According to DataBreaches citing RTHK, Hong Kong's Office of the Privacy Commissioner for Personal Data (PCPD) stated that a data breach at ImagineX affected nearly 128,000 individuals [1]. The report noted that failure to promptly delete a temporary account and the use of an end-of-support operating system were key contributing factors in the incident [1]. The PCPD stated it received a breach notification from ImagineX in May regarding stolen data and a ransom note, and its investigation found that attackers used the temporary account to access the company's internal network [1].
This event has not been officially confirmed. Content is based on media or third-party reports.
Backfill: this event became public on Mar 31, 2025 and we added it on Nov 10, 2026. It is not a new event.
HighMonitoringBackfillMedia reported
Unremoved Temporary Account Leads to Personal Data Breach at Hong Kong's ImagineX
1 min read
- Disclosed
- Mar 31, 2025
- Published
- Nov 10, 2026
- Last updated
- Nov 7, 2026
- CVSS basis
- Our assessment
- Attack vector
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Retail
What to do nowOur advice
The PCPD stated it received a breach notification from ImagineX in May regarding stolen data and a ransom note, and its investigation found that attackers used the temporary account to access the company's internal network [1].
Timeline
- Public disclosure of incident[1]
Technical details
Verified Investigation Findings
According to DataBreaches citing RTHK, Hong Kong's Office of the Privacy Commissioner for Personal Data (PCPD) stated that a data breach at ImagineX affected nearly 128,000 individuals [1].
The report noted that failure to promptly delete a temporary account and the use of an end-of-support operating system were key contributing factors in the incident [1].
The PCPD stated it received a breach notification from ImagineX in May regarding stolen data and a ransom note, and its investigation found that attackers used the temporary account to access the company's internal network [1].
References
Media1
- [1]
“The Office of the Privacy Commissioner for Personal Data says a data breach incident by ImagineX has led to nearly 128,000 people’s information being compromised.”
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.