Hong Kong Security Report — July 23, 2026

Security analysis based on open-source intelligence and web research. Period: July 16 — July 23, 2026.

Executive Summary

The period from July 16 to July 23, 2026, for Hong Kong was marked by a significant diplomatic shift from the United States, alongside persistent cybersecurity challenges and the ongoing reinforcement of national security measures. The US allowed its national emergency declaration related to Hong Kong to expire, a move welcomed by both Beijing and Hong Kong as a positive step towards potentially restoring economic and trade ties, though key sanctions and the revocation of special trading status largely remain. Concurrently, Hong Kong faced a notable cyberattack on a financial services firm and continued threats from advanced persistent threat (APT) groups, prompting authorities to enhance cybersecurity defenses against AI-driven attacks. The city also continued to operate under a tightened national security framework, with recent amendments to implementation rules granting broader powers to law enforcement. These developments collectively indicate a complex security landscape, balancing diplomatic overtures with internal security consolidation and evolving digital threats.

Key Security Developments

• US Lifts National Emergency Declaration on Hong Kong
  On July 17, 2026, the United States confirmed it would not renew Executive Order 13936, which declared a national emergency related to Hong Kong, allowing it to expire on July 14, 2026. This decision led to the lifting of some sanctions associated with the emergency declaration. China's Ministry of Commerce and the Hong Kong government both welcomed the move, viewing it as a positive step towards restoring normal economic and trade exchanges, following understandings reached during US-China trade talks in Madrid. However, the US State Department clarified that the underlying executive order, which revoked Hong Kong's special trading status, remains in effect, and 39 of 48 individuals previously sanctioned under the emergency declaration continue to face sanctions under the Hong Kong Autonomy Act of 2020. This indicates a partial, rather than complete, restoration of previous US-Hong Kong relations.

• Major Cyberattack Hits Hong Kong Financial Firm
  Hong Kong-listed Get Nice Holdings announced on July 22, 2026, that its units were targeted by a cyberattack on July 19, which temporarily disrupted its electronic trading systems and other services, including stock withdrawals. While the securities unit resumed operations, the futures unit remained affected. The company stated there was no immediate evidence of information misuse and has engaged a cybersecurity firm for investigation, notifying the Stock Exchange of Hong Kong, police, and the Securities and Futures Commission (SFC). This incident underscores the vulnerability of the financial sector to sophisticated cyber threats.

• Hong Kong Faces Elevated Advanced Persistent Threat (APT) Activity
  A ThreatBook report released on July 23, 2026, revealed that Hong Kong experienced a higher incidence of Advanced Persistent Threat (APT) attacks (37.6% of cyber incidents) compared to ransomware (16.2%) between June 2025 and June 2026. These targeted attacks are primarily focused on long-term espionage, intellectual property theft, cross-border fraud, targeted phishing, and gaining access to critical infrastructure networks for future operations. This trend highlights a strategic and persistent cyber threat landscape aimed at data exfiltration and strategic disruption rather than immediate financial gain through encryption.

• Cybersecurity Drills Incorporate AI Threat Scenarios
  On July 7, 2026, the Hong Kong Police Force (HKPF) Cyber Security and Technology Crime Bureau and the Government Computer Emergency Response Team Hong Kong (GovCERT.HK) under the Digital Policy Office (DPO) jointly organized their 10th Inter-departmental Cyber Security Drill. This year's drill specifically integrated Artificial Intelligence (AI) elements to enhance the defense and incident response capabilities of government departments against increasingly sophisticated AI-driven cyberattacks. The initiative reflects growing concerns over hackers leveraging AI for accelerated reconnaissance, vulnerability scanning, and deceptive phishing.

• SFC Warns Licensed Corporations on AI-Driven Cyber Threats
  Following an increase in incidents involving AI models, the Hong Kong Securities and Futures Commission (SFC) issued Circular 26EC32 on June 2, 2026, urging licensed corporations to review and adapt their cybersecurity practices. The SFC highlighted that traditional security architectures are insufficient against today's threats, as AI enables attackers to conduct faster reconnaissance, vulnerability identification, social engineering, and exploitation, significantly reducing the timeline for defenders to respond.

• PLA Naval Fleet Concludes Port Call in Hong Kong
  From July 2 to July 6, 2026, two People's Liberation Army (PLA) Navy warships, the guided-missile destroyer CNS Nanning and guided-missile frigate CNS Hengyang, conducted a five-day port call in Hong Kong. The visit included public tours and cultural exchange activities, attracting over 30,000 visitors. Hong Kong officials, including Chief Secretary Eric Chan Kwok-ki, hailed the event as a demonstration of the central government's support and a means to strengthen residents' patriotism and appreciation for national defense capabilities.

