On July 28, The SFC reprimanded and fined Luk Fook Securities (HK) Limited $2.1 million for inadequate cybersecurity controls. The firm suffered a ransomware attack in September 2022 that crippled its core IT systems for around three weeks, leaving clients unable to trade online. The investigation uncovered systemic lapses including insufficient network safeguards, outdated software, weak access and password controls, poor remote access governance and deficient backup arrangements, which enabled the hacker to infiltrate its servers. The SFC ruled the firm breached cybersecurity obligations for its regulated activities, and took into account its remedial actions, cooperation with the investigation, clean disciplinary record and absence of client losses when imposing the sanction.
Sources: https://apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announcements/news/doc?refNo=26PR118
Relative Circulars: https://apps.sfc.hk/edistributionWeb/api/news/openAppendix?lang=EN&refNo=26PR118&appendix=0