820,000 Sogo members at risk as department store, Chow Sang Sang hit by data breaches

Personal information of 820,000 members of Hong Kong’s largest department store chain, Sogo, may have been exposed in a data breach, the city’s privacy watchdog has revealed.

The Office of the Privacy Commissioner for Personal Data disclosed the figures on Thursday, hours after Sogo announced it had alerted authorities a week earlier to abnormal data access within its membership system.

Preliminary findings indicate that compromised records may include members’ names, email addresses, phone numbers, and membership point balances, prompting the regulator to launch a formal investigation.

In a separate statement earlier in the day, Sogo Hong Kong Company said it had discovered this month that unauthorised parties had accessed its membership system and obtained records including member numbers, names, phone numbers, email addresses and point balances. It did not disclose the scale of the incident.

The company said it had notified the relevant regulatory and government authorities, launched a comprehensive investigation, and stepped up cybersecurity monitoring to prevent a recurrence.

It urged its members to stay vigilant against phishing scams, avoid clicking unknown links, and refrain from sharing personal or account details with suspicious callers or senders.

Customers can verify inquiries via Sogo’s hotline at (852) 2833 8338 or email csteam@sogo.com.hk, and should report suspected fraud to the police.

“The company sincerely apologises for any inconvenience or concern this incident may cause to our members, and will continue to implement all reasonable and appropriate measures to strengthen system security and safeguard customer data,” it added.