Hong Kong Security Report — November 10, 2026

Security analysis based on open-source intelligence and web research. Period: November 03 — November 10, 2026.

Executive Summary

Hong Kong's security landscape during the period of November 03 to November 10, 2026, was primarily shaped by significant cybersecurity challenges and heightened diplomatic tensions surrounding its National Security Law. Cybersecurity incidents saw a notable 15% increase in Q3 2026, with phishing remaining the predominant threat, prompting a major government-led cybersecurity drill to bolster resilience. The sentencing of pro-democracy activist Joshua Wong to 10 years under the National Security Law on November 5, 2026, drew strong condemnation from a coalition of ten Western nations, including several EU members, which Hong Kong's government vehemently rejected as foreign interference. Despite these diplomatic frictions, discussions are underway for a new financial services dialogue between the EU and Hong Kong, indicating a complex relationship balancing human rights concerns with economic cooperation. The early release of several National Security Law convicts also marked a notable development in the city's legal and security framework.

Key Security Developments

• Cybersecurity Incidents See Significant Increase
  The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) reported on November 5, 2026, a 15% increase in cybersecurity incidents in Q3 2026 compared to the same period in the previous year, totaling 4,404 incidents. Phishing remained the most prevalent threat, accounting for approximately 61% of all security incidents, followed by botnet incidents at 17% and vulnerable system incidents at 11%. This surge indicates a persistent and evolving cyber threat landscape for Hong Kong organizations.

• Warning Issued on Widespread Credit Card Misuse
  In its Q3 2026 security incident statistics released on November 5, 2026, HKCERT highlighted a specific phishing campaign that led to unauthorized credit card transactions. Police received over 700 reports of suspected credit card misuse in mid-September 2026, resulting in losses of approximately HK$14.7 million. The incident underscores the need for enhanced payment security measures across customer devices, transaction verification, and third-party platforms.

• Major Cybersecurity Attack and Defence Drill Concludes
  Hong Kong authorities successfully concluded the "Hong Kong Cybersecurity Attack and Defence Drill 2026" on October 31, 2026, following a three-day exercise that began on October 29. The drill, spearheaded by the Digital Policy Office, expanded its scale to include 51 defensive "blue teams" from 28 government departments, 23 public organizations, and newly introduced private enterprises. It employed real-world combat scenarios to identify system vulnerabilities and test defense mechanisms, aiming to enhance the city's overall digital protection and cyber resilience.

• Joshua Wong Sentenced to 10 Years Under National Security Law
  On November 5, 2026, pro-democracy activist Joshua Wong Chi-fung was sentenced to 10 years in prison by Hong Kong's High Court for conspiracy to collude with foreign forces under the Beijing-imposed National Security Law. Wong, who is now 30, had pleaded guilty in September, with the court describing his offense as one of a "grave nature." This sentencing marks a significant development in the ongoing application of the National Security Law against prominent opposition figures.

• International Coalition Condemns Wong's Sentencing
  On November 6, 2026, a coalition of ten countries, including the United States, United Kingdom, France, Germany, Japan, Italy, Australia, Canada, the Netherlands, and New Zealand, issued a joint statement. They called for an immediate end to "unjust prosecutions" under Hong Kong's national security law, expressing serious concern over its use to target individuals for political expression. The European Union also criticized Wong's sentence.

• Hong Kong Government Rejects Foreign Interference in Judicial Affairs
  The Hong Kong Special Administrative Region Government, on November 7, 2026, strongly condemned and expressed firm opposition to the joint statement issued by the ten countries. It asserted that the statement "deliberately distorted facts and smeared the Hong Kong SAR," constituting a blatant interference with its judicial power and internal affairs. China's Foreign Ministry echoed this stance on November 5, 2026, firmly supporting Hong Kong in safeguarding national security and urging relevant parties to respect China's sovereignty and the rule of law.

• Early Release Granted to National Security Law Convicts
  On November 2, 2026, Leon Tong Ying-kit, the first person convicted under Hong Kong's National Security Law, along with three other individuals (former Apple Daily publisher Cheung Kim-hung, paralegal Wayland Chan Tsz-wah, and activist Andy Li Yu-hin) jailed in related high-profile cases, were granted early release. This development follows the enactment of the Safeguarding National Security Ordinance under Article 23 in 2024, which allows for early release if the Commissioner of Correctional Services is satisfied that national security will not be compromised.

• HKCERT Warns of Critical PHP Vulnerabilities
  HKCERT issued a reminder to businesses and organizations about emergency security updates for two critical PHP vulnerabilities, collectively known as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619). These vulnerabilities could allow remote attackers to execute unauthorized code, emphasizing the ongoing need for prompt patching and system updates to mitigate exploitation risks.

