Hong Kong SFC Fines Luk Fook Securities HK$2.1 Million After Ransomware Disrupted Systems for Three Weeks
Summary
Hong Kong’s SFC reprimanded and fined Luk Fook Securities HK$2.1 million over inadequate cybersecurity monitoring after a September 2022 ransomware attack disrupted key systems; full recovery took until October 7.
Key points
- The Hong Kong Securities and Futures Commission reprimanded Luk Fook Securities (Hong Kong) Limited and fined it HK$2.1 million.
- The regulator said the company lacked adequate and effective cybersecurity monitoring measures to defend against the September 19, 2022 ransomware attack.
- The attack disrupted key IT infrastructure, including file, domain controller, email, trading application, and accounting servers.
- Recovery was completed on October 7, about three weeks after the attack began.
- While systems were being restored, customers could not trade through the company’s mobile app or internet platform and had to place orders through their account managers.
- The company reported an incident in which a hacker used its remote access system to enter its servers; the SFC’s investigation found multiple deficiencies in its cybersecurity measures and systems.
Article Details
- Event Type
- Hong Kong Securities and Futures Commission reprimand and fine following a ransomware attack and cybersecurity control failures.
- Impact
- The September 19, 2022 attack disrupted key IT infrastructure, including file, domain controller, email, trading application, and accounting servers. Customers could not trade through the mobile app or internet platform during recovery and had to place orders through account managers. System recovery was completed on October 7, about three weeks after the attack. The company was reprimanded and fined HKD 2.1 million.