HKCERT Warns Public and SMEs of Rising Risks in Recent Data Breach Incidents

(Hong Kong, 17 October 2025) A recent social engineering attack on a Qantas Airways third-party service platform has compromised the personal data of 5.7 million customers, including approximately 20,000 in Hong Kong. The leaked information includes names, phone numbers, and addresses, exposing affected individuals to heightened risks of phishing and fraud. The incident has been reported to the Office of the Privacy Commissioner for Personal Data (PCPD), which has launched an investigation.

Hackers Leaked Personal Data of 5.7 million users onto the Dark Web

Hackers accessed Qantas' customer data through a customer service centre in the Philippines operated by a third-party service provider, using social engineering techniques such as vishing to deceive the provider's staff into granting access. The incident highlights the increasing risk of supply chain attacks, where hackers exploit vulnerabilities in third-party service providers to use them as a springboard to attack larger organisations. Even SMEs, if they neglect their own cybersecurity, could become critical vulnerabilities in cyberattack incidents.

In this context, recent events further highlight the critical need to enhance cybersecurity measures, both for SMEs and external service providers. The Vegetable Marketing Organization in Hong Kong had recently suffered a ransomware attack on some of its computer systems, and this incident has led to the risk of data leakage for users of its wholesale market. Meanwhile, cybersecurity vendor F5 recently announced that its internal systems were subjected to a long-term persistent cyberattack in August, during which hackers stole source code for its products and undisclosed system vulnerabilities. Using this leaked information, the hackers may plan attacks against users who are employing F5’s products.

These cases underscore the risks associated with third-party service providers and the importance of enhancing cybersecurity measures. Given the scale and potential threat of the incidents, the Hong Kong Computer Emergency Response Team Coordination Centre(HKCERT) advise users and SMEs to adopt the following measures to prevent third-party risks and enhance their cybersecurity:

1. Beware of Phishing Attack
   Always verify email senders and avoid clicking on any suspicious links. Be cautious of urgent or unusual requests, and if possible, to report suspicious messages to your IT or security team immediately. For more details, please visit https://www.hkcert.org/publications/all-out-anti-phishing
    
2. Enable multi-factor authentication to enhance account security
   Implement multi-factor authentication requiring users to enter verification codes or additional authorisation to log in and educate users not to share the verification code with others. This prevents account theft if the users accidentally disclose their password.
    
3. Be cautious when using freeware and open-source projects
   While freeware and open-source tools can be cost-effective, they may introduce vulnerabilities if not properly vetted. Only use trusted software from reputable sources and conduct security reviews before deployment.
    
4. Regular security update
   Keep all systems, applications, and devices updated with the latest security patches. Regular updates help close vulnerabilities before attackers can exploit them.
    
5. Raise social engineering awareness
   Social engineering remains a common attack vector. Provide frequent training to employees on recognising and resisting phishing attempts, suspicious phone calls, and other manipulation tactics. This can significantly reduce the likelihood of human error leading to a breach.
    

Four Key Measures to Secure Your Data 
Qantas has confirmed that the incident did not involve customers’ financial data, passport information, or account passwords. However, the leakage of sensitive personal data onto the dark web may lead to risks such as identity theft, phishing attacks, and other fraudulent activities. HKCERT emphasises that proactive protection of personal data is essential and urges affected individuals to take the following steps:

1. Regularly Monitor Accounts
   Check your email, phone, and financial accounts regularly for suspicious activity. If you detect unauthorised transactions or unusual activity, report them immediately to the relevant organisation.
    
2. Beware of Phishing Attacks
   Be cautious of emails, phone calls, or messages claiming to be from Qantas or related organisations. Avoid clicking suspicious links and handle suspicious emails, messages, and calls carefully. Never provide personal or login information without verification.
    
3. Enable Multi-Factor Authentication (MFA)
   Add MFA to key accounts to increase security. Never share verification codes with others.
    
4. Regularly Change Passwords
   Change passwords for all important accounts regularly and avoid using the same password across multiple accounts. 
    

For more information, please visit:

1. https://www.hkcert.org/blog/the-hidden-dangers-of-third-party-risk-lessons-from-the-recent-data-breaches
2. https://www.hkcert.org/blog/16-billion-account-passwords-leaked-worldwide-hkcert-urges-users-to-review-account-security-and-stay-vigilant
3. https://www.hkcert.org/blog/beware-of-cyber-attack-protect-personal-information
    

Join Now! Cyber Security Summit Hong Kong 2025

Jointly organised by the Hong Kong Productivity Council, HKCERT and 10+ other leading information security organisations, the “Cyber Security Summit Hong Kong 2025” will be held from 6 to 7 November at HKCEC with the theme "Future-Proofing Digital Infrastructure: Harnessing AI for Enhanced Security and Resilience". Through an array of engaging speaking sessions, the Summit will delve into how the integration of AI and state-of-the-art cyber security technologies can bolster digital infrastructure against cyber threats.

The Summit will feature a distinguished lineup of speakers, including Ir. Tony Wong from Digital Policy Office, Ms. Ada Chung Lai-ling from Office of the Privacy Commissioner for Personal Data, Mr. Chan Wing On, Francis from the Security Bureau, and Ms. Rachel Hui from Cyber Security and Technology Crime Bureau at the Hong Kong Police (HKP). You will have the opportunity to network and exchange ideas with the expert speakers, and gain valuable insights. Register now for FREE: https://www.cssummit.hk/registration/

- Ends -