Hong Kong privacy watchdog investigates data breaches at Oxfam Hong Kong and ImagineX Group

The Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong has launched investigations into two significant data breaches, one involving Oxfam Hong Kong (OHK), a global organization dedicated to fighting poverty and inequality, and the other affecting ImagineX Group, a Hong Kong-based luxury retail and brand management company. These breaches have potentially compromised the personal information of nearly 600,000 individuals combined.

 

The investigation into Oxfam Hong Kong was triggered after the organization reported a cyberattack on July 10, 2024. The breach, which targeted multiple systems, including the Oxfam TrailWalker system, may have exposed the personal data of up to 470,000 individuals. The information at risk includes names, addresses, email addresses, mobile phone numbers, Hong Kong Identity Card (HKID) numbers, and payment details.

 

OHK has notified the affected individuals and is working with cybersecurity experts to determine the extent of the breach. In a statement, OHK emphasized that they are investigating whether any unauthorized disclosure of personal data occurred and pledged to take appropriate steps as more information becomes available. The incident has also been reported to the Hong Kong Police, the PCPD, and the Hong Kong Computer Emergency Response Coordination Centre.

 

The PCPD is also investigating a breach at ImagineX Group, reported on May 31, 2024. This breach potentially affected over 126,000 members and employees, including 100,000 members of the company’s ICARD program and 27,000 Brooks Brothers members. The compromised data may include names, email addresses, phone numbers, passport numbers or copies, dates of birth, gender, nationality, and photographs. ImagineX Group has informed all affected individuals about the breach, as confirmed in a press statement. The company has also guided individuals on steps to protect their data.