• Expanded Powers Under National Security Law Implementation Rules
  On March 23, 2026, the Hong Kong government gazetted amended implementation rules for Article 43 of the National Security Law. These amendments enhance the enforcement powers of law enforcement authorities in preventing and investigating national security offenses. Notably, the changes make it a criminal offense to refuse to provide passwords or decryption assistance for personal electronic devices, including cellphones and laptops, to Hong Kong police, applying to all individuals, including US citizens, in Hong Kong or transiting through Hong Kong International Airport.

• Inter-departmental Counter-Terrorism Exercise at Airport and Tung Chung
  In preparation for major international conferences later in the year, the Hong Kong Police Force, in collaboration with over 1,400 personnel from various government departments and organizations, conducted a large-scale inter-departmental counter-terrorism, major incident, and protective security exercise at Hong Kong International Airport and Tung Chung on June 17, 2026. The exercise simulated armed terrorist attacks, knife attacks, and power outages, testing coordination in tactical interventions, emergency medical treatment, and suspicious object handling.

• Guangdong, Hong Kong, and Macao Joint Maritime Search and Rescue Exercise
  A joint maritime search and rescue exercise involving Guangdong, Hong Kong, and Macao was conducted on June 23, 2026. This exercise aimed to enhance regional cooperation in maritime safety and emergency response, particularly in the busy waters of the South China Sea.

• Security Bureau Youth Uniformed Group Leaders Forum Visits Shandong
  From July 19 to July 24, 2026, the Secretary for Security, Mr. Tang Ping-keung, led over 70 members of the Security Bureau Youth Uniformed Group Leaders Forum on a study tour to Shandong Province. On July 20, the group visited the special patrol unit of the Jinan Public Security Bureau to learn about its counter-terrorism, anti-riot, and crime-fighting work, aiming to strengthen participants' sense of national belonging and understanding of national security efforts.

Geopolitical Impact and Regional Dynamics

The period's most significant geopolitical development for Hong Kong was the United States' decision to let its national emergency declaration concerning the city expire on July 14, 2026. This move, while welcomed by Beijing and Hong Kong as a "positive shift" and an "important step" in implementing US-China trade consensus, carries nuanced implications. While some specific sanctions tied to the emergency declaration were lifted, the broader executive order revoking Hong Kong's special trading status remains in effect, and a majority of previously sanctioned individuals are still under separate US sanctions. This suggests a strategic recalibration by the US, potentially aimed at de-escalating certain aspects of the bilateral relationship while maintaining pressure on human rights and autonomy concerns. For Hong Kong, it offers a glimmer of hope for improved economic engagement with the US, but the fundamental shift in its autonomous status under US law persists.

China views this development as a vindication of its stance and a step towards normalizing relations, particularly in the context of broader US-China trade talks. The Chinese Ministry of Commerce explicitly stated that the US had made commitments on Hong Kong issues during trade consultations in Madrid. This diplomatic gesture could be interpreted as a concession by the US, potentially influencing other nations' approaches to Hong Kong. However, the continued existence of the Hong Kong Autonomy Act and related sanctions means that the international community, particularly Western powers, will likely remain vigilant regarding Hong Kong's freedoms and rule of law.

Relations with the European Union show a more cooperative, albeit cautious, trajectory. Discussions between the EU and Hong Kong to establish a financial services dialogue, with a focus on green finance, indicate a pragmatic approach to engagement, prioritizing areas of mutual economic benefit. Chinese Foreign Minister Wang Yi's call for China and Europe to maintain their partnership and avoid politicizing economic issues further underscores Beijing's desire for stable relations with the EU, which could indirectly benefit Hong Kong's international standing. Regionally, the joint maritime search and rescue exercise with Guangdong and Macao highlights ongoing practical cooperation within the Greater Bay Area, reinforcing regional stability and emergency response capabilities.

Military and Defense Analysis

Hong Kong's military and defense posture remains firmly integrated within China's overall national defense strategy, with the People's Liberation Army (PLA) Hong Kong Garrison serving as the primary military presence. The recent five-day port call by the guided-missile destroyer CNS Nanning and guided-missile frigate CNS Hengyang, which concluded on July 6, 2026, served as a significant demonstration of China's military capabilities and its sovereignty over Hong Kong. This event, attracting considerable public attention, was framed by Hong Kong officials as an opportunity to foster patriotism and appreciation for the nation's defense achievements, particularly among the youth. Such visits are instrumental in reinforcing the narrative of a "strong motherland" providing security and stability to the Special Administrative Region.

