Suspected cyberattack puts data of 33,054 customers using group-buying app at risk

A suspected cyberattack has compromised the personal data of approximately 33,054 customers using the group-buying platform, Neigbuy, a subsidiary of TVB. The Office of the Privacy Commissioner for Personal Data confirmed receiving a notification of the breach on Sunday and launched an investigation. Signs of unauthorized data access were initially detected on August 24.

The compromised information consists of customers' names, addresses, emails, phone numbers, and shopping order histories. The privacy watchdog advised Neigbuy users to update their passwords and enable multi-factor authentication, urging vigilance when communicating with unknown or suspicious parties. Police reported six instances of fraudsters posing as Neigbuy customer service representatives over the past week, causing losses exceeding HK$300,000 (US$38,270).

Scammers were requesting order details and recipient information to execute their scams. Neigbuy confirmed the incident to the police and the privacy watchdog, isolating affected systems, updating account credentials, and tightening access controls and anomaly monitoring. They reassured customers that their passwords, credit card details, and bank account information remained secure.

The company emphasized the importance of customers remaining cautious of suspicious calls or messages, emphasizing that their staff would never request passwords, verification codes, or bank transfers.