Look, the story a regulated firm here has to register today isn't the Sogou Input Method backdoor, real as CVE-2026-51990 is for any bank running mainland Chinese staff on Windows boxes (Kai Tanner's filing). It's Cheung Kwok-keung's item on card fraud: almost 700 people telling Hong Kong banks that someone bought iPhones, HK$8,000 to HK$10,000 a pop, on cards they never authorized. Banks issued a warning telling customers to check their statements. Nobody named which bank, which network, or where the card numbers leaked. Separately, the SFC banned Mok Cheuk Ling from the industry for 42 months on September 11, and suspended dealings in Cloudbreak Pharma over suspected IPO rigging on September 10, both routine enforcement, neither bearing on a bank's fraud-detection obligation the way the iPhone cluster does.

Here's the read for a compliance head or CISO at an authorized institution: 700 near-identical unauthorized transactions in one window is not 700 customer errors, it's a pattern that should have tripped velocity and merchant-category rules in transaction monitoring before the 700th filing, let alone the first (the HKMA's Supervisory Policy Manual TM-G-1 puts fraud detection controls squarely on the institution, not the cardholder's vigilance). Telling customers to watch their statements is the bank outsourcing detection it's supposed to own. The arithmetic that matters isn't the HK$8,000 ticket size, it's the count: 700 reports means either one compromised merchant or payment processor feeding a card-testing operation, and HKMA's Banking Conduct Department has not said which banks reported it or whether unauthorized-transaction reimbursement claims are being processed under the voluntary code banks already signed up to.

No consultation or hearing date has been set on this cluster yet. Watch RTHK and the HKMA's press release queue for whether an individual institution gets named, because until one is, "under investigation" is doing the work that a breach disclosure should be doing.