Hongkong Post

Summary

Hongkong Post reported a cyberattack involving unauthorized robotic access to address book information of its EC-Ship account holders. Upon detection, it blocked the access, notified police, the Digital Policy Office, the Office of the Privacy Commissioner for Personal Data, and the Security Bureau, and said the EC-Ship service has returned to normal operation. A preliminary assessment indicated that the accessed data could include senders' and recipients' names, addresses, phone numbers, fax numbers, and email addresses. Investigations are underway to determine how many account holders were affected and whether any personal data was leaked. The organization is seeking advice from the Digital Policy Office and plans to enhance its system security measures.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Hongkong Post reported an information security incident involving robotic access to information in the address books of its EC‑Ship account holders. Upon identifying the incident, the organisation took immediate measures to block the unauthorised access. It followed established guidelines and reported the case to the Police, the Digital Policy Office, the Office of the Privacy Commissioner for Personal Data and the Security Bureau on the same day. Hongkong Post condemned the attack and stated that it would work closely with the Police on the investigation. The EC‑Ship service was restored to normal operation after the containment actions were completed.

Based on a preliminary assessment, the incident could involve information in the address books of EC‑Ship account holders, including senders’ and recipients’ names, addresses, phone numbers, fax numbers and email addresses. Investigations are ongoing to ascertain the number of account holders affected and whether any personal data leakage occurred. Hongkong Post said that, when further updates are available, it will inform the affected account holders. The organisation is seeking advice from the Digital Policy Office to assist with its investigations and will further strengthen its system security measures. Hongkong Post reiterated that it does not send embedded hyperlinks via emails, SMS messages or social media pages for the collection of personal information or requesting payment. Citizens are advised to refrain from clicking on any embedded links or providing any personal or financial data, and from making payments via suspicious emails or SMS messages alleged to be sent by Hongkong Post. For enquiries, the public can call 2921 2222.

Sources

Sources available to members: 1 source.