-scale customer data breach, while a global-scale PHP vulnerability and AI-agent automated attacks are heating up in tandem, laying bare enterprises' gaps in risk assessment, incident notification, and insurance coverage.
This column compiles AI and cyber risk developments in Hong Kong and globally over the past one to two days; all figures and incidents are cited from verifiable sources.
I. Hong Kong: Customer Data Breaches at Three Companies Prompt PCPD Investigation
The Office of the Privacy Commissioner for Personal Data (PCPD) is investigating a data breach affecting approximately 1,600 customers, involving Hong Kong Airlines, online electrical retailer YOHO, and Broadway Photo Supplies. According to the PCPD, YOHO reported on 5 October that data of 790 customers had been leaked, while Hong Kong Airlines reported on 2 October that 815 passengers had likely received fraudulent calls; as of 26 October, the PCPD had received 23 complaints and 20 enquiries. The PCPD urges the public to verify callers' identities through official channels and not to make transfers. (Source: Hong Kong Free Press, 2026-10-28; on.cc, 2026-10-28)
II. HKCERT Warns of FortiBleed 2.0: Over 100,000 Credentials Leaked
The Hong Kong Computer Emergency Response Coordination Centre (HKCERT) issued a security alert on 2026-10-28, disclosing the follow-up findings of FortiBleed 2.0: the new dataset contains over 100,000 credentials and account records, covering sensitive data such as local user passwords, Active Directory LDAP connections, administrator logins, and high-availability clusters. HKCERT reminds organisations that even if they checked their domains following the June alert, they should re-verify using the updated dataset. (Source: HKCERT Security Bulletin, 2026-10-28)
III. PHP2Shell: AI-Assisted Discovery of a Vulnerability That Shakes the Globe
Researchers, with the aid of AI, discovered two critical vulnerabilities in the PHP programming language itself, collectively dubbed "PHP2Shell" (CVE-2026-109618, CVE-2026-109619). As roughly 70% of websites worldwide use PHP, within hours of the disclosure attack attempts surged from tens of thousands to millions, prompting governments and institutions in multiple countries to urgently take parts of their websites offline. The insurance industry is concerned that such incidents could evolve into systemic risk, exceeding the capacity of existing risk models. (Source: Cybersecurity Dive, 2026-10; Hong Kong Economic Times, 2026-10-28)
IV. AI-Agent Automated Attacks on the Rise
Trend Micro uncovered three attacks targeting Japanese organisations, one of which involved 44 AI agents working in coordination to execute the entire intrusion chain from reconnaissance to data theft; at least 19 organisations were identified, 16 of them in Japan. CrowdStrike's report states that agent-capable AI attack incidents doubled between July and September 2026, and are expected to keep rising in both volume and complexity over the coming year. (Source: Trend Micro / LavX News, 2026-10-27; CrowdStrike via TheDayAfterAI, 2026-10-28)
V. US Cyber Insurance Market: Surge in Policy Count, Rising Loss Ratios
The National Association of Insurance Commissioners (NAIC) 2026 Cybersecurity Insurance Market Report shows that by the end of 2025, there were 5.84 million active US cyber insurance policies, up 33% year-on-year; the industry loss ratio rose for the second consecutive year to 53%. New policies are concentrated in lower-limit endorsement forms attached to other policies, reflecting broader market penetration but continued underwriting caution. (Source: NAIC 2026 Report on the Cybersecurity Insurance Market, via Business Insurance, 2026-10-21)
The content of this column is provided for general information and educational purposes only, and does not constitute insurance, legal, or professional advice. Actual coverage is subject to the terms of individual policies.