While there were no specific reports of new defense acquisitions or major shifts in force posture within the reporting period, the ongoing emphasis on national security legislation directly impacts the operational environment for security forces. The amended implementation rules for Article 43 of the National Security Law, gazetted on March 23, 2026, grant enhanced powers to law enforcement, including access to electronic devices. This legislative strengthening complements the physical security measures and intelligence gathering capabilities of the Hong Kong Police Force (HKPF) and other disciplined services. The HKPF's regular counter-terrorism exercises, such as the large-scale drill at Hong Kong International Airport and Tung Chung in June 2026, demonstrate a proactive approach to maintaining readiness against potential threats, particularly in critical infrastructure and public spaces. These exercises, involving over 1,400 personnel from various departments, highlight a coordinated inter-agency response capability.

Defense spending trends for Hong Kong are not publicly detailed as a separate entity from China's overall defense budget. However, the Hong Kong government's allocation of HK$5 billion (US$638 million) to the national security budget in May 2026, bringing the total to HK$18 billion (US$2.3 billion), indicates a significant financial commitment to internal security and national security enforcement. This funding supports the expansion of the national security architecture and the capabilities of the Inter-departmental Counter Terrorism Unit (ICTU), which comprises members from six law enforcement agencies. The focus remains on maintaining internal stability and preventing activities deemed to endanger national security, aligning with Beijing's "national security first" policy.

Outlook and Forecast

Short-term trends (1-3 months): In the immediate future, Hong Kong is likely to experience a period of cautious optimism regarding its diplomatic and economic standing, particularly in light of the US decision to let the national emergency declaration lapse. This could lead to increased dialogue and potentially a gradual easing of some trade-related tensions, although a full restoration of preferential treatment is unlikely given the US State Department's stance. Cybersecurity will remain a critical area of focus, with government and financial institutions continuing to bolster their defenses against sophisticated APT and AI-driven attacks. The recent cyberattack on Get Nice Holdings will likely serve as a catalyst for further investment and regulatory scrutiny in the financial sector's digital resilience. The ongoing implementation of the National Security Law, including its expanded powers, will continue to shape the domestic security environment, with authorities maintaining a high degree of vigilance against any perceived threats to national security.

Critical flashpoints and risk areas: A primary flashpoint remains the South China Sea, where regional maritime disputes could escalate and indirectly impact Hong Kong's maritime security and trade routes. While Hong Kong itself is not a direct claimant, its role as a major port and financial hub makes it susceptible to broader regional instability. The cyber domain represents another critical risk area, with the increasing sophistication of APTs and AI-enabled attacks posing a constant threat to Hong Kong's vital financial infrastructure and government systems. The potential for data breaches and disruption of critical services remains high. Domestically, while large-scale protests have been suppressed, the underlying tensions related to the National Security Law and perceived erosion of autonomy could lead to sporadic, smaller-scale acts of dissent or online activism, which authorities will likely continue to monitor and address under the existing legal framework.

Indicators to monitor: Key indicators to monitor include the progress of the proposed EU-Hong Kong financial services dialogue, particularly any concrete outcomes related to green finance, which could signal broader international engagement. Any further statements or actions from the US regarding the Hong Kong Autonomy Act and remaining sanctions will be crucial in assessing the trajectory of US-Hong Kong relations. Domestically, the frequency and severity of reported cyber incidents, especially those targeting critical infrastructure or financial institutions, will indicate the effectiveness of enhanced cybersecurity measures. The application and interpretation of the amended National Security Law implementation rules, particularly concerning digital privacy and access to electronic devices, will be important for understanding the evolving legal and security landscape.

Strategic recommendations: Hong Kong should leverage the recent US diplomatic shift to actively pursue opportunities for re-engagement and to advocate for the restoration of its unique economic status, emphasizing its role as an international financial center. Simultaneously, it must continue to prioritize and significantly invest in cybersecurity infrastructure and expertise, particularly in defending against advanced persistent threats and AI-driven attacks, to safeguard its financial markets and critical services. This includes fostering public-private partnerships and international collaboration on cybersecurity intelligence sharing. Internally, while upholding national security, the Hong Kong government should strive for transparency and clear communication regarding the application of the National Security Law to mitigate international concerns and maintain confidence in its legal system. Continued participation in regional security cooperation, such as joint maritime search and rescue exercises, will also be vital for enhancing collective security and stability.

Sources

• indiatoday.in
• news.gov.hk
• thestandard.com.hk
• chinadaily.com.cn
• anews.com.tr
• bssnews.net
• youtube.com
• aa.com.tr
• chinadaily.com.cn
• newsday.com
• manilatimes.net
• globaltimes.cn
• channelnewsasia.com
• hongkongbusiness.hk
• info.gov.hk
• securityboulevard.com
• chinadailyhk.com
• globaltimes.cn
• scmp.com
• scmp.com
• osac.gov
• info.gov.hk
• news.gov.hk
• www.gov.mo
• hkicpa.org.hk
• info.gov.hk
• scmp.com
• chinadailyasia.com
• hrw.org
• police.gov.hk
• ictu.gov.hk
• taipeitimes.com