Hong Kong data breaches: Hong Kong Airlines, Cathay Pacific, Malaysia Airlines, Yoho, Broadway under PCPD investigation
Severity: medium · Patch status: no-fix-needed · Since 2026-11-02
Hong Kong's Office of the Privacy Commissioner for Personal Data (PCPD) is investigating a cluster of data breach notifications involving Hong Kong Airlines, Cathay Pacific, Malaysia Airlines, and electronics retailers Yoho Hong Kong and Broadway. As of 30 October 2026 the regulator had logged 51 complaints and 48 enquiries tied to these incidents. The sources do not state the attack vector, number of affected individuals, or data types exposed. Affected customers of the named airlines and retailers may face phishing and credential-theft risk; the PCPD investigation is ongoing and no remediation details are available.
What to do
- Customers of the named airlines and retailers should watch for phishing emails and unsolicited contact referencing their bookings or orders
- Monitor accounts and payment statements for unauthorised activity; enable MFA where offered
- Avoid reusing passwords across airline/retail accounts
- Organisations should review third-party and customer-data handling practices in light of the PCPD's active enforcement scrutiny
Sources
All live incidents on Threat Watch
