Crazy Rich Hong Kong | Cybersecurity, Digital Trust and the Security Economy begins with an uncomfortable fact: the richer a digital economy becomes, the more valuable it becomes to attack.
Search for “Hong Kong cybersecurity”, “HKCERT”, “cyber security Hong Kong”, “phishing Hong Kong”, “critical infrastructure cyber security” or “Hong Kong cyber attack” and the threat numbers are moving quickly.
HKCERT recorded a record 15,877 cybersecurity incidents in 2025, up 27% year on year. Phishing represented 57% of those cases. In the first half of 2026, HKCERT received another 8,358 incident reports, with phishing accounting for 63%.
On 1 January 2026, Hong Kong’s Protection of Critical Infrastructures (Computer Systems) Ordinance also came into effect, creating a dedicated legal framework for computer systems supporting essential services.
The Crazy Rich story is not fear. It is the creation of trust infrastructure for an economy that increasingly lives inside networks.
Did You Know? Cybersecurity Is an Economy of Things That Did Not Happen
A successful security system often produces no visible event.
No account was stolen.
No hospital system stopped.
No bank transfer was diverted.
No database leaked.
That makes cybersecurity difficult to value because success looks like normal life continuing.
15,877 Incidents in 2025
HKCERT’s 2026 outlook reported 15,877 incidents in 2025, the highest annual figure in its dataset and 27% above 2024.
The scale matters because cyber incidents are not confined to technology companies.
Banks, retailers, schools, logistics firms, households and government agencies all depend on digital systems.
The attack surface is civilisation-wide.
Phishing Is Still the Dominant Threat
About 57% of Hong Kong’s 2025 incidents were phishing.
In the first half of 2026, phishing represented 63% of reported cases.
Why does such an old attack remain effective?
Because the vulnerability is often human interpretation rather than software.
The attacker tries to make the message believable enough that the victim completes the attack personally.
AI Makes Social Engineering Better
Generative AI can help attackers write convincing messages, mimic tone, translate naturally and create large numbers of tailored lures.
That reduces the obvious spelling and grammar mistakes that once helped users identify scams.
The defence therefore cannot rely only on spotting awkward language.
People need stronger verification habits.
Cybersecurity Is a Human–Technology Interface Problem
A secure system can still fail if a user gives away a password.
A careful user can still fail if insecure software is exploited.
Good security therefore exists at the interface between humans and machines.
Technology must be secure enough for real human behaviour—not idealised human behaviour.
The Critical Infrastructure Ordinance
Hong Kong’s Protection of Critical Infrastructures (Computer Systems) Ordinance came into operation on 1 January 2026.
It creates obligations around governance, prevention and incident response for designated operators of critical infrastructure and critical computer systems.
The significance is larger than compliance.
It formally recognises that digital failure can disrupt essential physical services.
What Counts as Critical Infrastructure?
Critical infrastructure can include systems supporting essential functions such as banking, transport, communications and other major services.
The exact designation matters because not every computer is equally consequential.
Cybersecurity policy must prioritise the systems whose failure would cause the largest real-world damage.
Cybersecurity Is Also Business Continuity
A ransomware attack can stop manufacturing.
A compromised logistics system can delay goods.
A payment outage can halt sales.
Cybersecurity therefore belongs inside business continuity planning, not only the IT department.
The attack begins in software.
The loss appears in operations.
Supply-Chain Risk Changes the Security Boundary
A company can secure its own network and still be compromised through a software vendor, cloud provider or managed-service supplier.
HKCERT identified supply-chain risk as one of the major cybersecurity concerns for 2026.
This changes the definition of “your system”.
Your security perimeter increasingly includes other companies.
Why Patching Still Matters
Many attacks exploit known vulnerabilities that organisations have not repaired.
HKCERT reported 2,328 vulnerable-system incidents in 2025, more than 3.5 times the previous year.
Cybersecurity can sound futuristic.
Sometimes the most important action is simply updating the machine.
iAM Smart: Digital Identity Requires Digital Trust
Hong Kong’s iAM Smart system lets residents authenticate themselves for digital services.
Digital identity reduces friction when it works well.
It also raises security requirements because a trusted identity credential becomes valuable to criminals.
Convenience and security grow together.
Banking Makes Cybersecurity Financially Immediate
A compromised entertainment account is annoying.
A compromised bank account can move money immediately.
That is why finance invests heavily in authentication, transaction monitoring, encryption and incident response.
Hong Kong’s role as a financial centre makes digital trust economically central.
Cyberport and the Security Ecosystem
Cyberport connects FinTech, AI, data and cybersecurity companies inside one digital-technology cluster.