• Border Security Measures Enhanced for Peak Travel
  On October 25, 2026, Hong Kong's Chief Secretary for Administration, Eric Chan, inspected the Shenzhen Bay and Huanggang checkpoints, directing the Security Bureau to ensure safe, efficient, and orderly operations. This proactive measure was taken in anticipation of heavy passenger traffic during upcoming peak periods, with instructions to open additional inspection counters and vehicle lanes to ease congestion.

• Hong Kong Police Implement AI Facial Recognition on CCTV
  On November 6, 2026, the Hong Kong Police Force announced the enablement of AI facial recognition on CCTV. The force stated that the use of this technology would respect privacy rights and require authorization by an inspector or above, with collected data being retained for a maximum of 180 days. This move signifies an advancement in surveillance capabilities within the city's security infrastructure.

Cyber Threat Landscape

The cyber threat landscape in Hong Kong during this period was characterized by a significant increase in incidents and a focus on common attack vectors. HKCERT reported a 15% rise in cybersecurity incidents in Q3 2026, reaching 4,404 cases, with phishing remaining the primary threat, accounting for 61% of all incidents. This included a notable phishing campaign in mid-September 2026 that led to over 700 reports of suspected credit card misuse and losses of approximately HK$14.7 million, indicating financially motivated criminal activity. The "Hong Kong FinTech Week x StartmeupHK Festival," held from November 2–6, 2026, was identified as a high-risk period, with assessments indicating that both state-aligned and financially motivated threat actors were likely to increase their operational tempo to target this major international convergence of fintech, Web3, and AI leadership. Potential attacks during this period included data theft, credential harvesting, spear-phishing campaigns against high-value attendees, and ransomware attacks against event organizers and participating institutions.

HKCERT also issued a critical alert regarding two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as "PHP2Shell," which could allow remote attackers to execute unauthorized code. This highlights the ongoing exploitation of known software weaknesses. The government's response included the successful conclusion of the "Hong Kong Cybersecurity Attack and Defence Drill 2026" on October 31, which involved 51 "blue teams" from government, public, and private sectors, aimed at enhancing overall digital protection and incident response capabilities.

Background: Threat actors known to target Hong Kong include Lazarus Group (North Korea-linked), APT40 (China-linked), APT3 (China-linked), Earth Lusca (China-linked), LOTUS PANDA (China-linked), BRONZE HIGHLAND (China-linked), TEMPER PANDA (China-linked), and Aoqin Dragon (China-linked). TraderTraitor and QTFY were named in news in the last 30 days prior to this period.

Geopolitical Impact and Regional Dynamics

The period from November 3 to November 10, 2026, saw Hong Kong at the center of renewed geopolitical tensions, primarily stemming from the application of its National Security Law. The sentencing of pro-democracy activist Joshua Wong to 10 years in prison on November 5, 2026, for collusion with foreign forces, triggered a strong collective rebuke from ten Western nations, including the United States, United Kingdom, France, and Germany. This international condemnation underscores the persistent divergence between Beijing's assertion of sovereignty and national security and Western concerns over human rights and democratic freedoms in Hong Kong. The Hong Kong government's swift and firm rejection of this criticism, characterizing it as interference in internal affairs and judicial independence, reinforces Beijing's narrative and its unwavering stance on the city's governance.

This diplomatic friction highlights the broader strategic landscape where Hong Kong remains a flashpoint in the relationship between China and major Western powers. While China firmly supports Hong Kong's actions in safeguarding national security, the international outcry risks further alienating Hong Kong from global democratic norms and potentially impacting its standing as an international financial center, despite its economic rebound in recent years. The US Department of Defense's historical report from 2020, mentioned in a November 2026 article, which suggested the deployment of probable People's Armed Police forces in Hong Kong in August 2019, serves as a reminder of Beijing's willingness to exert direct security influence, further fueling international scrutiny over the city's autonomy.

Despite these political strains, Hong Kong continues to host significant international events, such as the "Hong Kong FinTech Week x StartmeupHK Festival" (November 2–6, 2026). This event, attracting global financial leaders, demonstrates Hong Kong's enduring role as a financial hub and its efforts to maintain international engagement. However, the identification of this event as a high-risk period for cyberattacks by both state-aligned and financially motivated actors indicates that geopolitical rivalries and criminal enterprises continue to leverage Hong Kong's interconnectedness, posing risks to regional stability and the interests of international businesses operating within the city.

EU Relations and Implications

Hong Kong's relations with the European Union during this period were marked by a clear divergence on human rights and rule of law, juxtaposed with ongoing efforts for economic cooperation. The EU, alongside other Western nations, expressed criticism regarding the 10-year sentencing of Joshua Wong on November 5, 2026, under the National Security Law. This aligns with the European Parliament's earlier resolution in September 2026, which urged targeted sanctions on Hong Kong officials under the EU Global Human Rights Sanctions Regime and called for the repeal of the National Security Law and Safeguarding National Security Ordinance. These actions reflect the EU's consistent concern over the erosion of rights and freedoms in Hong Kong, as highlighted in its 28th annual report to the European Parliament and the Council in September 2026.

