Police figures for the first three quarters of 2026: ransomware cases rose, and remote desktop and website flaws need patching

9 November 2026

What the police reported

According to reports in HK01 and Hong Kong Commercial Daily, the Police Cyber Security and Technology Crime Bureau said there were 21,573 technology crimes from January to September 2026, about 11.5% fewer than in the same period last year. Losses were about HK$3.897 billion, down about 15% from about HK$4.591 billion a year earlier. About 80% of the cases involved internet fraud.

For cases aimed at large organisations, there were 29 system intrusion cases in the first nine months, down from 37 in the same period last year. Ransomware cases rose from 34 to 40.

Remote desktop and website systems were singled out

The reports said the police had found about 44,000 high-risk cybersecurity weaknesses in the first nine months. About 37,950 were related to the Remote Desktop Protocol (RDP), and about 6,083 involved website systems built with PHP. Police warned that if a system has a weakness and is not updated in time, attackers may break into a company website, take data, or spread malicious software.

The reports also said 65 schools were found to be using outdated firewall firmware, which created a risk of intrusion. Police had contacted those schools and offered help with updates and patches.

What this means for smaller firms

Ransomware often encrypts files and stops computers or servers from working normally, so the business comes to a halt. This is what many owners mean when they say a company has been hit by a virus and the system will not start.

Remote desktop services that are exposed directly to the internet, and website systems (including older PHP sites) that have not been updated, are common ways in. Firms can start by checking whether remote access really needs to be open to the internet, whether firewalls and websites have been updated, and whether there is a backup that ransomware cannot reach, so work can be restored if something goes wrong.

This article is based on public reports and official statements. It is for general reference only, and is not legal advice. If you would like to discuss your own systems or security arrangements, please contact us.

Back to the blog