In August 2025, the Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) released the Q2 2025 Hong Kong Security Watch Report（https://www.hkcert.org/watch-report/hong-kong-security-watch-report-q2-2025）. While the total number of cybersecurity incidents declined, website defacement cases surged by 168% quarter-on-quarter, making it the fastest-growing attack type. For Hong Kong enterprises—especially SMEs—this trend highlights critical gaps in vulnerability management, web application security, and governance. This article summarizes the key findings of the Q2 report, analyzes the underlying risks and SME challenges, and outlines governance recommendations based on international standards such as ISO/IEC 27001, SRAA, and PIA.
HKCERT Q2 2025 Report: Website Defacements Surge in Hong Kong
Key Findings from the Q2 Report
According to HKCERT’s Q2 2025 report, Hong Kong’s cybersecurity landscape showed the following trends:
- Website defacements increased sharply — up 168% QoQ, becoming the most prominent threat.
- Phishing incidents declined by 12.2% — suggesting a tactical shift by attackers, though still prevalent.
- Botnet activity dropped by 14% — slightly reduced but still a long-term risk.
- Overall incidents decreased by 12.5% — fewer total cases, but more concentrated risks.
Main Technical Causes of Website Defacement (Q2 2025):
- Unpatched system vulnerabilities (28.4%)
- Web application flaws (25.5%)
- SQL injection (23.5%)
- Server intrusions (13.7%)
- Configuration and management errors (3.9%)
- File inclusion vulnerabilities (2.9%)
These figures reveal that insufficient vulnerability management and secure coding practices remain critical weaknesses for many Hong Kong enterprises.
Governance Challenges Facing SMEs
HKCERT emphasized that SMEs are particularly vulnerable to cybersecurity risks, mainly due to:
- Lack of transparency — unclear channels for identifying and contacting qualified service providers.
- Difficulty assessing providers — challenges in evaluating reliability and compliance.
- Knowledge gaps — limited in-house expertise to detect and remediate security issues.
A 2024 joint survey by the PCPD and the Hong Kong Productivity Council (HKPC) found that 71% of large enterprises and 69% of SMEs had experienced cyberattacks within the past 12 months. This demonstrates that cyber threats are universal, but SMEs face greater challenges due to resource constraints and insufficient preparation.
Governance Pathways for Enterprises
The Q2 report’s surge in website defacements underscores persistent gaps in vulnerability management, compliance governance, and resilience building.
As DQS HK has observed, many enterprises remain reactive—focused on post-incident remediation—rather than building a sustainable defense strategy.
To address this, enterprises should strengthen three governance pillars:
- Security Risk Assessment & Audit (SRAA) — Identify exposed assets, prioritize vulnerabilities, and allocate resources to the most critical areas.
- Privacy Impact Assessment (PIA) — Ensure compliance with PDPO and the upcoming Critical Infrastructure Ordinance, reducing regulatory and reputational risks.
- ISO/IEC 27001 ISMS — Establish a formalized, auditable, and continuously improving security management system, moving from ad-hoc fixes to structured governance.
Strategic Cybersecurity Actions for Enterprises
For the remainder of 2025, enterprises should focus on three key cybersecurity priorities:
- Strengthening website and application security — conduct regular scans and patching for CMS platforms, plugins, and web applications.
- Integrating governance and compliance — align SRAA, PIA, and ISO/IEC 27001 into a unified, long-term governance model.
- Enhancing talent and awareness — build employee training programs to improve detection of phishing, malware, and social engineering attacks.
Conclusion
The HKCERT Q2 2025 report delivers a clear message: a decrease in incident volume does not equate to reduced risk. The sharp rise in website defacements demonstrates that even “basic” attacks can seriously disrupt business continuity and damage reputation.
Hong Kong enterprises must move beyond reactive measures and adopt a proactive, compliance-driven security strategy. By implementing SRAA, PIA, and ISO/IEC 27001, and leveraging external expertise where needed, organizations can strengthen resilience, ensure regulatory readiness, and build long-term trust with clients and partners.
Cybersecurity is not an additional cost—it is an essential foundation for competitiveness and compliance in Hong Kong’s digital economy.
Associated Services by DQS HK
DQS Hong Kong
DQS – Leveraging Quality, Driving Success.
DQS empowers organizations worldwide to build trust, drive innovation, and achieve sustainable growth by certifying the future of business. Founded in 1985, DQS has grown into a global leader in the assessment and certification of management systems, with a team of 3,000 highly qualified auditors delivering over 130,000 audit days per year in more than 60 countries. Through internationally recognized certifications across 200+ standards, DQS helps businesses manage risks, ensure compliance, and unlock new opportunities in an evolving regulatory and business landscape.
Thinking beyond compliance, DQS is a trusted partner for digitalization, automation, and sustainability leadership. The company’s expertise covers a wide range of areas, spanning from cybersecurity and AI governance to ESG compliance, supply chain management, medical device safety, and future mobility, delivering real value to industries in their pursuit of resilient, sustainable, and intelligent systems. By leveraging advanced auditing methodologies, predictive analytics, and real-time insights, DQS supports organizations to future-proof their operations while demonstrating their commitment to excellence and responsible business practices.
