Hong Kong's Department of Health announced on October 24, 2026, that the email account associated with its HIV Testing Service website was suspected of unauthorized use to send fraudulent exposure notices.
Unauthorized messages sent to public
According to the Department of Health (DH), emails and text messages (SMS) were distributed to members of the public under the guise of the agency. The messages claimed recipients were exposed to Human Immunodeficiency Virus (HIV) and urged them to seek medical advice and get tested as soon as possible.
The DH stated that it did not send the messages and does not notify individuals in this manner. The department confirmed that its ongoing investigation has found no evidence of data loss or leakage.
Investigation and service suspension
Upon discovering the incident, DH personnel inspected the network system alongside an outsourced service provider overnight. The department reported the matter to the Police and notified the Digital Policy Office.
The HIV Testing Service website (www.hivtest.gov.hk) has been suspended while cybersecurity experts conduct an investigation and review to confirm the system poses no security risks. While the website remains offline, the public can still contact the Acquired Immune Deficiency Syndrome Hotline to arrange free, anonymous, and confidential testing.
What to do
- Do not click on links or submit personal information if you receive suspicious emails or SMS messages claiming HIV exposure.
- Contact the Police if you have provided personal details to suspicious senders or suspect you have been scammed.
- Call the Acquired Immune Deficiency Syndrome Hotline at 2780 2211 to book a free, anonymous, and confidential HIV antibody test while the website is suspended.
Key facts and where they come from
- The email account for the DH HIV Testing Service website is suspected of being misused to dispatch deceptive messages.
the email account for its HIV Testing Service website (www.hivtest.gov.hk) was suspected of being misused, with emails and text messages (SMS) sent to the public
- The unauthorized messages claimed recipients were exposed to HIV and instructed them to seek medical care.
claiming that the recipients are exposed to Human Immunodeficiency Virus (HIV), and should seek medical advice and get tested as soon as possible.
- No data loss or data leak has been detected following the incident.
has not yet found any evidence of data loss or leakage.
- The website was taken offline to allow cybersecurity specialists to inspect the system.
The HIV Testing Service website will be suspended starting today until cybersecurity experts have conducted a comprehensive investigation and review
