Hong Kong public health HIV test website restored after email misuse
Hong Kong's Department of Health restored its HIV testing service website after discovering on 23 October that a backup function was misused to send fake emails and texts claiming recipients were at risk of HIV. No real messages reached the public. Police and digital policy office were informed.
Hong Kong's Department of Health announced on 29 October that its HIV testing service website had resumed normal operation after a security incident was discovered on the evening of 23 October.
Department staff found that the website's email account had been suspected of improper use, with unauthorised emails or text messages sent claiming recipients were at risk of HIV infection and urging them to seek medical help and testing. The department immediately conducted a full network system check, reported the case to police and notified the Digital Policy Office.
Initial investigations showed that a backup function of the website had been improperly used. The probe confirmed that all recipients' email addresses and phone numbers were invalid, meaning no members of the public received the false messages. After a comprehensive review by cybersecurity experts, the system's security vulnerabilities have been repaired.
The Department of Health said it places great importance on network security, conducts regular information security risk assessments, and continuously reviews and improves its security measures to ensure they keep pace with evolving threats. It will conduct a full review of the incident and strengthen protection measures to prevent similar occurrences in future.