Chow Sang Sang suspends website amid possible data extraction

Chow Sang Sang disclosed a data-security incident in a Hong Kong stock-exchange filing on November 12, saying it first detected unauthorized system access on November 9. Its membership system and official e-commerce channels were affected. Some customer and employee information was accessed; possible extraction remained under investigation. The jeweller engaged cybersecurity experts, reported the incident to Hong Kong’s privacy regulator and police, and began notifying potentially affected people.

The disruption was already visible to shoppers. Economic Information Daily’s website reported on November 13 that Chow Sang Sang’s website displayed a service suspension. Jiemian reported that Tmall and JD.com flagship stores and physical shops continued operating. Read alongside the website notice, that makes the distinction between sales channels important: the company’s own site was unavailable, but other purchasing options remained. For shoppers, the practical questions are where they can place an order and which customer-service channels remain accessible.

The notice on Chow Sang Sang’s website also warns about calls, text messages and emails impersonating the jeweller, financial institutions or electronic-payment platforms. It tells customers to avoid unfamiliar links and not disclose card details, verification codes or account passwords. The suspended website retains customer-service contact information and says physical shops remain open. Customers therefore still have published company channels through which to check orders and ask questions while online service is unavailable.

The incident involves a jeweller with a substantial physical footprint. Unaudited third-quarter operating figures released on October 16 showed 739 jewellery stores and 16 watch stores at the end of September. Group retail sales value rose 3% from a year earlier, while mainland Chinese online sales edged down against the previous year’s comparison. Think of that network as a shopping center with several entrances: its own website, platform stores and physical counters. Closing one entrance can leave the others open, while disrupted membership services still need repair.

Jiemian reported on November 13 that the brand said its investigation was continuing; the company had not announced affected-person numbers or a restoration timetable. The next useful developments will be a clearer account of affected customers and data categories, alongside a plan to restore services. Specific, verifiable personal notifications will help customers more than a general announcement of an intrusion. The incident also illustrates why maintaining the security of membership and e-commerce services remains part of a retailer’s everyday relationship with shoppers long after those services launch.

Announcement published: November 12, 2026, 21:30 Beijing time / November 12, 2026, 08:30 U.S. Eastern time (EST).