SoFi Hong Kong 2026 Data Breach

In an email to customers, SoFi Hong Kong said it detected unauthorized access through one of its providers to a database belonging to SoFi Securities (Hong Kong) Limited. A company spokesperson separately confirmed the breach to BleepingComputer. These primary statements establish a completed third-party data-access event rather than merely suspicious activity.

April 30 is the company's detection date, not the attacker's initial-access date or duration in the database. The public account does not identify the exploited vulnerability, compromised account, network path, or exfiltration method. Because the provider was not named, no platform or company is labeled as technically responsible.

SoFi confirmed access to a customer database while saying it did not yet know whether, and which, categories of personal data were involved. Customer names, contact details, identity documents, account numbers, transaction history, password hashes, and financial records were not individually confirmed by the company.

This broad description identifies the system type without claiming that every customer field was stolen. The record can be updated with more specific classes if the investigation determines which rows and fields were viewed or copied.

SoFi did not disclose how many customers were affected, and its spokesperson declined additional questions on that point. SoFi Hong Kong's total customer or account count is not a breach total, and copying of the entire database was not confirmed. The organization did not publish a verifiable affected-person or record total. An undisclosed count does not mean the incident had no impact; it means the public sources do not provide a reliable total.

Zero does not mean that the event had no customers or no impact. Customer notifications and extra monitoring on affected accounts indicate potential person-level impact but provide no unique total.

The confirmed access occurred in a database held by an outside provider on behalf of SoFi Hong Kong. The disclosure does not say that all United States banking, lending, investing, or other systems operated by SoFi Technologies were compromised.

Because the provider and any impact on its other customers were not disclosed, the event should not be merged with unrelated supply-chain cases. The phrase third party also does not prove that a particular SaaS product, cloud vendor, or integration was the attack path. Technical attribution remains open until supporting evidence emerges.

After detection, SoFi engaged an outside cybersecurity firm to respond and investigate scope and impact. Additional safeguards and monitoring were applied to affected accounts. The company said support requests or account changes might require customers to provide extra verification information.

Customers were advised to watch for suspicious emails and messages, phishing attempts, and unusual account activity. SoFi recommended updating passwords, enabling two-factor authentication where possible, monitoring financial accounts, and avoiding links or attachments in unsolicited messages. These are precautionary steps and do not prove a specific password or financial-data exposure.

This record confirms unauthorized access to a SoFi Hong Kong customer database; it does not identify which personal fields were accessed or how many people were affected. Unverified person counts, data fields, and threat-actor claims are not treated as part of the public incident scope. The content preserves the investigation's stated uncertainty.

The verified conclusion is that SoFi Hong Kong detected unauthorized access to a third-party customer database on April 30, 2026, engaged outside experts, warned customers, and applied additional protections. The provider, attacker, technical method, person count, accessed categories, and extent of copying were undisclosed, so the record uses a broad data category and unknown total.