Cyber Exercise First to Include Private Enterprises; AI Liability Insurance Debuts — Daily AI and Cyber Risk Summary

In a nutshell: Hong Kong is stepping up cyber defence drills and mainland China's AI liability insurance has officially launched, signalling that "transferring AI and cyber risk through insurance" is moving from concept to practice.

I. Hong Kong Cyber Defence Exercise 2026 Concludes Successfully, First to Include Private Enterprises. The third Hong Kong Cyber Security Defence Exercise, organised by the Digital Policy Office, was held from 29 to 31 October, significantly larger than last year: a total of 51 blue teams defended 28 government departments, 23 public bodies, and — for the first time — private enterprises, against 23 red teams simulating attacks, with over 80 organisations sending observers. This marks the extension of Hong Kong's cyber defence from government and public bodies further into the private sector. (Source: China Daily Asia, 2026-10-31)

II. PCPD Receives 51 Complaints Over a String of Breaches. In response to recent incidents involving Hong Kong Airlines, YOHO Hong Kong, Broadway, Cathay Pacific (about 53,000 bookings leaked via third-party vendor Amadeus), and the Hong Kong Examinations and Assessment Authority (about 16,900 mainland candidates' data leaked), the Office of the Privacy Commissioner for Personal Data replied to enquiries stating that it had received a total of 51 complaints and 48 enquiries and had launched an investigation; the combined number of affected individuals exceeds 71,000. Experts note that AI has shortened the time hackers need to write attack tools from days to a single day, and that enterprises must harness AI to strengthen defence and confront outsourced-vendor risk. (Source: Dotdotnews relaying Ta Kung Pao, 2026-11-01)

III. Mainland China's AI Liability Insurance Officially Launches. At the 2026 Financial Street Forum Annual Conference, PICC Property and Casualty launched a comprehensive AI application risk protection scheme; a Shenzhen enterprise has taken out "AI system generated-content infringement liability insurance" with coverage exceeding one million yuan, and a Hangzhou AI agent has also introduced dedicated insurance. Reports indicate that in 2025 the scale of mainland China's core AI industry exceeded RMB 1.2 trillion, with growth in 2026 projected to exceed 30%; in September, the Supreme People's Court clarified that generative-AI infringement cannot be excused on the grounds that "it was generated by AI". (Sources: Economic Daily / China Economic Net, 2026-11-02)

IV. "Black October" Technical Vulnerabilities Draw Insurance Market's Attention to Directors' Liabilities. The industry uses "Black October" to describe the recent spate of cyber security incidents; on the technical front, the PHP2Shell vulnerability in PHP itself, a vulnerability in the curl library, and the tampering of the AI gateway LiteLLM on PyPI appeared in succession. AM Best describes PHP2Shell as a systemic scenario long feared by the insurance industry, warning that related legal liabilities could reach directors and senior management (D&O). (Source: CyberSecurity Institute CISO Brief, 2026-11-01)

The content of this column is provided for general information and educational purposes only, and does not constitute insurance, legal, or professional advice. Actual coverage is subject to the terms of individual policies.