Hong Kong Disneyland suspends ticket system after 17,000 QR codes allegedly stolen
Hong Kong Disneyland has suspended its online ticketing system after about 17,000 QR codes were allegedly stolen. Police are investigating the incident as computer misuse. A cybersecurity expert said the breach suggests possible vulnerabilities in QR code generation, storage and verification.
Hong Kong Disneyland has confirmed a cybersecurity incident involving its online ticketing system, with about 17,000 QR codes suspected of being stolen. The park has suspended its official ticketing system and stepped up ticket verification procedures at entry.
Police have classified the case as “obtaining access to a computer with criminal or dishonest intent” and no arrests have been made so far, according to a source. Hong Kong Disneyland said it had taken immediate follow-up and protective measures.
Fang Po-kiu, honorary president of the Hong Kong Information Technology Chamber of Commerce, said he believed the system was hacked. He described the suspension of online ticket sales before a full investigation into possible data theft as “appropriate and necessary”.
From a cybersecurity perspective, Fang said the incident indicates possible vulnerabilities in how QR codes are generated, stored and verified in the ticketing system, allowing attackers to harvest valid ticket credentials from third-party platforms in large quantities.
Fang outlined three critical steps: fully strengthening ticket verification at entry to prevent reused QR codes; thoroughly checking system logs to determine the scope and whether personal data was leaked; and promptly notifying regulators and law enforcement, including the Privacy Commissioner's Office, as required.
He also reminded the public to buy tickets only through the park's official channels or authorised travel agents and platforms, and to avoid unverified sellers. Anyone who has purchased tickets from unofficial sources should check with the park or police to avoid inconvenience and financial loss.
