If your company could not log in to email, the trading platform and the file servers tomorrow morning, what is the first thing you would think about?
"Are the backups any good? How long until systems are back?"
For a regulated firm there is a second question that matters just as much: were there security gaps that had been avoidable all along, and that nobody had dealt with?
An emerging ransomware group called Orova recently claimed to have added five Hong Kong companies to its dark web leak site, spanning asset management, travel, retail and manufacturing. Those claims remain unconfirmed by the companies named.
In the same period, Hong Kong's Securities and Futures Commission publicly reprimanded Luk Fook Securities (HK) Limited and fined it HK$2.1 million. The reason was not simply that the firm was hacked. The investigation found multiple failings in its cybersecurity controls, which left it unable to withstand a ransomware attack and delayed full recovery by about three weeks.
According to the SFC, the attack occurred on 19 September 2022, disrupting the trading platform, email, file and accounting servers, and systems were not fully restored until 7 October. It is the SFC's first disciplinary action arising from an actual cyberattack that disrupted a licensed corporation's trading systems.
The problem was not one vulnerability
The SFC did not find a single hole. It found several basic controls falling short at the same time, which is a more important finding than the size of the fine.
The weaknesses set out in the announcement include:
--- Inadequate protection of remote access systems.
--- Insufficient firewall and network monitoring capability.
--- Outdated operating systems and anti-virus software.
--- Weak management of privileged accounts and passwords.
--- Passwords stored in unencrypted files.
--- Incomplete backup and business continuity arrangements.
--- Insufficient staff cybersecurity training.
The details are in the SFC's press release (ref 26PR118).
The incident affected file servers, the domain controller, email, trading and accounting systems, and full recovery took roughly three weeks.
What makes this case worth an IT team's attention is that the exposure was not "do we have a vulnerability". It was whether the whole set of controls kept working over time.
Why are backups not enough?
Ransomware today rarely just encrypts files. An attacker typically gets in, looks for valuable data, takes it out, and only then encrypts systems and threatens to publish what was stolen.
So backups answer one question: can we restore after systems break?
They do not answer the other: once data has been taken, will it be published?
Even after a successful restore, a firm can still face:
--- Leakage of client and staff data.
--- Disclosure of commercial secrets.
--- Client notification and trust problems.
--- A regulatory investigation.
--- Incident handling and legal costs.
--- Business continuity and reputational loss.
So the question for an IT team is not "do we have backups" but:
--- Are backups isolated from the production network?
--- Has a restore actually been tested recently?
--- Is anyone watching for bulk downloads and unusual outbound transfers?
--- Do critical systems have a clear recovery priority order?
Why does this become a regulatory matter?
For a firm under SFC supervision, cybersecurity is not purely an IT operations concern.
The SFC expects licensed corporations to review and strengthen vulnerability patching, threat detection, incident response, backup and business continuity arrangements. Its guidance also states that firms should regularly test incident handling and response procedures, and regularly back up business records, client and transaction data while confirming that the backup copies are usable.
So the regulator's interest is not limited to whether clients lost money directly. It also covers:
--- Has the firm taken reasonable protective measures?
--- Are significant vulnerabilities patched promptly?
--- Is remote access properly protected?
--- Can the backups genuinely support business recovery?
--- Can the firm isolate affected systems quickly?
--- Does management know about the risk?
--- Can the firm show it has been testing and improving controls?
The action against Luk Fook Securities shows that even with no evidence of direct client financial loss, long-standing systemic cybersecurity failings can still lead to a disciplinary outcome.
Compliance is not a document
For an IT team, compliance is not having a cybersecurity policy. It is being able to show the controls in that policy have actually been running.
For example:
--- Are vulnerabilities patched by risk and priority?
--- Are backups tested regularly, with restores that actually succeeded?
--- Has the incident response plan been rehearsed, not just written?
--- Are administrator and third-party privileges reviewed on a schedule?
--- When something is found, is there a named owner and a follow-up record?
The SFC also requires internet brokers and virtual asset trading platforms to establish prompt response procedures for hacking incidents and, where applicable, to report to the SFC immediately. After an incident, firms should carry out root cause analysis, keep a detailed incident report and implement remedial measures.
Those records will not stop every attack. But after an incident they are what shows whether the firm had taken reasonable, continuous and effective protective measures.
Is this only a financial services problem?
No. The fine involved a securities firm, but the underlying weaknesses are not confined to finance.
Remote access, privileged accounts, vulnerability patching, backups and incident response are common risks for ordinary companies, NGOs, schools and professional services firms too.
For a financial institution these controls can carry direct regulatory consequences. For everyone else they can still affect:
--- Business continuity.
--- Client trust.
--- Contractual and supplier requirements.
--- Personal data protection obligations.
--- Insurance and incident handling arrangements.
In other words, not being directly supervised by the SFC does not mean weak cybersecurity controls carry no real consequences.
Six things an IT team can check first
This is not a compliance exam to be finished in one sitting. It is a starting point for finding the risks worth handling first:
--- 1. External assets: is there a complete inventory of VPN, RDP, websites, domains and public IPs?
--- 2. Accounts: have administrator, third-party and departed-staff accounts been reviewed?
--- 3. Patching: do significant vulnerabilities have a named owner, a deadline and a completion record?
--- 4. Backups: are they isolated from the production network, and did the last restore succeed?
--- 5. Detection: can you detect unusual logins, privilege escalation and bulk data leaving the network?
--- 6. Notification: after an incident, is it clear who tells management, the regulator and clients?
Not being able to answer immediately does not prove there is a problem. It does mean these areas are worth confirming.
What this case actually costs
The reason one ransomware attack turned into a HK$2.1 million regulatory bill was probably not only what the attacker did. It was whether the firm had kept the expected controls running beforehand, and whether it could demonstrate that.
You do not need to become a cybersecurity expert. You do need to know this: if an attack happened today, which systems would be affected, who would handle it, how long recovery would take, and whether your current controls meet your business and applicable compliance requirements.
Cybersecurity does not have to start with buying more tools. It starts with understanding the environment you already have. Reviewing external assets, remote access, account privileges, backup recovery and incident notification, then identifying the gap that most needs attention, is often already the first real reduction in risk.
If any of the six questions above cannot be answered right now, a Security Health Check covering external assets, account privileges, backup recovery and incident response is a reasonable place to start, working from where you actually are and ranking improvements by risk and compliance requirement.
Because after an incident, the hardest question is often not "when will systems be back?" It is "why were these gaps never found and fixed?"
Note: the victim list claimed by Orova remains unconfirmed by the companies named. This article is not legal or compliance advice; actual reporting and regulatory obligations should be confirmed against your own industry, licence and applicable regulations.
Reviewed by the UD information security team.
🛡️ Ready to Strengthen Your Security?
UD is a trusted Managed Security Service Provider (MSSP)
With 20+ years of experience, delivering solutions to 50,000+ enterprises
Offering Pentest, Vulnerability Scan, SRAA, and a full suite of cybersecurity services to protect modern businesses
From external asset inventory to backup recovery and incident response, we will walk you through every check step by step and help you rank what to fix first.