Hong Kong Consumer Council

The Hong Kong Consumer Council (HKCC) operates as a consumer protection organisation in Hong Kong. It provides a complaint hotline for residents to report issues with goods and services. The Council runs subscription services, including the publication of CHOICE magazine. It also maintains price comparison tools that help consumers evaluate product costs. Through these channels, HKCC offers advice and information to help consumers make informed decisions. Its activities are focused on the local market, serving individuals and households across Hong Kong. The organisation engages in public education campaigns about consumer rights and responsibilities. It collaborates with businesses and government agencies to address market practices. HKCC’s work aims to promote fair trading and improve product safety standards. These core functions define its role as a key consumer advocacy body in the region.

The Council’s reach is reflected in its CHOICE magazine, which had approximately 8,000 subscribers at the time of the 2023 incident. In September 2023, HKCC experienced a ransomware attack that encrypted about 80 % of its computer systems. The disruption affected its complaint hotline, subscription services, and price comparison tools. Attackers exfiltrated an estimated 65 GB of data, including staff HKID numbers, family member details, credit‑card information of subscribers, and job‑applicant records. The organisation refused a $500,000 ransom demand and enlisted forensic experts to investigate. It notified the police and the Privacy Commissioner for Personal Data, and began restoring services while repairing its email system. The incident occurred amid broader cybersecurity concerns in Hong Kong, prompting institutional reviews across the sector. These events highlight HKCC’s reliance on digital infrastructure for delivering consumer services. Despite the attack, the Council continued to fulfill its mandate of protecting consumer interests. Its commitment to transparency and accountability was demonstrated through public disclosure of the breach and cooperation with authorities.