This is useful because cybersecurity is becoming a feature inside every technology product rather than a separate industry added later.
Secure-by-design is cheaper than panic-by-design.
Cybersecurity Talent Is Scarce
HKCERT’s 2026 research found that nearly 30% of surveyed enterprises lacked dedicated cybersecurity personnel.
This is a capability problem.
Tools can be purchased quickly.
Experienced judgement takes years to develop.
The bottleneck is often people.
Capture the Flag Competitions Are Training Infrastructure
Cybersecurity competitions let participants practise attacking and defending simulated systems.
The game format turns abstract technical knowledge into operational skill.
That matters because cybersecurity is learned partly through exposure to failure modes.
You understand a system differently after you have tried to break it.
Cybersecurity Has an Adversary
Many engineering problems involve passive constraints.
Cybersecurity is different.
The system is being tested by people who actively change tactics when defences improve.
That creates an arms race.
Security cannot be “finished”.
Quantum Computing Changes the Future Threat Model
Hong Kong officials have highlighted the long-term cybersecurity implications of quantum computing.
Certain future quantum capabilities could threaten cryptographic systems used today.
That means security planning must sometimes protect against a machine that does not yet exist at practical scale.
Long-lived data creates long-lived risk.
Singapore and Hong Kong: Digital Trust Hubs
Singapore and Hong Kong both depend heavily on banking, aviation, logistics and digital government.
That makes cybersecurity economically strategic in both cities.
Singapore has invested deeply in national cyber governance and digital identity.
Hong Kong’s 2026 critical-infrastructure regime adds a new regulatory layer to its existing HKCERT and Digital Policy Office ecosystem.
Both show that digital cities eventually need digital defence at national scale.
What Students Can Learn from Cybersecurity
Computer science
Networks, operating systems and software design determine where vulnerabilities can appear.
Psychology
Social engineering exploits trust, urgency and habit rather than code alone.
Mathematics
Cryptography depends on mathematical structures and computational difficulty.
Economics
Security spending is an investment in reducing expected future loss.
Civilisation mechanics
The more civilisation depends on digital substrate, the more protection of that substrate becomes a prerequisite for continuity.
Ten Vocabulary Words for Cybersecurity
1. Phishing
A deceptive attempt to trick users into revealing information or taking unsafe actions.
2. Malware
Software intentionally designed to damage, disrupt or gain unauthorised access.
3. Ransomware
Malware that blocks access to data or systems and demands payment.
4. Vulnerability
A weakness that can be exploited to compromise a system.
5. Patch
A software update designed to fix bugs or security weaknesses.
6. Botnet
A network of compromised devices controlled by an attacker.
7. Authentication
The process of verifying identity.
8. Encryption
Transforming information so that only authorised parties can read it.
9. Incident response
The organised process of detecting, containing and recovering from a cyber incident.
10. Critical infrastructure
Systems and services whose disruption could seriously affect society or the economy.
Frequently Asked Questions
How many cybersecurity incidents did HKCERT record in 2025?
15,877, up 27% year on year.
What was the biggest incident category?
Phishing, accounting for 57% of 2025 incidents.
What happened in the first half of 2026?
HKCERT received 8,358 incident reports, with phishing representing 63%.
What law took effect on 1 January 2026?
The Protection of Critical Infrastructures (Computer Systems) Ordinance.
Why does AI increase cyber risk?
It can automate and personalise phishing, fraud and attack workflows while also helping defenders analyse threats.
Why is cybersecurity economically important?
Digital attacks can interrupt banking, commerce, transport, healthcare and other systems that modern economic activity depends on.
Helpful Reading Across the Hong Kong and Singapore Graph
- Crazy Rich Hong Kong | Data Centres, Cloud and the AI Computing Infrastructure Economy
- Crazy Rich Hong Kong | Cyberport, FinTech and the Digital Assets Economy
- Crazy Rich Singapore | Cybersecurity, Digital Trust and the Security Economy
- Crazy Rich Hong Kong | HSBC, Banking and the Global Finance Economy
References and Current Sources
- HKCERT, Hong Kong Cybersecurity Outlook 2026.
- HKCERT, Mid-Year Review 2026.
- Hong Kong Digital Policy Office, Information and Cyber Security.
- Hong Kong SAR Government, Protection of Critical Infrastructures (Computer Systems) Ordinance Commencement, 1 January 2026.
Crazy Rich Hong Kong Makes Trust a Digital Asset
A digital city becomes powerful when transactions feel effortless.
That ease survives only when the systems underneath remain trustworthy.
Did you know? Cybersecurity is the price civilisation pays for making more of itself programmable.