HKCERT: security incidents in the third quarter of 2026 rose about 15%, and phishing still made up about 60%

5 November 2026

The quarter in figures

The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) published its third-quarter figures on 5 November 2026. It recorded 4,404 security incidents, 565 more than the 3,839 incidents in the same quarter of 2025, a rise of about 15%.

Phishing remained the largest category, with 2,672 incidents, or about 61%. There were 729 botnet incidents (about 17%) and 469 incidents involving vulnerable systems (about 11%). The remaining 534 incidents (about 12%) included malware, denial-of-service attacks, website defacement, data leaks and unauthorised access.

Among phishing cases, those aimed at social media and instant messaging apps made up about 46%, ahead of banking, finance and e-payment (about 21%), technology firms (about 10%), e-commerce (about 9%) and cryptocurrency (about 8%).

A related warning in the same period

In the same article, HKCERT also cited police and media reports that, in mid-September 2026, the police received more than 700 reports of suspected credit-card misuse in a short period, with losses of about HK$14.7 million, and issued an alert about a specific phishing campaign.

What this means for smaller firms

Fake links in email, instant messages or social media are still the most common way in. An incident does not always begin with a virus. Often a member of staff clicks a link or hands over a login, and only then does an account get taken over, a payment get diverted, or a system get broken into.

Firms can start by reminding staff not to click unexpected links, by checking any request to pay or to log in, and by adding an extra step of verification to email and remote access.

This article is based on public reports and official statements. It is for general reference only, and is not legal advice. If you would like to discuss your own systems or security arrangements, please contact us.

Back to the blog