Short answer
Hong Kong's privacy watchdog opened investigations after customers of Hong Kong Airlines, Yoho and Broadway received scam calls that quoted their personal details. Hong Kong Airlines notified the watchdog on 2 October and Yoho on 5 October. The cause has not been made public.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Hong Kong Airlines, Yoho Hong Kong and Broadway Photo Supply |
|---|---|
| Incident type | Data leak |
| Status | Under investigation |
| Sector | Aviation and consumer electronics retail |
| Country | Hong Kong |
| Detected | 2026-10-02 |
| Disclosed | 2026-10-26 |
| People or records affected | More than 1,600 people reported to be affected: 815 Hong Kong Airlines passengers and 790 Yoho customers, plus an unreported number for Broadway |
What data was exposed
- Names and phone numbers
- Hong Kong Airlines: flight dates, flight numbers and routes
- Yoho: delivery addresses, order numbers and purchased products
- Broadway: names, phone numbers, products bought and payment amounts (as reported by one outlet)
What happened
Customers of Hong Kong Airlines, the electronics retailer Yoho and Broadway Photo Supply began receiving scam calls that quoted their personal details. Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) opened investigations. The Standard reported on 27 October that more than 1,600 people were affected, and that the PCPD had received 23 complaints and 20 inquiries.
The three cases
Hong Kong Airlines told the PCPD of its breach on 2 October. Of its passengers who flew between 29 September and 22 October, 815 received suspected scam calls about cancellations and compensation. The data involved names, phone numbers, flight dates, flight numbers and routes.
Yoho reported on 5 October. A total of 790 customers who ordered between 29 September and 12 October received calls claiming their parcels were damaged and offering refunds. The data involved names, phone numbers, delivery addresses, order numbers and products bought.
Broadway Photo Supply also submitted a breach report. The articles we reviewed gave no affected count.
What is not known
None of the reports we reviewed quote a company statement on the cause. Dimsum Daily quoted an IT veteran who suggested the matching calls might point to a shared supplier. That is one expert’s opinion, not a finding, and the PCPD has not said whether the cases are linked.
Losses and the PCPD’s warning
On 2 November, The Standard reported that the PCPD is investigating breach notifications from five companies: Cathay Pacific, Hong Kong Airlines, Malaysia Airlines Berhad, Yoho and Broadway. It said victims’ losses ranged from HK$10,000 to more than HK$1.5 million. The PCPD told the public that real merchants never ask for upfront deposits, handling fees or transfers to verify an account.
Why these calls work
A caller who knows your flight number or order number sounds like the real company. Our phone scams guide and urgent payment scams guide explain the pressure tactics, and the data breach checklist covers what to do if your details were exposed. See more cases on our breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Calls claiming your flight is cancelled and offering compensation, a refund or a rebooking if you share bank or card details.
- Calls saying your Yoho parcel was damaged and offering a refund, which ask for banking details or a transfer.
- Callers who quote real order or flight details so that the request for a 'deposit' or 'handling fee' sounds legitimate.
- Follow-up messages with links to fake refund or compensation pages.
What to do if you are affected
- 01Hang up on unexpected calls about flights or orders, then call the airline or shop on the number from its official website.
- 02Never pay a deposit, handling fee or transfer to 'verify' an account or claim a refund. The PCPD says genuine merchants do not ask for these.
- 03Do not share online banking credentials, card numbers or one-time passwords with a caller.
- 04Keep records of the calls and messages, and report suspected fraud to the police Anti-Deception Coordination Centre on 18222.
- 05Report suspected misuse of your data to the PCPD and check your bank accounts for unfamiliar transfers.
Frequently asked questions
What data was exposed in the Hong Kong Airlines leak?
Names, phone numbers and flight details such as dates, flight numbers and routes, according to The Standard. Hong Kong Airlines notified the PCPD on 2 October, and 815 passengers who flew between 29 September and 22 October reported suspected scam calls.
What happened with Yoho and Broadway?
Yoho notified the PCPD on 5 October. 790 customers who ordered between 29 September and 12 October got calls claiming parcels were damaged. Broadway Photo Supply also filed a breach report, but the reports reviewed gave no count of affected customers.
Is it one breach or three?
Not established. An IT expert quoted by Dimsum Daily suggested a shared supplier could be involved, but that is one person's view and no official finding.
How much have victims lost?
The Standard reports on 2 November that individual losses reported to the PCPD ranged from HK$10,000 to more than HK$1.5 million. That report covers five companies under PCPD investigation, including Cathay Pacific and Malaysia Airlines, not only these three.
Sources
- Privacy watchdog probes data breaches at HK Airlines, YOHO and Broadway, The Standard (Hong Kong), 2026-10-27
- Hong Kong privacy watchdog probes data breaches at Hong Kong Airlines, Yoho and Broadway, Dimsum Daily, 2026-10-27
- PCPD warns public after victims lose up to 15m in post breach fraud, The Standard (Hong Kong), 2026-11-02
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.