HKEAA and Cathay Pacific Hit by Consecutive Breaches as PCPD Steps In — Daily AI and Cyber Risk Summary
In a nutshell: Hong Kong has seen multiple data breaches over successive days, with regulatory and law-enforcement follow-up intensifying; meanwhile, the global "Black October" wave of AI supply-chain attacks is testing the boundaries of cyber insurance coverage for AI risk.
1. HKEAA International Examination System Hit by Cyber Attack; Data of About 16,900 Mainland Candidates Leaked (30 October) On 30 October, the Hong Kong Examinations and Assessment Authority (HKEAA) reported to police a cyber security incident involving part of its international examination information system and notified the Office of the Privacy Commissioner for Personal Data (PCPD). The incident mainly affected approximately 16,900 mainland residents who had applied for two international examinations; the leaked data included names, dates of birth, and email addresses. The HKEAA has set up an enquiry hotline and email, and emphasised that the Hong Kong Diploma of Secondary Education examination system is separate and currently unaffected. Sources: Hong Kong Economic Times, Dotdotnews (2026-10-30).
2. Cathay Pacific Vendor Amadeus Unauthorised Access; 53,000 Booking Records Leaked (30 October) Cathay Pacific said that its third-party travel technology provider Amadeus had its systems accessed without authorisation between August 2023 and September 2026, exposing approximately 53,000 booking records — mainly booking references, passenger names, and flight details, with a small portion involving email addresses, telephone numbers, and travel documents; there is no evidence that financial or payment data was leaked. The Hong Kong Computer Emergency Response Coordination Centre (HKCERT) warns that real names and flight numbers make scams more convincing, noting that a retiree had already lost HK$1.2 million to fraudsters impersonating airline customer service. This is a typical supply-chain attack. Sources: South China Morning Post, Bastille Post, Channel NewsAsia (2026-10-30).
3. HA United Christian Hospital Breach: PCPD Finds Breach of the Privacy Ordinance and Serves Enforcement Notice (30 October) The PCPD published the findings of its investigation into the United Christian Hospital data breach, finding that the Hospital Authority had inadequate monitoring of its contractor's access and had failed to take all practicable steps to safeguard the security of personal data, thereby contravening Data Protection Principle 4(1) of the Personal Data (Privacy) Ordinance, and has served an enforcement notice. The incident affected 56,243 data subjects. The Hospital Authority said it now requires contractor personnel accessing systems on-site to be accompanied and logged by hospital IT staff. Source: Hong Kong Economic Times (2026-10-30/31).
4. "Black October" AI Supply-Chain Attacks Emerge; Cyber Insurance Faces "Silent AI" Challenge (October) In October, attackers targeted the tools and platforms sitting between enterprises and AI: the open-source AI gateway LiteLLM was implanted with credential-stealing code on 21 October, and ConnectWise, Railway, and others were subsequently compromised; Verizon's 2026 report notes that third-party-involved data breaches rose from 30% to 48%. Meanwhile, Aon's 2026 analysis estimates that over 90% of AI-related risk falls under "silent AI" coverage — policy wording neither expressly includes nor excludes it, creating claims uncertainty. Sources: Risk Ledger, BusinessWorld (2026-10).
The content of this column is provided for general information and educational purposes only, and does not constitute insurance, legal, or professional advice. Actual coverage is subject to the terms of individual policies.