Hong Kong Police Neutralised Over 40,000 Vulnerabilities in First Three Quarters; Cathay Caught Up in Asian Airline Breach; Cowbell Launches AI Liability Insurance — Daily AI and Cyber Risk Summary

In a nutshell: Hong Kong's first-three-quarter cyber security operation data is out, the Asian aviation industry sees another large-scale breach affecting Cathay, and AI liability insurance products are successively coming to market globally.

I. Hong Kong's First Three Quarters Cyber Security Situation and Calls for AI Fraud Regulation Hong Kong Commercial Daily published a commentary on 10 November 2026, citing police data: in the first nine months of 2026, cyber threat intelligence targeting Hong Kong reached 1.3 million items, up 32% year-on-year, averaging as high as 4,650 items per day; although the number of technology crime cases and losses fell by over 10% year-on-year, online fraud and AI automated attack threats are tightening. The commentary also cited a report by the global anti-fraud agency Sumsub, noting that deepfake-related cases in Hong Kong surged 147% year-on-year last year. The article urged authorities to act "fast, accurate, and tough" in legislation, law enforcement, and defence, and mentioned that in the first nine months the police helped remediate over 44,000 vulnerabilities and cleared over 63,000 online threats; INTERPOL's first AI-driven "Operation Swift Strike" adopted the RAPID analytics engine developed by the Hong Kong Police, taking down or blocking over 51,000 phishing links in its first phase. (Source: Hong Kong Commercial Daily, 2026-11-10)

II. Asian Aviation Industry Breach Affects Cathay Thai Airways reported on 9 November 2026 that about 60,529 passenger booking records may have been accessed without authorisation via its reservation system provider Amadeus. The Civil Aviation Authority of Thailand (CAAT) subsequently confirmed that six other Asian airlines were affected by similar incidents, including Cathay Pacific, All Nippon Airways (ANA), Asiana Airlines, Japan Airlines, Malaysia Airlines, and Singapore Airlines. The data involved included names, booking references, itineraries, and some passport and contact details. Thailand's Ministry of Transport has ordered aviation entities to strengthen cyber security. (Source: The Straits Times, 2026-11-09/10)

III. GovCERT.HK Issues High-Threat Alert on SonicWall Vulnerabilities The Government Computer Emergency Response Team (GovCERT.HK) issued a high-threat alert (reference A26-11-11) on multiple SonicWall SonicOS vulnerabilities, noting that organisations using the relevant boundary devices should upgrade firmware as soon as possible, restrict exposure of SSL VPN and management interfaces, and monitor anomalous connections. The alert echoes a concurrent announcement by France's CERT-FR, highlighting the urgency of boundary device patching. (Source: Enigma Global Daily Threat Intelligence Summary, 2026-11-09)

IV. Check Point Exposes Shared Spyware Toolkit Affecting Hong Kong Check Point Research published on 10 November 2026 a year-long investigation showing that a supplier named CopperDragon provided the same "Sparrow" spyware toolkit to multiple China-linked hacker groups, involving three operations — SilentDelivery, OceanGate, and DarkWire — with targets including telecoms, government, military, and critical infrastructure. SilentDelivery implanted malware via water-holing attacks, with infected websites distributed across the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, and Indonesia. (Source: Check Point Research / The LaymanSecurity, 2026-11-10)

V. Cowbell Launches AI Liability Insurance US cyber insurer Cowbell announced on 10 November 2026 the launch of Cowbell AI Liability Insurance, a standalone policy for SMEs deploying AI agents in customer service, payments, and core operations, triggered by an "AI incident" and covering scenarios such as tool overreach, unauthorised data leakage, and inaccurate or unsafe output, to be offered through wholesale brokers from 1 January 2027. This reflects underwriters building dedicated coverage for agentic AI risk. (Source: Unite.AI / Cowbell, 2026-11-10)

The content of this column is provided for general information and educational purposes only, and does not constitute insurance, legal, or professional advice. Actual coverage is subject to the terms of individual policies.