For: members of Sogo Hong Kong. This article is an explainer based on the company's official statement and does not cover attack steps.
Developing: this article will be updated as the organisation publishes more
- Who is affected
members of Sogo Hong Kong.
- Confirmed so farSee the table ↓
- Obtaining of data from the member system
- Member number, name, contact phone number, email address, membership points
- Not yet confirmed
- The number of affected members (not in the statement)
- The date of discovery and the cause (not in the statement)
- Whether and how members will be notified individually (not in the statement)
1 more
- The final findings of the investigation (the company says it continues)
- What to do nowSee the steps ↓
- Do not open links in contact claiming to be from the company; check through its own contact details
- Never give verification codes or passwords by phone or message
- Check your points activity
2 more
- Change reused passwords
- If you suspect fraud or have been a victim, go to the police
- Where to verify (source)All sources ↓
- Sogo (Hong Kong) Department Store Co., Ltd., "Important statement: member system data incident" (official statement posted on the company website; Traditional Chinese; checked November 12)
- Last checked
- As of November 13, 2026
Follow-up plans and what we checked
The company says it is conducting a full investigation and has reported to the relevant government departments, and that it will keep taking appropriate measures. When we checked on November 13, 2026, we found nothing newer than the statement on its website.
What members should do today
Do not open links in contact claiming to be from the company; check through its own contact details
The company asks members not to click links of unknown origin, and not to give personal data or verification details if they receive a call, SMS or email claiming to represent it. To check, contact its customer service line, (852) 2833 8338, or its email address csteam@sogo.com.hk, yourself. Do not use numbers or links in the message you received. See What phishing is.
Never give verification codes or passwords by phone or message
The items in the statement are member number, name, phone number, email and membership points. Contact from someone who knows your name and phone number can sound genuine. Do not give a verification code (OTP), password, card number or ID image by phone or message, for any reason (our view).
Check your points activity
Membership points data is among the affected items. Occasionally check the app or website for points use or exchanges you do not recognise (our view). The company does not say points were misused.
Change reused passwords
The statement lists no password item. But a password reused on several sites carries risk from other incidents. If you reuse one, change it now and turn on multi-factor authentication (our view).
If you suspect fraud or have been a victim, go to the police
The company advises reporting suspected fraud or crime to the police at once. In a separate statement it warned about fake calls, claiming returns or refunds, that try to get personal data and bank details, and said it has no connection with them; that statement also mentions the Hong Kong Police anti-deception coordination centre line, 18222.
What happened (from Sogo's statement)
This section is based on the important statement "Member system data incident" (in Traditional Chinese; checked November 12) posted on the company's website. It is the company's own account and has not been verified by a third party.
November 2026 (no date given)
The company finds that an unauthorised party obtained some data from its member system.After discovery
The company strengthens network security monitoring, abnormal-activity detection, detailed investigation and risk assessment, and continuing system monitoring, and reports to the relevant government departments.November 12
The statement is seen posted on the company's website.
- What happened
- In November 2026 it found that an unauthorised party had obtained some data from its member system
- Information affected
- Per the investigation so far, mainly some members' member numbers, names, contact phone numbers, email addresses and membership points data
- The company's response
- Reported to the relevant government departments. Strengthened network security monitoring, abnormal-activity detection, detailed investigation and risk assessment, and continuing system monitoring
- Guidance to members
- Do not click links of unknown origin. Do not give personal data, account details or verification details to anyone claiming by phone, SMS or email to represent the company. Check by phone, (852) 2833 8338, or email, csteam@sogo.com.hk. Report suspected fraud to the police
What is known and what is not
The state as of November 13, 2026. We will update the status column when more is published.
| Item | Content | Status |
|---|---|---|
| Obtaining of data from the member system | An unauthorised party obtained some data | Confirmed (the company; data obtained. Its statement says an unauthorised party "obtained some data") |
| Member number, name, contact phone number, email address, membership points | Mainly affected per the investigation so far (some members) | Confirmed (the company; data obtained. Its statement says an unauthorised party "obtained some data") |
| Passwords | Not an item in the statement | Not stated |
| Payment card data, address, date of birth | Not items in the statement | Not stated |
| Number of affected members | Not in the statement | Not stated |
| Date of discovery and cause | Only "November 2026"; no cause given | Not stated |
| Misuse of the data | Not in the statement | Not stated |
| Final findings | The company says the investigation continues | Under investigation |
How to read this: the member count is not in the company's statement
The company's statement does not give a number. The Office of the Privacy Commissioner for Personal Data's media statements list (entries through November 12) did not show this matter either. The range of items, described with "mainly", may change as the investigation proceeds.
What can happen when names, phone numbers, emails and points are taken
The following is what can generally happen, not a statement that any of it has occurred here. What the company says has occurred is limited to "What happened" above.
A name, phone number and email together make it possible to write a convincing call or message in a department store's name. A member number or points balance can lend weight to fake notices such as "your points are about to expire" or "renew your membership". The company also warned about fake calls claiming returns or refunds in a separate statement, but it does not describe any link between the two. The company's own advice, checking through its contact details yourself, works best.
Sources (public records)
The facts in this article come from the public information below. Attack step details are not covered.
- Sogo (Hong Kong) Department Store Co., Ltd., "Important statement: member system data incident" (official statement posted on the company website; Traditional Chinese; checked November 12) — sogo.com.hk
- Office of the Privacy Commissioner for Personal Data (PCPD), media statements list (official; checked November 13; no statement on this matter was listed) — pcpd.org.hk
Update history
2026-11-13: First version. Based on the important statement on the company's website. The member count is not given because the company's statement does not state one. We will update when more is published.
Read next
- An overseas retailer's customer data breach: The ASOS customer data breach
- Spotting fake contact: What phishing is / Multi-factor authentication guide
- Other 2026 incidents: Data breaches and cyberattacks of 2026