Cybersecurity · Industry brief

Hong Kong's Securities and Futures Commission (SFC) reprimanded and fined Luk Fook Securities HKD2.1 million for inadequate cybersecurity controls following a September 2022 ransomware attack that disrupted trading systems for over two weeks. The SFC's investigation identified systemic deficiencies including lack of firewall protection, outdated systems, weak access controls, poor password management, insufficient remote access controls, and inadequate staff training. The SFC determined the firm failed to comply with cybersecurity requirements under multiple regulatory frameworks, characterizing the failings as "systemic" and finding misconduct. This represents the SFC's first enforcement action arising from an actual cyberattack and signals a shift from guidance to direct financial penalties for control failures even without evidence of client loss. The decision reinforces that cybersecurity is a senior management accountability issue and reflects broader Hong Kong regulatory expectations, with both the SFC and HKMA increasingly using supervisory powers to hold licensed firms directly accountable for cyber risk management as sectoral regulators step into this space absent a general cyber resilience law.

Keyfactor secured more than $1 billion in strategic growth capital led by Summit Partners, with existing investors Insight Partners and Sixth Street Growth maintaining significant ownership. The digital identity and machine identity management provider plans to use the investment for product development, international expansion, recruitment, strategic acquisitions, and expanding security products for AI and post-quantum environments. (Source: Intellizence Startup Funding Dataset)