Phishing sites now favored by scammers

In a concerning shift, phishing websites have become the scammers' method of choice for defrauding Hong Kong residents, overtaking malware as the most common cyber threat in the city, according to the police.

In the first three months of this year, the police recorded 18,758 cases of cyber threat intelligence. Of these, 8,592 cases (45.8 percent) were related to phishing, while 5,482 cases (29.3 percent) involved malicious software.

Superintendent Chan Shun-ching of the Cyber Security and Technology Crime Bureau said that there were 10,113 technology crimes between January and April 2024, resulting in total losses of HK$1.86 billion. These cases included computer system intrusions, e-mail attacks, and ransomware attacks.

Chan warned that local companies are expected to face an increasing risk of cyber attacks, with the number of cases likely to rise further.

"We do not suggest companies pay the ransom to hackers," Chan said.

To help small and medium-sized enterprises in Hong Kong defend against these growing threats, the police will be launching this year's "BugHunting Campaign" from today until August 30th.

The campaign aims to assist at least 150 SMEs, more than double the 60 companies helped last year.

Participating companies will receive a free cyber system test from the local cybersecurity firm CyberBay, which will help them identify and fix vulnerabilities.

Every two weeks, companies will be provided with a report on the bugs they need to address, and the police will offer one-on-one consultations if required.

Chief superintendent Lam Cheuk-ho said that the 60 companies that joined last year's campaign had 197 cyber vulnerabilities identified, 77 of which were high-risk.

Common issues included outdated systems and unsupported hardware.

To further bolster cybersecurity awareness, the police have also invited the Office of the Privacy Commissioner for Personal Data to hold a workshop on incident response and provide guidance on personal information management.

"We will award companies with good cybersecurity awareness an electronic medal to encourage them to fix their bugs and update their systems, which will protect citizens' personal information," Lam said.