Despite these significant frictions, the EU's relationship outlook with Hong Kong was assessed as "Stable" in August 2026, and cooperation projects continue in sectors such as Trade & Investment, Education & Skills, and Development Cooperation. Notably, senior officials from the EU and Hong Kong are in talks to launch a financial services dialogue in November 2026 in Brussels, with a focus on green finance and sustainable innovation. This indicates a pragmatic approach from the EU, seeking to maintain economic ties and cooperation in areas of mutual interest, even while expressing strong political disapproval of Hong Kong's security policies. The cybersecurity developments, particularly the increased phishing incidents and the identified high-risk period during FinTech Week, pose potential implications for EU businesses and investments in Hong Kong, necessitating enhanced digital security measures for EU-funded cooperation projects and companies operating in the city.

Military and Defense Analysis

During the period of November 03 to November 10, 2026, there were no reported significant military activities, exercises, defense acquisitions, or strategic shifts directly involving Hong Kong's local defense forces or the People's Liberation Army (PLA) Hong Kong Garrison. The focus remained primarily on internal security and cybersecurity resilience.

The Inter-departmental Counter Terrorism Unit (ICTU), comprising members from six disciplined services, continued its efforts to enhance public awareness and response capabilities against terrorism. This was evidenced by the ongoing Counter Terrorism Education Thematic Exhibition at the Hong Kong Museum of History, which opened in October 2026 and aims to deepen public understanding of the global counter-terrorism landscape and Hong Kong's strategies. This initiative underscores a proactive approach to internal security and public education rather than external defense posturing. While a 2020 US Department of Defense report, referenced in a November 2026 article, suggested the deployment of probable People's Armed Police forces in Hong Kong in August 2019, this serves as historical context regarding Beijing's potential security influence rather than a current military development within the reporting period. Overall, Hong Kong's defense posture during this week was characterized by a steady state, with an emphasis on internal security, counter-terrorism preparedness, and cyber defense, rather than overt military modernization or strategic shifts.

Outlook and Forecast

In the short-term (1-3 months), Hong Kong is expected to continue navigating a complex security environment marked by persistent cyber threats and ongoing international scrutiny over its national security policies. The increased volume of cybersecurity incidents, particularly phishing attacks, suggests that organizations will remain under significant pressure, necessitating continuous investment in cyber defense and employee training. The "Ethical Phishing Email and SMS Campaign 2026" and HKCERT's free cybersecurity webinar series for SMEs, both ongoing, indicate a sustained government effort to bolster cyber resilience.

Critical flashpoints include further prosecutions under the National Security Law and the Safeguarding National Security Ordinance, which could trigger renewed international condemnation and diplomatic tensions. The early release of some National Security Law convicts, while potentially a de-escalatory signal, will be closely watched for its implications on future cases and the broader application of the law. The ongoing financial services dialogue with the EU, set to take place in Brussels in November, represents a critical opportunity for Hong Kong to balance economic engagement with addressing international concerns, though significant breakthroughs on human rights issues are unlikely.

Indicators to monitor include the frequency and sophistication of cyberattacks, particularly against critical infrastructure and financial institutions, and the government's response to these threats. Any new legislative actions or high-profile court cases related to national security will also be key indicators of the city's evolving political and legal landscape. Furthermore, statements and actions from major international bodies and governments, particularly the EU and the Five Eyes allies, regarding Hong Kong's autonomy and human rights, will shape the city's diplomatic standing.

Strategic recommendations include strengthening public-private partnerships for cybersecurity intelligence sharing and incident response, particularly given the identified risks to the financial sector. Hong Kong should also continue to engage in dialogue with international partners, including the EU, to articulate its legal framework while demonstrating a commitment to transparency and due process, where possible. Internally, continued public education on cyber hygiene and counter-terrorism awareness, as promoted by the ICTU, remains crucial for enhancing overall societal resilience.

Sources

• hkcert.org
• chinadailyhk.com
• scmp.com
• newscord.org
• news.gov.hk
• ibgnews.com
• scmp.com
• scmp.com
• infosec.gov.hk
• ocmfa.gov.cn
• youtube.com
• cybersecurity.hk
• hkcert.org
• clb.org.hk
• scmp.com
• cyfirma.com
• washingtonpost.com
• thestandard.com.hk
• scmp.com
• jurist.org
• brusselstimes.com
• ictu.gov.hk
• news.gov.hk
• info.gov.hk
• police.gov.hk