Hong Kong Airlines, UoU and Broadway: after a data leak, customers received scam calls that used real order or flight details

27 October 2026

The three merchant reports

In October 2026, the Office of the Privacy Commissioner for Personal Data received data-breach reports from Hong Kong Airlines Limited, UoU Hong Kong Limited and Broadway Photo Supply Ltd. According to what the Office told the media, the data of at least about 1,600 people was affected, and an investigation had begun.

The Office said it received Hong Kong Airlines’ report on 2 October. Preliminary information showed that 815 passengers who departed between 29 September and 22 October had received suspected scam calls. The data involved may have included names, telephone numbers, flight dates, flight numbers and routes.

The Office received UoU Hong Kong’s report on 5 October. Preliminary information showed that 790 customers who placed orders between 29 September and 12 October had received suspected scam calls. The data involved may have included names, telephone numbers, delivery addresses, order numbers and details of the products purchased.

The Office received Broadway’s report on 26 October, saying customers had received suspected scam calls. The data involved may have included names, telephone numbers, products purchased and payment amounts. At that time the Office did not publish the number of people affected at that company. As of 26 October, the Office had received 23 complaints and 20 enquiries about these incidents.

Later reports, including in Ming Pao, said some victims received calls that accurately stated flight details and were led to transfer money, and that some cases involved losses of more than a million dollars. The three companies had not then publicly explained the cause, and the investigation was still under way.

Another public incident in the same period

The Hong Kong Examinations and Assessment Authority announced on 30 October 2026 that the personal data of about 16,900 people living on the mainland, who had applied for two international examinations, had been leaked. The data included names, dates of birth and email addresses. The Authority had reported the matter to the police and the Privacy Commissioner, and said there was then no evidence that the Hong Kong Diploma of Secondary Education Examination, or the systems used for most other examinations, had been affected.

What this means for smaller firms

Once customer data is leaked, scammers can telephone people using real order, flight or personal details, which makes the call sound more believable. Even if the caller can recite those details, a business handling a refund or compensation does not usually ask a customer to transfer money first, or to hand over online banking details or passwords.

Firms should review which systems hold customer data, whether contractors, logistics firms or contact centres also hold the same data, and how affected people will be told, and the Privacy Commissioner notified, if a leak is suspected.

This article is based on public reports and official statements. It is for general reference only, and is not legal advice. If you would like to discuss your own systems or security arrangements, please contact us.

Back to the blog