Shun Hing Group data breach: were your name and home address exposed?

On 20 March 2026, Shun Hing Group, the Hong Kong distributor for Panasonic and other household brands, detected a cyberattack that allowed unauthorized access and damaged its systems. It told the police and Hong Kong’s privacy regulator, the PCPD, which received the notification on 23 March and opened an investigation.

The PCPD, citing the company’s latest figures in early July 2026, said personal data of more than 921,000 people may have been exposed: about 920,000 customers (names, addresses, phone numbers and email addresses) and about 1,000 staff and supplier personnel, who also had identity-document numbers, bank-account details and salary information involved. Attackers also locked files holding personal data of about 1.05 million people, almost all customers. Shun Hing’s own notices confirm the attack and the customer data types, and said it had no evidence of misuse. The PCPD inquiry was still open as of July 2026.

What this actually means if you bought an appliance

Most reports lead with the round million, the watchdog, and the company’s line that nothing has been misused. That last sentence is easy to hear as “you’re fine.” It is not the same as saying a copy was never taken, or that a copy was destroyed.

For a typical customer, this is not a stolen-password story and it is not a drained-bank-account story. Those fields are not in the customer data the PCPD listed. What may be out is the same combination a courier already needs: your name, your phone, your email, and the address where an appliance was registered or delivered. That mix is what lets a stranger call and sound like the service desk for a machine that really is in your home, or message you about PanaClub, a warranty, a visit, or “help” with this very incident.

The 1.05 million figure is about files being locked inside the company. The 921,000 figure is the privacy problem — people whose details may have been exposed. Shun Hing later said its PanaClub system was suspended. None of this tells you, personally, whether your record was included. There is no reliable public lookup that can answer that, and a clean result from any breach-checking site would not prove you were spared.

What to actually expect

• Calls, texts or emails that already know your name and address, claiming to be Shun Hing, Panasonic, PanaClub, a technician, the police, or the privacy regulator — often asking you to click, pay a fee, confirm an identity document, or “verify” so they can protect you.
• No personal yes-or-no letter. The company’s published statements were general. Silence does not mean you were left out.
• If you are one of the roughly 1,000 employees or supplier contacts, a different problem: possible misuse of an identity-document number, a bank account or salary details, not just a nuisance call.
• The company’s public position as of its July 2026 update was that it had seen no evidence of misuse. Read that as “not seen yet,” not as a guarantee it will stay that way.

What you can and cannot fix

If your name, phone number, email address or home address was in this file, that copy cannot be pulled back. Nobody can delete it from whoever took it. For the smaller group of staff and suppliers, an identity-document number, bank-account number and salary record cannot be undone either. An address that is out is out.

There is also no way for an article or a scanner to tell you whether you were one of the 921,000. Do not treat a “no match” on some other website as proof you were safe here.

• Treat unsolicited appliance or “breach help” contact as fake. Anyone citing this incident already has a reason to sound official. If you need to speak to Shun Hing, use a number or website you already had — not a link or number they just sent.
• Do not hand over more than they already may have. A customer record in this incident is not described as holding identity-document numbers or bank details. Anyone who asks for those, or for a one-time code, a payment, or control of your phone, is trying to turn a contact list into a fraud.
• If you are staff or a supplier contact, put the bank and identity watch first. That group is about 1,000 people, not 920,000. Alerts on the real account, and a fast check if a new loan, card or mobile registration appears in your name, matter more than anything a customer needs to do.
• Shrink the rest of your public footprint. A leaked name and home address become much more useful when they can be joined to people-search pages and old directories that add relatives, extra phone numbers, employers and previous addresses. Those listings, unlike the stolen file, can actually be removed. That is the lever you still have: make the leaked record a dead end instead of a starter kit.