SFC Fines Luk Fook Securities for Ransomware Incident

• •LFSHK fined HKD2.1 million for inadequate cybersecurity controls after a ransomware attack.
• •The ransomware incident disrupted critical IT systems, affecting client trading for over two weeks.
• •The SFC's action signals a shift towards stricter enforcement of cybersecurity regulations in Hong Kong.

On September 19, 2022, Luk Fook Securities (LFSHK) experienced a ransomware attack that severely disrupted its IT infrastructure, affecting critical systems including file servers and trading applications. The Securities and Futures Commission (SFC) of Hong Kong fined LFSHK HKD2.1 million for failing to implement adequate cybersecurity controls. The attack compromised client trading capabilities, limiting them to orders through account executives for over two weeks. LFSHK self-reported the incident, revealing that hackers exploited its remote access system. The SFC's investigation found systemic deficiencies in LFSHK's cybersecurity policies, leading to the enforcement action. This marks a significant shift in the SFC's approach to cybersecurity enforcement, emphasizing senior management accountability. The decision reinforces the expectation for firms to maintain robust cybersecurity governance and incident response capabilities.