Hong Kong Cyber Exercise First to Include Private Enterprises; PCPD Probes Breach of Over a Thousand Customers — Daily AI and Cyber Risk Summary
In a nutshell: The Hong Kong government has launched a cyber exercise for the first time incorporating private-sector defenders, while the PCPD is simultaneously investigating multiple customer data breaches; globally, underwriters are beginning to include the risks of AI and "people" within coverage.
1. Hong Kong's 2026 Cyber Defence Exercise Invites Private Enterprises to Participate for the First Time (29 October) The "Hong Kong Cyber Security Defence Exercise 2026", organised by the Digital Policy Office, commenced on 29 October and ran for three days (60 hours) until 31 October. For the first time this year, private enterprises were invited to take part as blue teams (defenders), joining 28 government departments and public bodies in live exercises; a total of 51 blue teams and 23 red teams (attackers) participated, with over 80 organisations sending observers. Sources: Bastille Post, China Labour Bulletin (2026-10-29).
2. PCPD Investigates Customer Data Breaches at Hong Kong Airlines and Others, Receives at Least 85 Enquiries and Complaints (29 October) The Office of the Privacy Commissioner for Personal Data stated that it is investigating customer data breaches at Hong Kong Airlines, YOHO Hong Kong, and Broadway Photo Supplies, in which personal data — including names, telephone numbers, and addresses — of at least 1,600 customers was leaked; to date it has received a cumulative 85 enquiries and complaints. The Privacy Commissioner reminds the public to stay vigilant when receiving calls purporting to be from customer service. Source: Tencent News relaying the PCPD (2026-10-29).
3. Department of Health HIV Testing Website Email Account Suspected of Misuse; Experts Confirm No Data Breach (29 October) On the evening of 23 October, the Department of Health discovered that the email account of its HIV testing service website was suspected of being misused to send fake health notifications impersonating the Department; after a thorough inspection by cyber security experts, it was confirmed that neither the website nor the email account had been accessed without authorisation or had sensitive data stolen, the website has resumed operation, and the Department continues to assist the police with their investigation. Sources: Hong Kong Commercial Daily, Bastille Post (2026-10-29).
4. CFC Upgrades Its Cyber Policy: Adds AI Cover, Executive Protection, and 18-Month Business Interruption (October) Specialist insurer CFC has updated its Cyber Proactive Response policy, adding explicit AI risk coverage (affirmative AI cover), personal crime and extortion protection for senior executives, temporary relocation and trauma counselling, and extending the business interruption indemnity period from 12 to 18 months — reflecting a shift by underwriters from "system remediation" towards covering the personal and psychological risks of executives. Sources: Insurtech Eye, Insurance Business (2026-10).
5. Taiwan's First-Half Cyber Insurance Premium Reaches NT$319 million (29 October) According to statistics from the Financial Supervisory Commission, Taiwan's overall cyber insurance premium income for the first half of 2026 was approximately NT$319 million, led by the semiconductor industry at 48.71%, followed by the financial sector and computer peripheral equipment industry; the industry reminds enterprises to strengthen cyber risk management and consider taking out cyber insurance at the appropriate time. Source: Central News Agency (2026-10-29).
The content of this column is provided for general information and educational purposes only, and does not constitute insurance, legal, or professional advice. Actual coverage is subject to the terms of individual policies.