香港个人资料私隐专员公署（私隐专员公署）周一表示，已接获逾40宗与香港航空及电器零售商Yoho及百老汇涉嫌泄露数据有关的查询及投诉。
Almost 2,000 customers of Hong Kong Airlines and two electronic appliance retailers received fraudulent calls after their personal information was leaked by the companies, the city’s privacy watchdog has found. The Office of the Privacy Commissioner for Personal Data (PCPD) said on Monday that it had received more than 40 inquiries and complaints linked to the suspected data leaks involving Hong Kong Airlines and the electronic appliance retailers Yoho and Broadway.
私隐专员公署发言人表示：“我们已根据既定程序，就上述事件展开调查。”
“We have initiated an investigation into the aforementioned incident in accordance with established procedures,” a spokesman for the watchdog said.
公署称，最先于10月2日接获香港航空通报数据外泄。初步调查显示，815名在9月29日至10月22日期间出发的乘客接获疑似诈骗电话，泄露数据包括乘客姓名、电话号码、航班日期、航班号码及行程路线。Yoho于本月较早时候另行呈报。
The office said it was first notified by Hong Kong Airlines of the data breach on October 2. Preliminary findings showed 815 passengers departing between September 29 and October 22 received suspected scam calls, with leaked data including passenger names, phone numbers, flight dates, flight numbers and travel routes. Yoho submitted a separate notification earlier this month.
私隐专员公署表示，初步查询揭示，790名在9月29日至10月12日期间于Yoho下单的顾客接获诈骗电话，外泄详情可能包括姓名、联络电话、送货地址、订单编号及购买记录。
Initial inquiries revealed that 790 customers who placed orders with Yoho between September 29 and October 12 had received fraudulent calls, with compromised details potentially including names, contact numbers, delivery addresses, order IDs and purchase records, the watchdog said.
百老汇于周一亦联络公署。该零售商表示，顾客在数据外泄后接获疑似诈骗电话，外泄数据可能包括姓名、电话号码、购买项目及交易金额。私隐专员公署就三宗事件合共接获23宗投诉及20宗查询。
The office was also contacted by Broadway on Monday. The retailer said customers had received suspected scam calls after a data breach that may have included names, phone numbers, purchased items and transaction amounts. The watchdog received a total of 23 complaints and 20 inquiries over the three incidents.
公署提醒接获自称代表商户来电的顾客，透过官方渠道核实来电者身份，并留意商户发出的防骗警示。
It reminded customers who received calls from individuals claiming to represent merchants to verify the caller’s identity through official channels and to stay alert to fraud alerts issued by businesses.
公署提醒市民切勿向他人透露网上银行账户号码及密码等敏感资料。
The watchdog reminded the public never to disclose sensitive information, such as online banking account numbers and passwords, to others.
《南华早报》记者周颖诗（Fiona Chow）在10月7日于Yoho购物后，也接到了一通诈骗电话。
A South China Morning Post reporter, Fiona Chow, also received a fraudulent call on October 7 after making a purchase on Yoho.
来电者声称她的包裹在运输途中丢失，但有保险覆盖，承诺全额退款商品价格，并额外赔偿300港元（约38美元）。但周颖诗被指示联系一个WhatsApp号码以提出索赔。
The caller claimed her parcel had been lost in transit but that it was covered by insurance, promising a full refund on the product along with an additional HK$300 (US$38) in compensation. But Chow was instructed to contact a WhatsApp number to file the claim.
同一天，她还收到Yoho发出的通知，警告称多名在9月29日至10月6日期间下单的顾客反映接到诈骗电话。
On the same day, she also received a notice from Yoho warning that several customers who had placed orders between September 29 and October 6 had reported receiving scam calls.
据该零售商称，诈骗分子冒充Yoho或顺丰速运等快递公司的客服人员联系买家。
According to the retailer, fraudsters impersonating customer service agents from Yoho or delivery companies such as SF Express had approached buyers.
来电者引用真实的购买记录和个人详细信息，以包裹损坏赔偿或退款等借口，骗取银行账户信息或诱使受害者点击欺诈性WhatsApp链接。
The callers cited legitimate purchase records and personal details, using pretexts such as damaged parcel compensation or refunds to solicit bank account information or trick victims into clicking fraudulent WhatsApp links.
香港资讯科技联会名誉会长方保侨表示，三家来自不同行业的公司的客户，在9月下旬至10月这一完全相同的时间窗口内，均遭遇诈骗电话。
Francis Fong Po-kiu, honorary president of the Hong Kong Information Technology Federation, said customers of three separate companies from different sectors were hit by scam calls during the exact same window between late September and October.
他说：“这种一致的模式表明，个别公司泄露数据的可能性不大。相反，几乎可以肯定是共同的第三方供应商——负责处理客户服务、短信提醒或物流通知——在一次典型的供应链攻击中遭到入侵。”
“This uniform pattern indicates that individual company breaches are unlikely. Instead, a shared third-party vendor handling customer service, SMS alerts, or logistics notifications was almost certainly compromised in a classic supply chain attack,” he said.