27th October 2026 – (Hong Kong) An information-technology veteran says the matching scam calls that followed data-breach notices from Hong Kong Airlines, Yoho Hong Kong and Broadway Photo Supply look less like three separate company hacks than a typical supply-chain attack on a shared vendor.
The Privacy Commissioner’s office has confirmed it received personal-data breach notifications this month from the airline, the retailer and the electronics chain, covering more than 1,600 people’s details, and has opened an investigation. Francis Fong, honorary president of the Hong Kong Information Technology Federation, notes that customers of three firms in different trades were hit in the same late-September to October window with highly precise fraud calls.
According to his reading of the pattern, callers could recite names, flight numbers, ordered products and payment amounts. The pitch was the same shape in each case: impostors posing as customer service, citing a cancelled flight or a damaged parcel, then pressing for “refund verification”. That level of consistency, Fong argues, points away from each brand being cracked on its own and toward a hole in a common third-party customer-service, SMS or logistics notification platform that all three may use.
He frames that as a classic supply-chain compromise: steal once from the shared pipe, then harvest customers across unrelated shops and an airline. The public still hears three company names; the technical fault, on this view, may sit one layer down the vendor stack.