Hundreds of convenience stores in Hong Kong paralyze payment and membership services due to suspected cyber attack.

A suspected cyber attack on Hong Kong's OK Convenience Store has paralyzed the operations of nearly 400 stores across the territory for several days, forcing the e-payment, email and member services systems to go out of service.

SECURITY INSIDER, Sept. 25 (Bloomberg) -- OK Convenience Stores (Circle K), Hong Kong's second-largest convenience store chain, said a "network outage" has paralyzed its operations in the city for several days, forcing the suspension of most of the e-payment and membership services at nearly 400 stores across the territory.

The retailer said the incident, which was first reported last weekend, affected electronic payment systems, email services and membership programs. For the time being, OK Convenience Store remains “open and open for business”, and customers can still pay with cash or Octopus, a contactless smart card widely used in Hong Kong.

In a Facebook statement Monday, the company said, “As a cyberattack cannot be ruled out, we have taken swift action to protect the data of our customers, employees, and suppliers, and are working with law enforcement and third-party forensics experts to identify the cause, scope, and impact of this intrusion.”

The company has yet to release further updates or respond to requests for comment from foreign media. As of Tuesday, customers were still reporting service outages on its Hong Kong social media pages, complaining about expired membership points and coupons, and calling on the company to extend the expiration dates.

OK Convenience Store has been victimized by repeated cyberattacks in the last three years.

OK Convenience Stores Hong Kong is owned by Alimentation Couche-Tard (ACT), a Canadian company that operates OK Convenience Stores in North America and elsewhere.

According to local media reports, an OK Convenience Store located in Causeway Bay, a major retail district in Hong Kong, has posted a notice stating that the electronic payment service is suspended due to “network outage”.

OK Convenience Stores Hong Kong's former parent company was Celia Retail Limited (CRA). CRA licensed the brand in the 1980s and sold it back to ACT in 2020. CRA similarly reported a network outage on Monday, saying its internal systems had been impacted and it had notified law enforcement, but it is unclear whether the two incidents are related.

OK Convenience Stores has been the target of numerous cyberattacks around the world. In January, Gas Express, the chain's largest franchisee in the United States, disclosed that hackers had stolen customer names, social security numbers, and driver's license information. In June 2024, a ransomware group allegedly claimed responsibility for an intrusion at the OK Convenience Store in Atlanta.

In 2023, researchers also discovered that an OK Convenience Store's dataset was leaked online, containing partial payment card information, customer membership numbers, and employee contact information. The company said it had fixed the issue but did not comment further.

Reference: https://therecord.media/circle-k-hong-kong-suspected-cyberattack-convience-stores

 

 

Related articles

遭駭的積架路虎（JLR）估計損失高達 19 億英鎊，為英國歷來之最

積架路虎（JLR）今年 9 月初遭黑客攻擊，停產超過一個月，英國網絡監測中心估計損失高達 19 億英鎊，為英國史上最嚴重資安事故，波及逾 5,000 家機構。黑客透過網絡釣魚及外洩憑證入侵系統，相關組織更聲稱發動攻擊，此次事件屬 3 級系統性事故，重創生產與供應鏈。...
Learn more

Qantas Hacked, 5.7 Million Customers' Data Leaked, Exposing New Challenges in Capital Protection

In July 2025, Qantas Airways was hit by a massive cyber-attack, which resulted in the leakage of 5.7 million customers' names, emails, addresses, and other personal information, making it one of the most serious cyber-security incidents in Australia in recent years. The incident is suspected to be related to the social engineering and voice phishing tactics of the Scattered Spider organization, exposing the vulnerabilities of large-scale corporate security and bringing important warnings to enterprises to strengthen their cybersecurity....
Learn more

Malicious Ads Trigger Crisis Nevada Government Ransomware Attack Revealed

In August 2024, the state government of Nevada was hit by a ransomware attack triggered by malicious advertisements that disrupted services in more than 60 government departments. IT staff clicked on the malicious advertisements to download a tool that contained a backdoor, and the password vault was breached. The authorities refused to pay the ransom, and in-house staff worked overtime for 28 days to repair 90% of the critical systems, at a much lower cost than outsourcing, which has brought important information security revelations to both public and private organizations....
Learn more

