SOGO Leaks Data of 820,000 Members; Chow Sang Sang Suffers Unauthorised Access — Daily AI and Cyber Risk Summary

In a nutshell: Two major Hong Kong retail groups disclosed data security incidents on the same day, with the Privacy Commissioner formally launching an investigation, highlighting the urgency of corporate cyber defence and data protection.

Hong Kong Retail Sector Hit by Consecutive Leaks; Commissioner Launches Investigation. Hong Kong's SOGO department store discovered on 5 November that unauthorised parties had obtained some data from its membership system, involving personal data of up to 820,000 members, including names, emails, phones, and loyalty point balances. The Office of the Privacy Commissioner for Personal Data (PCPD) announced the figures on 12 November and formally launched an investigation (Ming Pao, The Standard, 2026-11-12). On the same day, the Chow Sang Sang Group (00116.HK) announced on the Hong Kong Stock Exchange that it first identified unauthorised access to its systems on 9 November, affecting its membership system and official e-commerce channels, with some customer and employee data potentially extracted; it has reported to the PCPD and the Hong Kong Police (Chow Sang Sang HKEX announcement, The Paper, 2026-11-12).

International Insurance Regulatory Conference in Hong Kong Focuses on Interconnected Risk. The International Association of Insurance Supervisors (IAIS) 2026 Annual Conference was held in Hong Kong on 12 November, with over 600 global regulators and industry representatives attending, under the theme "The Insurance Sector in an Era of Interconnected Risk". The Vice Chair of the IAIS Executive Committee noted that adopting frontier AI models makes cyber risk more complex, and that insurers are both underwriters and potential victims of operational disruption (Xinhua, Bastille Post, 2026-11-12).

Five US AI Giants Sued. On 12 November local time, four non-profit organisations filed a lawsuit in the San Francisco Superior Court, naming OpenAI, Anthropic, Google, Meta, and SpaceX's AI business as defendants, seeking to halt their development of advanced AI models, citing cases of AI systems participating in cyber attacks (Associated Press via Chinanews, Tencent News, 2026-11-13).

Cyber Insurance Demand Coexists with Gaps. Chubb's 2026 Mid-Market Risk Report shows that over 90% of mid-market enterprises in the UK and Ireland experienced a major disruption event in the past three years, with cyber security their top concern (70%), yet only 36% have cyber insurance reviewed on a regular basis; average cyber claim amounts for European and UK mid-market enterprises tripled between 2020 and 2025 (CIR Magazine, Insurance Business, 2026-11-12).

Taiwan's FSC Uses AI Against AI. On 12 November, Taiwan's Financial Supervisory Commission held a financial-sector chief information security officer conference, and in response to rising AI cyber attacks proposed four directions: implementing cyber security fundamentals, dynamically prioritising vulnerability patching, and prudently adopting defensive AI (Central News Agency, 2026-11-12).

The content of this column is provided for general information and educational purposes only, and does not constitute insurance, legal, or professional advice. Actual coverage is subject to the terms of individual policies.