{
  "id": "chow-sang-sang-data-access",
  "url": "https://ohshit.app/incidents/chow-sang-sang-data-access/",
  "title": "Chow Sang Sang discloses unauthorized access to customer and employee data",
  "level": 3,
  "level_name": "sharted",
  "date": "2026-11-12",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Chow Sang Sang",
    "retail",
    "data exposure"
  ],
  "ecosystems": [],
  "summary": "Chow Sang Sang says an intruder accessed some customer and employee records. Its preliminary findings identify the membership system and official online sales channels. The group is checking whether data was taken.",
  "splash": "Chow Sang Sang customers and employees whose records were accessed. The group is notifying potentially affected people.",
  "wipe": "Verify any notice through official customer service or HR. Review account activity and report unfamiliar changes.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Verify notifications through a known channel",
      "hint": "Use the group's official site or a known HR channel to confirm any message about the incident. Avoid opening attachments or giving passwords or verification codes to unsolicited callers."
    },
    {
      "title": "Check your account for unexpected changes",
      "hint": "Open the legitimate membership or shopping site directly. Review recent orders and profile changes. If you see suspicious activity, save the details and contact official customer support or your internal security team. Change a reused password and enable MFA where supported."
    }
  ],
  "sources": [
    {
      "name": "Chow Sang Sang disclosure filed with HKEX",
      "url": "https://www1.hkexnews.hk/listedco/listconews/sehk/2026/1112/2026111201492.pdf",
      "says": "Confirms unauthorized access, names affected systems and describes the investigation and notification process.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "The company confirmed unauthorized access to some customer and employee records.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 9, 2026",
      "title": "The group detects unauthorized access",
      "body": "Its November 12 filing says it first identified the incident on November 9."
    },
    {
      "date": "Nov 12, 2026",
      "title": "Chow Sang Sang files a preliminary disclosure",
      "body": "It had taken containment measures, retained security specialists and notified Hong Kong privacy and police authorities. Notifications to potentially affected customers and employees were underway."
    }
  ],
  "body_markdown": "The company says some customer and employee information, including personal data, was accessed. Its filing identifies the membership system and official e-commerce channels among the affected systems. The number of people, specific data fields, entry point and extent of any extraction remain under investigation."
}