A cyberattack on the Hong Kong Post has been confirmed. Targeting its EC?Ship online shipping portal, the attack compromised personal address?book information for approximately 60,000 to 70,000 users.

The data breach included names, physical addresses, phone and fax numbers, and email addresses of both senders and recipients.

The incident, detected late Sunday into Monday, involved an attacker using a legitimate EC?Ship account to exploit a code vulnerability. Though the system's security protocols identified unusual activity and suspended the account, the hacker persisted until the flaw was fully patched.

Affected customers received email alerts and were advised to monitor their information closely and alert contacts of potential phishing attempts.

Hong Kong Post is now collaborating with the Hong Kong Police Force, the Digital Policy Office, and the Office of the Privacy Commissioner. It implements a layered cybersecurity solution managed by the government's Digital Policy Office.

The Postmaster General emphasised that remediation steps have been taken to close the loophole and pledged ongoing infrastructure improvements. An official investigation is underway to reinforce resilience and safeguard user data.