Supply Chain Data Breach: It May Not Be Your Server That Leaked

Several Hong Kong companies have notified the Office of the Privacy Commissioner for Personal Data of customer data breach incidents, affecting more than 1,600 customers in total. The common thread: affected customers received calls from someone posing as support staff, quoting their name, phone number, and in some cases order numbers, flight numbers or delivery addresses.

This article does not name the companies involved. What matters is the shared pattern — one that can affect any online store or brand.

1. Why the trail leads to a third party, not your own server

Four things line up across the incidents:

• They happened in the same period
• The same script: a cancelled flight with compensation, or a damaged parcel with a refund
• The data was precise enough that only an internal system would hold it together
• Callers targeted customers who had just ordered or were about to travel

Security experts assess that the source is most likely a shared third-party customer service, SMS or logistics notification platform that was compromised — a textbook supply chain attack. The Privacy Commissioner's investigation is ongoing, but the pattern matches what we see in practice.

2. The role of AI: an amplifier, not the source

The first reaction is often "did AI cause this?". On the public record, there is no evidence that an AI system was the source. The source was access control or data handling at a third-party platform.

AI does change the scale of the damage. With leaked data, an attacker can use AI to:

• Filter for high-anxiety customers — those about to travel or who just ordered
• Generate fluent, well-targeted refund conversations
• Produce convincing fake bank verification pages

AI is not the cause; it is the amplifier. That said, there are three situations where using AI does directly cause data exposure and each is worth checking:

1. An AI assistant with excessive database permissions — one prompt injection can pull order data
2. Copying customer names, phones and addresses into an external AI service or vector database in order to "feed the AI"
3. AI plugins or SaaS holding long-lived API tokens — another back door

3. Seven actions you can take today

1. List your third parties. Which services hold customer names, phones and addresses — support desk, SMS, logistics, CRM, AI tools. Without the list, risk cannot be assessed.
2. Least privilege. AI and support systems read only the fields they need. No shared administrator database accounts.
3. Separate the data. Keep phone and address in a separate table or encrypted column; return masked values to external queries.
4. Three contract clauses. 24-hour breach notification, data processor terms, audit rights.
5. Monitor anomalies. Bulk queries in a short window, exports outside office hours, immediate suspension of departed staff accounts.
6. 2FA and IP allowlists on the admin panel and on every SaaS — not just your own server.
7. Run a quarterly breach drill. Take fifty customer records and ask: which single system could export all of this at once? That is where to start.

4. If it happens: the first 48 hours

• Revoke the relevant API tokens, rotate passwords, cut third-party connections
• Notify the Privacy Commissioner for Personal Data within 24 hours
• Notify affected customers proactively — do not wait for the press
• Preserve logs; do not rebuild the system

5. How we build it

Our default design: customer data stays on the customer's own server; AI translates questions into SQL instead of holding the customer list; every third-party integration has a documented owner and contract terms. That does not reduce risk to zero, but it makes risk visible, explainable and traceable.

If you want to know how many third parties currently touch your customer data, we run a one-day third-party data flow review that ends with a one-page inventory and priority list.

This is not legal advice. Statutory notification duties and deadlines should be confirmed under the Personal Data (Privacy) Ordinance and with professional advice.

Source: RTHK — Over 1,600 affected in airline, retailer data breaches (27 Oct 2026)