hong kong
SOGO Hong Kong member data breach may affect about 820,000 members
Hong Kong department store SOGO has confirmed a data breach in its membership system, with the privacy regulator estimating that personal data of about 820,000 members may be affected. On the same day, jeweller Chow Sang Sang disclosed unauthorised access to its own systems.
Key takeaways
- Unauthorised parties obtained SOGO member numbers, names, phone numbers, emails and points data.
- The PCPD says about 820,000 members may be affected and is investigating.
- According to the PCPD's preliminary information, SOGO found abnormal data access on 5 November.
- SOGO urges members not to click unknown links or share details with anyone claiming to represent it.
Why it matters
For members, leaked names, phone numbers and emails are enough to fuel scam calls and texts impersonating the retailer, so verify any contact claiming to be from SOGO through official channels. For retailers, loyalty systems concentrate large amounts of personal data, and a breach puts customer trust at stake.
What happened
RTHK reported that SOGO (Hong Kong) said it discovered this month that unauthorised parties had obtained some data from its membership system. The affected data mainly involves some member numbers, names, contact phone numbers, email addresses and membership points information. SOGO said it had launched a full investigation, notified the relevant government departments and was cooperating fully.
Sing Tao, citing the Office of the Privacy Commissioner for Personal Data (PCPD), reported that preliminary information shows SOGO found abnormal data-reading records in its membership system on 5 November. The PCPD received the notification on 12 November, said the incident may affect the personal data of about 820,000 members, including names, email addresses, phone numbers and points balances, and has opened an investigation. The South China Morning Post describes SOGO as Hong Kong's largest department store.
SOGO's response
SOGO apologised for any inconvenience to members and said it had taken several measures: strengthening network security monitoring and detection of unusual activity, carrying out a detailed investigation and risk assessment, and continuing to monitor its systems to prevent a recurrence.
According to Ta Kung Pao, SOGO reminded members to stay alert, not to click unknown links, and not to disclose personal, account or verification information to anyone who calls, texts or emails claiming to represent the company.
A second breach the same day
Ta Kung Pao and the South China Morning Post also reported that Chow Sang Sang disclosed unauthorised access to its systems, with some customer and staff data possibly extracted. The affected systems include its membership system and official e-commerce channels. The group has notified the PCPD and police and is contacting customers and staff who may be affected.
Background
Hong Kong's Personal Data (Privacy) Ordinance is enforced by the PCPD, which opens an investigation under its established mechanism when it receives a breach notification. Retail loyalty programmes typically hold names, contact details and points balances, which makes them common targets.
What to watch
- The outcome of the PCPD investigation and any fuller disclosure from SOGO on the scope.
- Whether SOGO notifies affected members individually.
- Whether scams impersonating SOGO appear in the coming weeks.
Sources
Questions
What data was exposed in the SOGO breach?
According to SOGO and the PCPD, member numbers, names, phone numbers, email addresses and membership points information may be involved. Reports do not mention payment card data.
How many SOGO members are affected?
The Privacy Commissioner for Personal Data says the incident may affect the personal data of about 820,000 members.
What should SOGO members do now?
Do not click unknown links, and do not share personal, account or verification details with callers, texts or emails claiming to be SOGO. Verify through official channels.
