Chow Sang Sang Group said in a statement on November 12 that it had identified unauthorised access to parts of its systems on November 9. The affected systems included its membership system and official e-commerce channels. Member and employee information might be involved.
The potentially involved member data includes names, telephone numbers, email addresses, some order information and the last four digits of payment-card numbers. Possible employee data includes names, job titles, company email addresses and telephone numbers.
The company said it was still verifying whether any customer or employee information had been extracted. The privacy commissioner’s office said it had received a notification and was investigating; the number of people affected was still being confirmed.
Chow Sang Sang said it had taken steps to stop malicious access and strengthen system security, and had engaged cybersecurity experts to investigate and advise on measures. It was notifying potentially affected customers and employees.
The company urged customers to be alert to calls, texts or emails impersonating Chow Sang Sang, financial institutions or electronic-payment platforms. It advised them not to click unfamiliar links or disclose card details, verification codes, passwords or other sensitive personal information.