Chow Sang Sang: Unauthorised Access Hits Membership and E-commerce Systems

"Chow Sang Sang Holdings International, the Hong Kong jewellery and watch retailer listed as 0116.HK, has confirmed that unauthorised parties got into its systems. Its membership system and official e-commerce channels…"

Chow Sang Sang Holdings International, the Hong Kong jewellery and watch retailer listed as 0116.HK, has confirmed that unauthorised parties got into its systems. Its membership system and official e-commerce channels were affected, and some customer and employee personal data "was accessed and may have been extracted, subject to verification." The company disclosed this in an inside-information announcement to the Hong Kong stock exchange dated 12 November 2026. It has reported the incident to the Office of the Privacy Commissioner for Personal Data (PCPD) and the Hong Kong Police Force, and is notifying people who may be affected. It has not said how many customers or staff are involved or which types of data were exposed. The disclosure came the same week as a separate breach at department store Sogo, which the PCPD says may affect about 820,000 members. Nothing published so far links the two incidents.

What Happened

The company's stock exchange announcement, as reported by NewTimeSpace, Minichart and TipRanks, says the unauthorised access was first identified on 9 November 2026. That was a Monday, and China Labour Bulletin Board also describes it as "Monday of this week". The Standard reports that the intrusion was "first identified on Wednesday" (11 November). Accounts differ on this point. The exchange filing's 9 November date is the more authoritative, and the Wednesday date may refer to a different milestone, but no outlet has explained the gap.

Chow Sang Sang says it has:

Contained all unauthorised access and strengthened system security
Hired outside cybersecurity experts to investigate and recommend fixes
Reported the incident to the PCPD and the Hong Kong Police Force
Started notifying customers and employees who may be affected

The announcement says its contents reflect management's "preliminary assessment of currently available information," according to NewTimeSpace.

Customers could see the disruption. The Standard reported that the group's website showed an "under maintenance" notice and could not be accessed. iHolyShit, citing Economic Information Daily and Jiemian, reports that the company's own site was suspended while its Tmall and JD.com flagship stores and its physical shops kept trading. Unaudited operating figures released on 16 October showed the group had 739 jewellery stores and 16 watch stores at the end of September, according to iHolyShit.

The PCPD has publicly confirmed it received a notification from Sogo and opened an investigation into that case. As of publication, it has not said whether it has opened a formal investigation into Chow Sang Sang.

What Was Taken

The company has confirmed that some customer and employee information, including personal data, was accessed. It describes extraction as possible but still "subject to verification." That wording stops short of confirming the data left its network, but it does not rule it out either.

Some important facts are still missing. As Minichart notes, the announcement does not state:

How many customers or employees are affected
Which types of personal data were involved
Whether a ransom or extortion demand was made
How long the attackers had access before they were detected

The affected systems suggest what may be at risk. A jeweller's membership system usually holds names, phone numbers, email addresses and purchase or loyalty history. E-commerce systems may also hold delivery addresses and order records. The company has not confirmed that any of these were exposed. The phishing warning on its suspended website, reported by iHolyShit, tells customers never to give out card details, verification codes or account passwords. That is standard advice and does not mean payment data was compromised. No figure for affected records has been published by the company, the PCPD or any outlet.

The breach also covers staff as well as customers. Employee records can carry identity document numbers, bank details and payroll data. Chow Sang Sang has not said what employee information was involved.

Why It Matters

Luxury retail customers are valuable phishing targets. People who belong to a jewellery chain's membership scheme have shown they spend money on high-value goods. A list of those members, with contact details and possibly purchase history, is worth more to fraudsters than an ordinary marketing list. Chow Sang Sang's own website warns of calls, texts and emails impersonating the jeweller, banks or electronic payment platforms, according to iHolyShit.

Hong Kong retail is being hit repeatedly. This incident sits alongside the Sogo membership breach and earlier suspected leaks at Hong Kong Airlines, YOHO and Broadway that HK01 reported. In a 2 November research post, NyxLab described fraudsters in Hong Kong calling victims while posing as customer service staff and quoting real order details to make refund, cancellation or recall stories believable. NyxLab did not mention Chow Sang Sang, and that post came out before this breach. It shows how stolen membership and order data tends to be used once it is in criminal hands.

Investors and regulators will want the scope. Minichart points out that no cost, provision, fine or sales impact has been disclosed. Until the investigation gives verified figures, the regulatory and legal exposure is unknown. China Labour Bulletin Board notes that the PCPD has already been warning businesses to strengthen safeguards after a series of attacks on local firms.

The Attack Technique

Chow Sang Sang has not said how the attackers got in. No threat actor has claimed the attack, no ransom demand has been reported, and the company has not published any indicators of compromise.

The only evidence of method comes from the systems involved: the membership platform and the e-commerce channels, both of which face the internet. In NyxLab's investigations of other Hong Kong e-commerce and logistics breaches since August, it found three recurring ways attackers reached customer data:

Abusing member and order lookup functions. These are broken access control flaws, where an API returns other customers' records when identifiers are changed.
SQL injection against e-commerce platforms and supporting systems.
Exposed or misused cloud and privileged credentials.

These are offered as the likely kinds of entry point for this type of breach. They are not findings about Chow Sang Sang, and the company has not confirmed which method, if any, applies here.

What Organizations Should Do

Test member and order APIs for broken access control. Check that every lookup endpoint enforces ownership on the server side. Rate-limit and alert on bulk lookups or requests that walk through sequential IDs, which is a common sign of scraping.
Audit web apps for injection flaws. Run authenticated testing against e-commerce, loyalty and back-office portals, including third-party plugins. Use parameterised queries everywhere, and put a web application firewall in front of legacy code while it is fixed.
Find and rotate exposed credentials. Scan code repositories, CI pipelines and cloud storage for leaked keys. Enforce MFA and short-lived tokens for privileged and service accounts, and review who has direct database access.
Alert on unusual data reads. Sogo found its breach through "abnormal data reading records". Set baselines for normal query volumes on customer databases and alert on large exports or reads at unusual hours. Shortening the gap between intrusion and detection matters more than almost any other control.
Prepare customers for impersonation scams. If your customer data may be exposed, tell customers early and clearly which channels you will and won't use to contact them. Publish a verification hotline, and warn them that callers quoting real order details may still be scammers.
Treat employee data as a breach of its own. If staff records may be involved, notify employees separately, assess identity and bank fraud risk, and watch for targeted phishing aimed at staff with system access.

Sources: 820,000 Sogo members at risk as department store, Chow Sang Sang hi... | SOGO and Chow Sang Sang report data breaches affecting up to 820,00... | Chow Sang Sang Discloses Data Security Incident - TipRanks.com | Chow Sang Sang suspends website amid possible data extraction｜iHoly... | The Refund Call That Knows Your Order: Inside Ecommerce Breaches an... | Chow Sang Sang Discloses Data Breach Affecting Membership and E-com... | Chow Sang Sang says client and staff data may have been accessed in... | CHOW SANG SANG (00116.HK): Unauthorised System Access; Customer and...