Security notice
Do you keep a membership list and an online shop? Chow Sang Sang says unauthorized access reached both, and some customer and staff data may have been taken.
On November 12, 2026, Chow Sang Sang Holdings International Limited, the Hong Kong jeweler, told the Hong Kong stock exchange it had detected unauthorized access to its systems, first identified on November 9. The initial investigation indicates the affected systems include the group's membership system and official e-commerce channels. The company says certain customer and employee information, including personal data, was accessed and may have been extracted, subject to verification. It says it has taken steps to contain the unauthorized access, enhance the security of its systems, and engage cybersecurity experts. It has reported the incident to the Office of the Privacy Commissioner for Personal Data in Hong Kong and the Hong Kong Police Force, and is notifying potentially affected customers and employees. A company statement reported by HK01 and The Standard says preliminary findings indicate affected customer data may include member names, contact phone numbers, email addresses, some order details and the last four digits of credit card numbers, and that affected employee data may include names, positions, company email addresses and contact numbers. The company has not published a count of affected people. When we checked on November 13, 2026, the official Chow Sang Sang e-shop was still showing a notice that the site had paused service to protect customer data, that physical stores remain open, and that customers should watch for calls, messages or emails impersonating the group, financial institutions or e-payment platforms, and should not click unknown links or share card details, verification codes or account passwords. This is not a named software flaw, so there is no CVE or patch to install. If you shop at Chow Sang Sang or work there, watch for phishing and wait for the company's notice. If you run a store, this is a reminder that membership lists, order details and even partial card data are enough to make a scam convincing, and that you should have a plan to pause a shop and tell customers if you are breached. (Chow Sang Sang HKEX announcement, Nov 12; Chow Sang Sang e-shop notice, checked Nov 13; HK01, Nov 12; The Standard, Nov 12)
What happened
- Identified on November 9, disclosed on November 12. Chow Sang Sang Holdings International Limited said in a Hong Kong stock exchange announcement on November 12, 2026, that it had detected unauthorized access to its systems, first identified on November 9, with potential extraction of customer and employee information. (Chow Sang Sang HKEX announcement, Nov 12)
- Membership system and official e-commerce channels. The company says the initial investigation indicates those are the systems affected. It says the investigation is still ongoing. (Chow Sang Sang HKEX announcement, Nov 12)
- Steps taken to contain access, experts hired, authorities told. The company says it has taken steps to contain all unauthorized access, enhance the security of its systems, and engage cybersecurity experts to investigate and advise. As of November 12, it had reported the incident to the Office of the Privacy Commissioner for Personal Data in Hong Kong and the Hong Kong Police Force, and was notifying potentially affected customers and employees. (Chow Sang Sang HKEX announcement, Nov 12)
- Official e-shop paused. On November 13, 2026, the official Chow Sang Sang e-shop at chowsangsang.com was still showing a company notice. That notice says the group recently found unauthorized access to its systems, took steps at once to stop the malicious access and strengthen security, and has paused the website to protect customer data. It says physical stores remain open as usual. The Standard had already reported on November 12 that the website was showing an "under maintenance" notice and could not be used. (Chow Sang Sang e-shop notice, checked Nov 13; The Standard, Nov 12)
What data
The stock exchange announcement does not list the types of data or a count of affected people. It says certain customer and employee information, including personal data, was accessed and may have been extracted, subject to verification. (Chow Sang Sang HKEX announcement, Nov 12)
A company statement reported by HK01 and The Standard gives more detail, described as preliminary findings: (HK01, Nov 12; The Standard, Nov 12)
- Customer data that may be affected: member names, contact phone numbers, email addresses, some order details and the last four digits of credit card numbers.
- Employee data that may be affected: names, positions, company email addresses and contact numbers.
No reputable source we checked, including the stock exchange announcement, has said that full card numbers, card security codes or identity-card numbers were taken. 9updaily reported that the Privacy Commissioner's Office said it had received a data breach notification and that the number of people affected was still being confirmed. (9updaily, Nov 13)
Who should worry
- You have a Chow Sang Sang membership, you have shopped on its official e-shop, or you work for the group.
- You run an online store or a membership program, and you keep customer names, contact details, order history or even partial card data.
If you have never shopped at Chow Sang Sang, you are not a member or employee, and you do not run a store that keeps this kind of customer data, this notice does not apply to you.
What to do now
If you are a Chow Sang Sang customer or staff member. This follows the company's own e-shop notice and the statement reported by HK01 and The Standard.
