Look, the story Kai Tanner filed today is about the gap between claim and confirmation: ShinyHunters says it pulled personnel data on every FBI employee through a previously unknown flaw in Oracle PeopleSoft, 404 Media reports, and Oracle has published no advisory naming the flaw. Separately, HKEX's Listing Division put out a consultation on Phase II of its Listing Framework Competitiveness Review (September 21), and the SFC's Enforcement Division got a worldwide freezing order extended against Lo Kai Bong and Major Success Group Limited (September 18). None of the three regulators' own notices this week (Exchange Fund Bills results, HKICL fraud alerts, a PBOC bill issuance circular) touch a bank's, broker's or insurer's own systems.

So here is the read for a Hong Kong firm running PeopleSoft or any HR platform like it: an authorized institution's exposure to an unconfirmed vendor zero-day sits in HKMA's SPM SA-2 outsourcing module, which covers due diligence on the arrangement and the institution's contractual right to get the vendor to tell it what happened (not a duty that activates only once Oracle confirms the flaw exists). An SFC-licensed intermediary running the same HR software answers to the ICG's internal-control and information-management standards instead, which is the general control expectation, not a named breach-notification clause (there is no module here that requires the firm to report a vendor's unconfirmed CVE to the SFC). The freezing order against Lo Kai Bong is a reminder of what Part VIII enforcement looks like once the SFC has facts; it has none yet on Oracle.

Watch Oracle's advisory queue, not the FBI's. Until Oracle names the flaw with a CVE number, no Hong Kong regulator has a filed instrument that requires anyone to act, and the HKEX Phase II consultation runs alongside it with its own clock, closing per the September 21 paper.