No sign of data leak following ransomware attack against InvestHK

InvestHK found no evidence of personal data leaks from last month’s ransomware attack, according to Secretary for Innovation, Technology and Industry Sun Dong in a written reply to lawmaker Jeffrey Lam Kin-fung.

Lam asked the secretary whether the February 22 cyberattack had dampened investors’ confidence in the information security of the government’s promotion agency.

Sun said InvestHK has immediately taken measures according to established procedures and has not received any public complaints or enquiries over the cyberattack as of mid-March.

“After the incident, InvestHK promptly issued press releases to clearly explain the situation to the public and its clients. It is believed that the incident has not affected investors' confidence,” Sun added.

The technology chief also revealed that the Digital Policy Office received 10 incident reports involving ransomware attacks on government IT systems in the past three years, and none resulted in data leakage.

The government also has not received relevant reports from public bodies, which have been required to notify authorities of incidents involving their designated IT systems since August 2024.

According to Sun, the administration has asked departments and public bodies to strengthen the project governance and security of IT systems.

Measures include appointing a senior directorate officer to oversee information security work, conducting regular tests, assessments and audits, as well as staging real-life cybersecurity attack and defense drills.

(Jamie Liu)