'Shangri-La Hack May Affect Over 290,000 HK Guests'

The city's privacy watchdog on Saturday said unauthorised activities online targeting Shangri-La Group might involve personal information of tens of thousands of guests in Hong Kong.

The luxury hotel chain announced on Friday that eight of its hotels in Asia, including three in Hong Kong, had been hit by a data breach, and that it first noticed suspicious activities on its IT networks in July this year.

"We immediately engaged cyber forensic experts to investigate and contain the issue. The investigation revealed that between May and July 2022, a sophisticated threat actor managed to bypass Shangri-La's IT security monitoring systems undetected, and illegally accessed the guest databases," Shangri-La Group said.

The affected hotels included the Island Shangri-La, Kerry Hotel and the Kowloon Shangri-La in Hong Kong, as well as other hotels in Singapore, Chiang Mai, Taipei, and Tokyo.

The group said the databases contained some combinations of guest names, e-mail addresses, phone numbers, and postal addresses, among other information.

"Certain data files were found to have been exfiltrated from these databases but the investigation has not been able to verify the content of these files...Personal information such as dates of birth, identity and passport numbers, and credit card details, was encrypted. There is no indication that any guest data has been misused," it said.

The hotel chain also said the incident had not impacted its operations and steps had been taken to further strengthen the security measures of its IT networks, adding that it had notified authorities and affected guests.

In response, the city's privacy watchdog said it had been notified of the incident by Shangri-La Group on Thursday evening.

The Office of the Privacy Commissioner for Personal Data said the breach might involve personal information of over 290,000 Hong Kong guests, adding that it has launched a compliance check.

It also said it was disappointed at Shangri-La Group for only formally informing the watchdog, and affected customers, more than two months after the hotel chain first became aware of the incident.