2,000 customers of Hong Kong Airlines, 2 appliance shops, get scam calls after data breach

Almost 2,000 customers of Hong Kong Airlines and two electronic appliance retailers received fraudulent calls after their personal information was leaked by the companies, the city’s privacy watchdog has found.

The Office of the Privacy Commissioner for Personal Data (PCPD) said on Monday that it had received more than 40 inquiries and complaints linked to the suspected data leaks involving Hong Kong Airlines and the electronic appliance retailers Yoho and Broadway.

“We have initiated an investigation into the aforementioned incident in accordance with established procedures,” a spokesman for the watchdog said.

The office said it was first notified by Hong Kong Airlines of the data breach on October 2. Preliminary findings showed 815 passengers departing between September 29 and October 22 received suspected scam calls, with leaked data including passenger names, phone numbers, flight dates, flight numbers and travel routes.

Yoho submitted a separate notification earlier this month.

Initial inquiries revealed that 790 customers who placed orders with Yoho between September 29 and October 12 had received fraudulent calls, with compromised details potentially including names, contact numbers, delivery addresses, order IDs and purchase records, the watchdog said.

The office was also contacted by Broadway on Monday. The retailer said customers had received suspected scam calls after a data breach that may have included names, phone numbers, purchased items and transaction amounts.

The watchdog received a total of 23 complaints and 20 inquiries over the three incidents.

It reminded customers who received calls from individuals claiming to represent merchants to verify the caller’s identity through official channels and to stay alert to fraud alerts issued by businesses.

The watchdog reminded the public never to disclose sensitive information, such as online banking account numbers and passwords, to others.

A South China Morning Post reporter, Fiona Chow, also received a fraudulent call on October 7 after making a purchase on Yoho.

The caller claimed her parcel had been lost in transit but that it was covered by insurance, promising a full refund on the product along with an additional HK$300 (US$38) in compensation.

But Chow was instructed to contact a WhatsApp number to file the claim.

On the same day, she also received a notice from Yoho warning that several customers who had placed orders between September 29 and October 6 had reported receiving scam calls.

According to the retailer, fraudsters impersonating customer service agents from Yoho or delivery companies such as SF Express had approached buyers.

The callers cited legitimate purchase records and personal details, using pretexts such as damaged parcel compensation or refunds to solicit bank account information or trick victims into clicking fraudulent WhatsApp links.

Francis Fong Po-kiu, honorary president of the Hong Kong Information Technology Federation, said customers of three separate companies from different sectors were hit by scam calls during the exact same window between late September and October.

“This uniform pattern indicates that individual company breaches are unlikely. Instead, a shared third-party vendor handling customer service, SMS alerts, or logistics notifications was almost certainly compromised in a classic supply chain attack,” he said.