820,000 Sogo members at risk as department store, Chow Sang Sang hit by data breaches

Major Hong Kong retailers Sogo and Chow Sang Sang have disclosed separate data breaches after unauthorised parties accessed their systems, potentially exposing the personal information of customers, including that of up to 820,000 Sogo loyalty members.

The Office of the Privacy Commissioner for Personal Data disclosed the Sogo figures on Thursday, hours after Hong Kong’s largest department store announced it had alerted authorities a week earlier to abnormal data access within its membership system.

Preliminary findings indicate that compromised records may include members’ names, email addresses, phone numbers and membership point balances, prompting the regulator to launch a formal investigation.

In a separate statement earlier in the day, Sogo Hong Kong Company said it had discovered this month that unauthorised parties had accessed its membership system and obtained records including member numbers, names, phone numbers, email addresses and point balances. It did not disclose the scale of the incident.

The company said it had notified the relevant regulatory and government authorities, launched a comprehensive investigation, and stepped up cybersecurity monitoring to prevent a recurrence.

It urged its members to stay vigilant against phishing scams, avoid clicking unknown links, and refrain from sharing personal or account details with suspicious callers or senders.

Customers can verify inquiries via Sogo’s hotline at [phone] or email [e-mail], and should report suspected fraud to the police, it said.

“The company sincerely apologises for any inconvenience or concern this incident may cause to our members, and will continue to implement all reasonable and appropriate measures to strengthen system security and safeguard customer data,” it added.

Meanwhile, local jewellery chain Chow Sang Sang also disclosed a separate data breach on Thursday, revealing that unauthorised parties had accessed its systems in an incident first identified on November 9.

According to a press release issued by Chow Sang Sang Holdings International, the breach may have compromised the personal data of both customers and employees.

Potentially affected customer records include names, contact numbers, email addresses, partial order details and the last four digits of credit card numbers, while exposed employee information may include names, job titles, corporate email addresses and contact numbers.

The jeweller said it had contained the malicious access, engaged cybersecurity experts to investigate, and reported the incident to both the privacy watchdog and police.

Chow Sang Sang added that it was notifying potentially affected customers and urged the public to remain vigilant against phishing scams impersonating the company, financial institutions or e-payment platforms.

It advised customers to verify suspicious contacts via its hotline at [phone] or email at [e-mail].

The privacy watchdog said it had received a data breach notification from Chow Sang Sang on Thursday, adding the company was still verifying the number of people affected. It launched an investigation under its established procedures. -- SOUTH CHINA MORNING POST