For: customers in Hong Kong who bought appliances from, registered a warranty with, or booked installation or repairs through Shun Hing Group's businesses, or who were PanaClub members; and staff, service and supplier personnel who worked with the group.
This article is based on the Office of the Privacy Commissioner for Personal Data (PCPD)'s public response and Shun Hing Group's official notice. It does not cover how the attack was carried out.
What customers should do now
Check whether you're affected only through official channels
Shun Hing Group says that anyone who wants to check whether their information was affected can send their name, telephone number and email address to the dedicated incident email address in its notice. Copy that address from the notice on Shun Hing Group's official website yourself; don't reply to unsolicited messages "on behalf of Shun Hing" or click their links. You can also call the PCPD on 2827 2827.
Check the latest PanaClub instructions on the official website
In its 9 July 2026 notice, Shun Hing Group said PanaClub was suspended and members did not need to reset their login credentials or take action about account access at that time. Check the current status and any required action by opening the official website yourself for its latest guidance. Don't use password-reset or account-verification links in emails or texts. For how to recognise these, see what is phishing?.
For 'home repair' or 'warranty expiring' calls, hang up and call back yourself
Names, addresses and phone numbers are exactly what someone needs to pose as a repair appointment, installation follow-up or extended-warranty offer. When you get such a call or text, hang up and call back on a number you find yourself, such as the customer service hotline on your warranty card or the official website. Don't pay, log in or give details through a number or link the caller provides.
Follow the PCPD's advice: passwords, multi-factor authentication, login history
The PCPD advises potentially affected people to consider changing online account passwords and enabling multi-factor authentication where available, and to watch personal email and accounts for unusual logins. If you used your PanaClub password on other sites, change it there first. A password manager keeps passwords unique; for choosing a second factor, see choosing multi-factor authentication.
Review your bank statements
The PCPD advises reviewing bank statements for any unauthorised transactions. This matters most for the staff, service and supplier personnel whose identity document numbers and bank account numbers may have leaked, since those details can be used to pose as a bank or an employer. If you see something suspicious, call your bank on the number on your card or statement.
Check suspicious numbers with Scameter or 18222
The Hong Kong Police's CyberDefender site offers Scameter, which rates the scam risk of phone numbers, email addresses and websites, and the police Anti-Deception Coordination Centre runs the Anti-Scam Helpline 18222. Note that "no record" doesn't mean safe; calling back on a number you looked up is still the most reliable check.
Want to know what a company holds about you? Make a data access request
Under Hong Kong's Personal Data (Privacy) Ordinance, you can make a data access request to find out what personal data an organisation holds about you. The PCPD's procedural guidance says to use its prescribed form. An organisation generally has 40 days to comply. If unable to complete all or part within that period, it must notify you of the reasons in writing within the same period, comply as far as possible, and complete the remainder as soon as practicable. Refusal on lawful grounds is a separate matter and requires notice of the reasons. For complaints about how your data was handled, contact the PCPD (complaints@pcpd.org.hk, 2827 2827).
Name + address + phone (customers)
→ Fake "repair appointment", "warranty expiring" or "home inspection" calls
Check: hang up, call a number you look up
Email + membership
→ "Reset your PanaClub password" or "verify your account" phishing
Check: open the official website for the latest guidance
ID doc no. + bank account (staff etc.)
→ Posing as a bank or employer, identity misuse
Check: review statements, call your bank
Shun Hing's 9 July notice: no evidence of misuse at that time
What happened (per the PCPD and Shun Hing Group)
The following comes from the PCPD's 2 July 2026 response to a media enquiry and Shun Hing Group's 9 July 2026 notice.
23 March 2026
The PCPD receives a data breach notification from Shun Hing Group and opens an investigation under its established mechanism.2 July
Responding to a media enquiry, the PCPD cites the organisation's latest information: the personal data of more than 921,000 people may have been leaked, and that of about 1,050,000 people may have been maliciously encrypted. The PCPD says its investigation is ongoing.9 July
Shun Hing Group publishes a latest update: potentially involved data includes names, phone numbers, email addresses and billing or mailing addresses, with no evidence at this time of misuse; the PanaClub system has been suspended; the group is collaborating fully with law enforcement and has upgraded its cybersecurity defences.