- Watch for fake calls, texts and emails. The company tells customers to be wary of anyone impersonating the group, financial institutions or e-payment platforms. (Chow Sang Sang e-shop notice, checked Nov 13; HK01, Nov 12; The Standard, Nov 12)
- Do not click unknown links, and do not give anyone your card details, verification codes, account passwords or other sensitive personal data. (Chow Sang Sang e-shop notice, checked Nov 13; HK01, Nov 12; The Standard, Nov 12)
- Use official contact routes if you have questions. The paused e-shop notice lists the company's official customer service options and says physical stores remain open. Do not use contact details from an unexpected message. (Chow Sang Sang e-shop notice, checked Nov 13)
- Wait for the company's notice if you may be affected. The company says it is notifying potentially affected customers and employees. The stock exchange announcement does not say how or when those notices will arrive. (Chow Sang Sang HKEX announcement, Nov 12)
If you run an online store. These are general steps, not from Chow Sang Sang. We are not claiming any tool, including EverThread, would have stopped this attack.
- Look at what your membership list and your shop hold together. This breach reached a membership system and official e-commerce channels. Review whether customer names, phones, emails, order details and any leftover card data, including last-four-digit records, still sit where an attacker who reaches one system could also reach the other.
- Do not keep payment data you do not need. Even the last four digits of a card, together with a name and order details, can make a phishing message look real. Delete card fragments and old order fields you no longer need.
- Have a plan to pause the shop and tell people. Chow Sang Sang paused its official e-shop, kept physical stores open, put a warning on the site, told the privacy regulator and the police, and said it is notifying affected customers and employees. Know in advance who can take the shop offline, who tells customers, and how you would report the incident.
- Warn customers about impersonation, not only about the missing data. The useful advice in this case is about fake calls, texts and emails that use real names and order details. Prepare that warning before you need it.
What to send your developer, agency or host
Hong Kong jeweler Chow Sang Sang told the stock exchange on November 12, 2026, that unauthorized access, first identified on November 9, reached its membership system and official e-commerce channels. It says customer and employee personal data was accessed and may have been extracted, subject to verification. A company statement reported by HK01 and The Standard says affected customer data may include names, phone numbers, emails, some order details and the last four digits of credit card numbers, and that employee names, positions, company emails and phone numbers may also be affected. The official e-shop is paused. Please tell us what customer and staff data our membership program and online shop still keep, including order history and any partial card data, whether those systems share access, how we would pause the shop and put a warning up, and how we would notify customers and the relevant privacy regulator if we had a similar incident. Source: Chow Sang Sang Holdings International Limited stock exchange announcement, November 12, 2026; Chow Sang Sang e-shop notice, checked November 13, 2026; company statement as reported by HK01 and The Standard, November 12, 2026.
Common questions
Has my site been hacked?
This notice does not mean your site has been hacked. It is about a breach of Chow Sang Sang's own systems. It matters to you as a shopper or staff member if you used that store or work there, and as a store owner because many shops keep membership lists, order details and partial card data.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see your store's customer records, membership lists or stored payment data, and we cannot tell you whether you were one of Chow Sang Sang's customers or employees.
Were full card numbers stolen?
No source we checked has said that. The stock exchange announcement does not list card data at all. The company statement reported by HK01 and The Standard says the last four digits of credit card numbers may be among the affected customer data. That is not a full card number, but together with a name and order details it can still be used to make a scam more convincing. (Chow Sang Sang HKEX announcement, Nov 12; HK01, Nov 12; The Standard, Nov 12)
How did the attacker get in?
Chow Sang Sang has not said. It says the investigation is still ongoing. (Chow Sang Sang HKEX announcement, Nov 12)
Is the official online shop still down?
When we checked on November 13, 2026, the official e-shop at chowsangsang.com was still showing the company's notice that the website had paused service to protect customer data. The notice says physical stores remain open. Check the company's own site for the current status.
Is there anything to update?
No. This was an attack on one company's systems, not a named flaw in software you run. The general steps for store owners above are worth doing anyway.
Where can I follow official updates?
Chow Sang Sang's November 12 stock exchange announcement, Inside Information - Data Security Incident, is on the Hong Kong Exchanges website. The official e-shop notice is at chowsangsang.com. HK01 and The Standard reported a more detailed company statement the same day. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Chow Sang Sang Holdings International Limited: Inside Information - Data Security Incident, Hong Kong stock exchange announcement, November 12, 2026, checked November 13, 2026
- Chow Sang Sang official e-shop notice: chowsangsang.com, checked November 13, 2026
- HK01: Chow Sang Sang says systems were accessed without authorization, involving member and staff personal data such as names and phone numbers, November 12, 2026, updated November 13, 2026, checked November 13, 2026
- The Standard: SOGO and Chow Sang Sang report data breaches affecting up to 820,000 members, November 12, 2026, checked November 13, 2026. The 820,000 figure in that headline is about SOGO, not Chow Sang Sang.
- 9updaily: Chow Sang Sang says systems were accessed without authorization and member and staff data may have been taken, November 13, 2026, checked November 13, 2026, for the Privacy Commissioner's Office response that a notification was received and the affected count was still being confirmed