Regal Group Hit by Massive Conduent Data Breach

Conduent, a business services provider, has suffered a massive data breach affecting 25 million people and nearly 17,000 employees in North America. Hackers breached the system between October 2024 and January 2025, stealing personal, medical, and social security information, and the incident was caused by...
Learn more

Digital Vault Congratulates All Hong Kong People on the Year of the Horse

Remins. On this New Year's Eve, Digital Vault wishes all Hong Kong people and corporate clients a happy New Year of the Horse. On this New Year's Eve, Digital Vault would like to wish all Hong Kong citizens and enterprise customers a prosperous year of the Horse. As a cloud security storage expert rooted in Hong Kong, we will continue to protect data assets with solid encryption technology and professional cloud services, drive the digital transformation of enterprises, and work with Hong Kong to leap to the new peak of the digital world....
Learn more

Data breach affects over 200 million Telegram user records

Cybernews reports that on January 24, BreachForums leaked more than 200 million Telegram user logs, 44GB of uncompressed data containing names, usernames, emails, and phone numbers, and another 60 million logs with 160...
Learn more

Georgia Medical Group Data Breach Affects Over 620,000 People

A cyberattack on ApolloMD, a medical group based in Georgia, USA, has resulted in the leakage of sensitive information about 626,540 people, including names, addresses, diagnostic records, and health insurance and social security numbers. The hackers breached the system in May, and the incident was staged by the Qilin ransomware group, which has repeatedly targeted the healthcare industry, releasing information on an average of about 40 victims per month over the last year....
Learn more

Six Million Oracle Cloud Users' Data Suspected to be Leaked

Hacker Rose87168 claimed to have hacked into Oracle's cloud SSO server and stolen 6 million user authentication data for sale on the dark web, and is suspected to have exploited the vulnerability of the old software to even build files on its server. oracle adamantly denied that it had been hacked, but quickly took down the server involved, and BleepingComputer verified that the hacker's data samples were true, which has triggered a test of cloud security. The incident has triggered a test of trust in cloud information security....
Learn more

Unauthorized Access to SoundCloud Backend Assistance Dashboard HIBP Alleges About 29.8 Million Account Data Exfiltrated

SoundCloud's backend assistance dashboard was accessed without authorization, and HIBP pointed out that about 29.8 million account information was exfiltrated, including about 30 million individual email addresses, no passwords and financial information. The platform was hit by a DoS attack after processing, the attacker harassed the relevant people by email and claimed to hold sensitive information, the platform has strengthened protection, HIBP has recorded the incident, the official reminded users to guard against phishing....
Learn more

AT&T Data Breach Settlement Pending Judge's Final Ruling

AT&T has reached a $177 million settlement, pending judge's approval, for two serious data breaches in 2024. The incidents involved the disclosure of sensitive data and telephone numbers of 73 million users, and the settlement was split between the two incidents, with the legal team claiming about one-third of the costs. The State of Connecticut has stepped up data privacy enforcement over the same period, reflecting the tightening of digital security regulations in the U.S. AT&T users are still awaiting judgment and compensation....
Learn more

HKCERT Releases "Hong Kong Cyber Security Outlook 2026" Cyber Security Incidents Rise by 27% Annually, Hitting New Highs AI Applications and Supply Chain Risks Become a Concern Nearly 30% of Enterprises Still Don't Have Manpower to Take Charge of Cyber Security

According to Media OutReach Newswire, the Hong Kong Cyber Security Incident Response Team Coordination Center (HKCERT), a division of the Hong Kong Productivity Council (HKPC), held a media briefing to announce its annual "Hong Kong Cybersecurity Outlook 2026" on January 28, 2026,...
Learn more

Nike attacked by ransomware group WorldLeaks 1.4TB of trade secrets leaked Hong Kong supplier worried about the implication

Nike, the global sportswear giant, was attacked by the international ransomware organization WorldLeaks in January 2026, which involved the theft of 1.4 terabytes of internal data and a total of 188,347 files, and the hackers even set up a countdown timer to threaten to disclose all the contents, which has aroused the concern of the global business community and cybersecurity industry....
Learn more