Sogo Hong Kong has confirmed that unauthorized parties took data from its membership system, and Hong Kong’s privacy regulator says the breach may affect about 820,000 members. On the same day, jewelry retailer Chow Sang Sang disclosed a separate attack on its membership system and online store that may have exposed customer and employee information.
The Office of the Privacy Commissioner for Personal Data (PCPD) said it received Sogo’s data breach notification on November 12, 2026, and has opened an investigation into both incidents.
What Sogo has confirmed
Sogo (Hong Kong) Company Limited, which runs the Sogo department stores in Causeway Bay and Tsim Sha Tsui, said it found in November that unauthorized people had obtained some data from its membership system. In a statement carried by RTHK, the retailer said the affected data mainly covers some members’:
- Membership numbers
- Names
- Contact phone numbers
- Email addresses
- Membership points information
Sogo said it launched a full investigation, notified the relevant government departments and is cooperating with the authorities. It also said it has stepped up cybersecurity monitoring and abnormal activity detection, and is carrying out a detailed risk assessment. It also warned members not to share personal, account or verification details with anyone claiming to be from Sogo.
Sogo has not said how the attackers got in or whether a ransom was demanded. Its statement does not mention card numbers or passwords.
Regulator puts the count at 820,000
Sogo did not give a number of affected members. The figure came from the PCPD, which said preliminary information shows Sogo spotted abnormal data reading records in its membership system on November 5. The regulator said the incident may affect the personal data of about 820,000 members, possibly including names, email addresses, phone numbers and membership points balances, according to reports.
That puts about a week between Sogo detecting the suspicious activity and the privacy regulator receiving its notification. Reports say Sogo alerted authorities shortly after it found the problem, but the company has not published a timeline of who it notified and when.
Chow Sang Sang reports a separate attack
Chow Sang Sang Holdings International, which is listed on the Hong Kong stock exchange under stock code 116, disclosed its own incident in an inside information announcement on November 12. The group said it detected unauthorized access to its systems, first identified on November 9, “with potential extraction of customer and employee information.”
According to the filing, the affected systems include the group’s membership system and official e-commerce channels. Chow Sang Sang said certain customer and employee information, including personal data, “was accessed and may have been extracted, subject to verification.” It has contained the access, hired outside cybersecurity experts and reported the incident to the PCPD and the Hong Kong Police Force. It is notifying people who may be affected.
In a separate public statement, the company said the customer data that may be involved includes:
- Member names
- Contact phone numbers
- Email addresses
- Some order details
- The last 4 digits of credit card numbers
Employee data that may be involved includes names, job titles, company email addresses and contact numbers. The PCPD said Chow Sang Sang is still confirming how many people are affected. On November 12, the company’s eShop at chowsangsang.com showed only an “under maintenance” page.
Neither company has linked the two incidents, and there is no public sign that they are connected. No ransomware or extortion group had publicly claimed either attack at time of publication.
Why this data still matters
Neither breach is known to include full card numbers or passwords, but the exposed data is exactly what scammers need to sound convincing. A caller who already knows a shopper’s name, phone number, points balance or a recent jewelry order can pass as customer service with little effort. The last 4 digits of a card are often used to “prove” a call is real.
The PCPD urged the public to verify anyone claiming to be a retailer by using the company’s official website, hotline or a store visit, even if the caller knows personal details. It warned that merchants handling refunds or compensation do not normally ask for a “deposit,” a handling fee or a test transfer to verify a bank account, and that people should never share online banking login details.
Retail customer databases have been a steady target in recent weeks. Landmark Group recently confirmed a breach of its Shukran loyalty program, and Japanese retailers Nitori and Muji have both disclosed large customer data breaches.
What Sogo and Chow Sang Sang customers should do
- Treat unexpected calls, texts and emails about your membership, points, orders or refunds as suspicious, even if the sender knows your details.
- Do not click links in messages about points expiring, rewards or order problems. Go to the official website or app directly.
- Never give out a one-time code, card number, CVV or banking password to anyone who contacts you.
- Check your card statements for charges you do not recognize, and call your bank using the number on the back of your card.
The PCPD’s investigations into both incidents are ongoing. BreachNews will update this story if either company releases final affected counts or more details about how the attacks happened.
Featured image: Sogo Causeway Bay by LN9267, via Wikimedia Commons, CC BY-SA 4.0, cropped and toned.