- Customers (~920,000)
- Names/titles, addresses, phone numbers and email addresses may have been leaked (Shun Hing's notice also mentions billing or mailing addresses)
- Staff, service/product/supplier personnel (~1,000)
- Names/titles, addresses, phone numbers, email addresses, identity document numbers, bank account numbers, salaries, etc. may have been leaked
- Malicious encryption
- Information on about 1,050,000 people, of whom about 1,045,000 are customers, may have been maliciously encrypted (PCPD, citing the organisation's latest information)
- Misuse
- In its 9 July notice, Shun Hing said there was no evidence of misuse at that time
- PanaClub
- The 9 July notice said the system was suspended and no reset was needed at that time. Check the current status and instructions on the official website
- Investigation
- Opened by the PCPD under its established mechanism; ongoing as of 2 July
- Enquiries
- PCPD: 2827 2827 · communications@pcpd.org.hk (enquiries) · complaints@pcpd.org.hk (complaints)
How to read it: this is the distributor's incident, not the brand manufacturer's
According to its website, Shun Hing Group has been the agent for a major Japanese home-appliance brand in Hong Kong and Macau since 1953, and provides installation and after-sales services through its service centres. The incident described here is the one the PCPD and Shun Hing Group have disclosed about Shun Hing Group; neither says any brand manufacturer's systems were affected. If a message claims to be from a "brand head office" about this incident, verify it the same way: on a number you look up yourself.
Why an old warranty registration becomes today's risk
When we buy an air conditioner, a fridge or a washing machine, we hand our name, address and phone number to a distributor or service centre for delivery, installation, warranty registration or later repairs.
Unlike a password, this data doesn't expire and can't be reset: the address from before you moved, the phone number you registered years ago, may all still sit in the system. The customer data the PCPD lists here (names, addresses, phone numbers, emails) is exactly this kind of after-sales record.
Suspicious 'after-sales' contact
- Opens by reciting your name, address and the appliance you bought
- Says your "warranty is about to expire" and wants payment through a link
- Asks you to "reset your PanaClub password" or "verify your account"
- Offers a last-minute "home inspection" and pushes you to decide
- Asks for your ID number or bank details "to verify you"
Safer habits
- Hang up and call the number on your warranty card or the official website
- Renew or pay only through official channels you open yourself
- Check any required PanaClub action against the latest guidance on the official website
- Confirm home visits and the technician through the official hotline
- Never give ID or bank details on an incoming call
The point isn't to get better at spotting scammers. It's to change how you check whether contact is genuine. Before, someone knowing your address and what appliance you bought was a reasonable sign it was real after-sales service. After this breach, it proves nothing.
Don't trust a call based on what the caller tells you; hang up and check by calling back on a number you look up yourself.
This site's view: write down the official hotline for your main appliances
Write down the brand, model, purchase date and official customer service hotline for your main appliances, on a card or in a phone note. When someone calls to say "your air conditioner's warranty is expiring", you already have a number to call back, and don't need anything the caller gives you. It's also worth making a data access request to the organisations that hold your details, to learn what they keep and for how long. For organisations holding large customer databases, the lesson is to keep only what after-sales service actually needs, and delete the rest on a schedule; see the minimum security baseline for organizations.
For suspicious texts and links on your phone, see smartphone security basics. For other breaches this year where leaked contact details made fake messages more convincing, see the TVING breach in South Korea and the list of 2026 breaches.
Sources (public record)
The facts in this article are based on the public sources below. Attacker claims and unpublished figures are not used.
- PCPD, "公署回應有關信興集團資料外洩事故" (response to media enquiry on the Shun Hing Group data breach, 2 July 2026, Chinese only) — pcpd.org.hk
- Shun Hing Group, "Latest update on Shun Hing Group cybersecurity incident" (9 July 2026) — shunhinggroup.com
- Shun Hing Group, official website (group profile) — shunhinggroup.com
- PCPD, "Data Access Request" Q&A leaflet — pcpd.org.hk
- Hong Kong Police Force, CyberDefender, Scameter — cyberdefender.hk
- Hong Kong Police Force, Anti-Deception Coordination Centre (Anti-Scam Helpline 18222) — adcc.gov.hk
Update history
2026-10-19: Limited correction: suspension, no reset needed and no evidence of misuse are dated to the 9 July notice; contact details are described as potentially involved. Check the current status by opening the official website for its latest guidance. The 40-day data access request guidance now distinguishes inability to complete from refusal on lawful grounds. We could not retrieve the PCPD's incident response again, so its figures and data items, and the last-verified date, are retained.
2026-09-30: First version, based on the PCPD's 2 July 2026 response to a media enquiry and Shun Hing Group's 9 July 2026 notice (as checked on 30 September 2026).
Read next
- Fake calls and messages: What is phishing? / Smartphone security basics
- Protecting your accounts: Choosing a password manager / Choosing multi-factor authentication
- Other 2026 incidents: The TVING data breach / List of breaches and cyberattacks (Japan and worldwide)
- For operators: The minimum security baseline for organizations