Technology-related crimes in Hong Kong surged 47.3% in first half of 2023, with police pointing to growing online activity after Covid pandemic

Technology-related crimes in Hong Kong surged nearly 50 per cent in the first six months of the year over the same period 12 months ago, with police attributing the rise to an increase in online economic activity as the Covid-19 pandemic eased.

Senior Superintendent Raymond Lam Cheuk-ho of the force’s cyber security and technology crime bureau on Tuesday said police logged 15,637 cases of such crimes in the first half of this year.

The recorded incidents led to HK$2.03 billion (US$259 million) in financial losses and included offences such as hacking, internet fraud, misuse of accounts and online theft.

Compared with the same period last year, the figures represented a 47.3 per cent jump in cases and a 28 per cent rise in the amount of money stolen.

“This rise is in line with the increase of things taking place online, as economic activity continues to ramp up following the pandemic,” Lam said during the closing ceremony for the force’s “BugHunting Campaign”.

“Whether it’s work, shopping, dating or seeking employment – all these things are increasingly being conducted on the internet. We think this has created more opportunities for criminals to take advantage of security risks.”

He added that the force’s cyber security centre recorded an average of 500,000 attacks targeting organisations and people in Hong Kong, with cases including phishing scams, malware, botnets and ransomware.

Police collaborated with local cybersecurity start-up Cyberbay to run the campaign between June and July to help protect local businesses and other institutions from harmful attacks on their websites.

The initiative connects businesses with local cybersecurity talent, sometimes known as “bounty hunters”, to help manage risks.

Hong Kong police arrest 43 over 32 cases of cyber fraud totalling HK$28 million

“There is no security system in the world that is invincible,” Cyberbay CEO and co-founder Felix Kan said. “So it is important to always be one step ahead and keep upgrading.”

The troubleshooting service was free of charge for organisations, while talent received cash rewards under the programme for flagging any vulnerabilities.

Turning back to recent figures, the senior superintendent said while about 90 per cent of the technology-related crimes had targeted individuals, a “significant amount” set their sights on companies. He also stressed the importance of raising awareness among organisations of potential security risks.

Sixty organisations had signed up for the two-month campaign, half of which were start-ups and small-and-medium-sized enterprises. Another 30 per cent were NGOs.

Organisers said a total of 197 online security risks were discovered during the two-month programme, with 10 per cent listed as “critical”.

The Hong Kong Council of Social Service (HKCSS) was among the campaign’s beneficiaries and said it was surprised to learn that hackers did not only go after businesses.

“When you think about security risks, there is an assumption only e-commerce websites or other businesses that require credit card information face them,” said Cody Tam, a project officer with the organisation.

“But it turns out that is not the case. All organisations are at risk at all times.”

Tam said the programme had helped him and his colleagues to be more aware of potential red flags when checking their websites, such as sudden increases in traffic or inexplicably long loading times.

Hong Kong cyber fraud victims lost HK$830 million in first 3 months of year

Another company that joined the campaign was online therapy start-up Just a Moment Wellness. Charlie Ng, a web developer with the company, said the programme had brought to light a high-risk vulnerability and some low-risk ones.

“As a mental health service platform, we deal with a lot of highly sensitive, personal information from our users, including their therapy records and background information,” she said. “We have a legal and moral duty to protect them.”

The web developer said she was also thankful for the risk report handed out by organisers and described it as extremely detailed, making it easy for company staff to plug any loopholes.