Shangri-La apologises following data leak affecting nearly 2,000 staff

Shangri-La Hotels has apologised after 1,941 part-time employees’ information was accidentally sent to employees at Kowloon Shangri-La and JEN Hong Kong by Shangri-La.

Meanwhile, the Office of the Privacy Commissioner for Personal Data (PCPD) has received five related complaints as of noon today (8 May 2024) and is investigating the suspected personal information leakage.

In a statement to MARKETING-INTERACTIVE, a spokesperson from Shangri-La said the hotel was informed yesterday morning that there was an incident involving the leakage of the personal information of its casual staff at Kowloon Shangri-La and JEN Hong Kong by Shangri-La.

“After our internal investigation, we identified that an email was sent by mistake due to a system error with the casual labour management system. We sincerely apologise to all affected staff for any inconvenience caused,” the statement reads. 

The spokesperson clarified that the data leak did not involve the data of other employees and its hotel customers. Meanwhile, Shangri-La is informing the affected staff and is investigating the cause of this incident.

“We will take all necessary steps to prevent any recurrence. We understand the concerns of the staff affected by this incident. We plan to report this matter to the PCPD shortly,” the spokesperson added.

It comes as a former employee of Kowloon Shangri-La Hotel told HK01 that he received an email titled "no subject" last night. The email contained a document with the personal information of 1,941 employees. One of his friends who works at the hotel also received the same document around the same time, raising suspicions of a data breach at the hotel. He estimated that the document was mistakenly sent to 1,941 individuals, said the report. 

According to the report, the former employee said their Hong Kong Identification (HKID) number was required to access the document. It would be difficult to access the document unless someone knows their identification number. Meanwhile, the document consists of 1,941 pages and is an English tax form containing personal information such as gender, marital status, identification numbers, addresses, and income of those 1,941 individuals.

The document is suspected to have been sent by the Human Resources (HR) department of Shangri-La, according to the report. The former employee said although he and his friend reached out to the hotel  regarding the incident, they have not received a response from the hotel thus far.

Don’t miss: Shangri-La's hotels face cyber attacks affecting 290,000 consumers

In fact, this is not the first time that Shangri-La Hotels and Resorts has been involved in a data breach incident. Back in September 2022, three hotels in Hong Kong under Shangri-La (Asia), including Island Shangri-La, Hong Kong; Kerry Hotel, Hong Kong and Kowloon Shangri-La, Hong Kong, suffered cyber-attacks, affecting the personal data of over 290,000 customers.

Shangri-La announced to its members that it found that there were professional cyber attackers who bypassed its information technology security monitoring system and illegally entered the guest data of its eight hotels from May to July 2022. 

The hotel group also said that some files were leaked, which may include personal information such as names, phone numbers and mailing addresses while it assured that passports, ID numbers and credit card numbers are encrypted and protected.

Join us this coming 26 June for Content360 Hong Kong, a one-day-two-streams extravaganza under the theme of "Content that captivates". Get together with our fellow marketers to learn about AI in content creation, integration of content with commerce and cross-border targeting, and find the recipe for success within the content marketing world!

Related articles:

Island Shangri-La highlights commitment to family travel with new luxury space
Shangri-La Group's Daniel Koo steps up as vice president of digital
Shangri-La onboards AXA's Andrea Wong as SVP of group marketing and communications