Cyber Incident Victim: Hongkong Post
Date:
Jul 2025
Location:
Hong Kong
Summary
Hongkong Post reported a cyberattack involving robotic access to the address books of its EC‑Ship account holders, which may have exposed senders’ and recipients’ names, addresses, phone numbers, fax numbers and email addresses. Upon detection, the unauthorized access was blocked and the incident was reported to police, the Digital Policy Office, the Office of the Privacy Commissioner for Personal Data and the Security Bureau. The EC‑Ship service has been restored to normal operation while investigations continue to determine the number of affected accounts and whether any personal data was leaked. It said it is seeking advice from the Digital Policy Office and will strengthen its system security measures.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Hongkong Post reported an information security incident involving robotic access to information in the address books of its EC-Ship account holders. The organisation condemned the attack and stressed that it would work closely with the Police on the investigation. Upon identifying the incident, Hongkong Post took immediate measures to block the unauthorised access. It followed established guidelines and reported the case to the Police, the Digital Policy Office, the Office of the Privacy Commissioner for Personal Data, and the Security Bureau on the same day. The EC-Ship service has resumed normal operation.
Based on a preliminary assessment, Hongkong Post said the incident could involve information in the address books of EC-Ship account holders, including senders’ and recipients’ names, addresses, phone numbers, fax numbers and email addresses. Investigations are ongoing to ascertain the number of account holders affected and whether any personal data leakage is involved. Hongkong Post stated that it will inform affected account holders when further updates become available. The service is seeking advice from the Digital Policy Office to assist with its investigations and will further strengthen system security measures. Hongkong Post reiterated that it does not send embedded hyperlinks via emails, SMS messages or social media pages for the collection of personal information or requesting payment. For enquiries, the public may call 2921 2222.