Context

Hong Kong SMEs are seeing two high-impact patterns in the same quarter: ransomware that succeeds because backups were never restored under time pressure, and deepfake-enabled payment fraud that bypasses email filters by using voice, video, or AI-rewritten invoices.

Neither pattern is new. What changed is speed — attackers use GenAI to personalise lures, while lean IT teams still share admin accounts and keep backups on the same network as production.

This is an HKISG security news briefing for operators and boards. It is not an HKCERT advisory. For active compromise, escalate through your incident path and HKCERT. Role clarity: HKCERT and HKISG.

Hong Kong implications

  • Finance and EA staff often approve payments on WhatsApp-style channels where classical DLP is weak.
  • MSP/MSSP access without MFA multiplies ransomware blast radius across clients.
  • Personal data in stolen mailboxes can trigger PDPO considerations after exfiltration.
  • Boards that only hear “AI risk” without inventory decisions leave residual risk unowned — see CISO AI Security Briefing.

Practical guidance

Verify these five controls this month:

  1. Timed restore of one critical system (date the result).
  2. Dual control for payments above a published threshold — no voice/video-only wires.
  3. Out-of-band check for any supplier bank-detail change.
  4. MFA on email, VPN, cloud admin, and MSP privileged paths.
  5. One-page impersonation rule for CEO/CFO requests.

Deep dives: Ransomware for Hong Kong SMEs, Deepfake Fraud in Hong Kong, Prompt Injection.

Operator checklist

  1. Confirm whether your estate matches the patterns above.
  2. Assign owners and a 30-day review date for the five controls.
  3. Capture evidence if you later enter a Trust Review.
  4. Brief leadership with a dated one-pager (Board Briefing Pack).

Editorial note

Published by HKISG for educational and early-warning purposes. Not legal advice and not a substitute for bank fraud procedures or national CERT coordination. See Policies.