The Office of the Privacy Commissioner for Personal Data, Hong Kong said it had received data-breach incident reports from Hong Kong Airlines Limited, Yoho Hong Kong Limited and Broadway Photo Supply Limited after customers received suspected scam calls. The office said it had begun investigating the three incidents.
The office’s preliminary figures showed that 815 Hong Kong Airlines passengers who departed between 29 September and 22 October received suspected calls. Potentially affected details included names, phone numbers, flight dates, flight numbers and routes. It said 790 Yoho customers who ordered between 29 September and 12 October also received suspected calls; information that may have been affected included names, phone numbers, delivery addresses, order numbers and product details. Broadway reported suspected calls and said names, phone numbers, products bought and payment amounts might be involved. The office gave no number for Broadway customers. By 26 October, it had received 23 complaints and 20 inquiries about the incidents.
A Broadway customer wrote on social media that about an hour after an air fryer was delivered, her husband received a call from someone claiming to work for the retailer. The caller said the product needed to be recalled and asked for personal details to arrange a refund. The husband checked with Broadway and was told there was no recall.
In another account reported by HK01, a customer who bought an in-stock hair dryer in a Yoho shop on 7 October said a caller claiming to be from the retailer’s logistics department rang the next day. The caller alleged the plug had been damaged in delivery and asked the customer to verify details and provide an account for a refund. The customer said the purchase had required no delivery.
The privacy office advises people to verify merchant calls through the business’s official website, customer-service hotline or a shop, even if the caller knows personal details. It also advises rejecting requests for advance fees or transfers to verify a bank account, and not disclosing online-banking details or passwords.