Receipts attached 7 sources
Sources
-
Other source
Suspected unauthorised use of HIV Testing Service email account
False messages, investigation, no evidence of leak at statement time, hotline.
-
Other source
HIV Testing Service suspension notice
Suspension start, affected online functions, telephone booking hours.
-
Other source
AIDS Counselling and Testing Service
Free anonymous testing, rapid and conventional tests, results procedure and hours.
-
Other source
Yau Ma Tei Integrated Treatment Centre
Confirms ACTS at Yau Ma Tei Jockey Club Polyclinic; street address is on published service listing.
-
Other source
HIV post-exposure prophylaxis recommendations
Clinical PEP assessment and prompt initiation within 72 hours.
-
Other source
Anti-Deception Coordination Centre
24-hour Anti-Scam Helpline 18222.
-
Other source
HIV antibody testing kit image
NIAID, CC BY 2.0; illustrative only.
.jpg){kind=link}
Limits
The Department of Health had found no evidence of data loss or leakage as of its October 24 statement; this is not proof no leak occurred. It has not identified sender, method, message count or recipient-selection mechanism. The official site remained suspended when checked October 26 around 17:30 HKT. Medical advice in the article is general; clinical assessment determines PEP suitability.
Corrections
No correction notes have been added for this article.
A message arrives claiming to be from Hong Kong's Department of Health. It warns that you may have been exposed to HIV and urges you to seek medical advice and testing immediately.
The warning sounds serious. It appears to come from a public health authority. And for someone concerned about their HIV status, it could cause considerable anxiety.
But the Department of Health says such messages are not from it.
On October 24, the department disclosed suspected unauthorized use of an email account associated with its HIV Testing Service website. Emails and text messages had been sent to members of the public under the department's identity, claiming recipients had been exposed to human immunodeficiency virus (HIV) and needed prompt medical attention.
The department discovered the suspicious activity on the evening of October 23, inspected its network with an outsourced service provider overnight, notified the police and the Digital Policy Office, and suspended the testing website the following day.
Its initial investigation found no evidence of data loss or leakage. The investigation is continuing.
For anyone who received an alarming message, the most important distinction is this: an unsolicited warning of HIV exposure is not evidence that you have HIV, or even that you were exposed. At the same time, a suspicious message is not a substitute for medical advice if you have an independent reason to believe a genuine exposure occurred.
What the Department of Health actually confirmed
The department's October 24 announcement establishes several important facts.
An email account associated with the government's HIV testing website was suspected of misuse. Messages falsely presented as official notifications warned recipients of possible HIV exposure. The department said it had not sent those messages and did not notify individuals in that manner.
Officials began examining the network system with the outsourced service provider after discovering the incident. They also reported it to the police and notified the government's Digital Policy Office.
The department has not publicly established who sent the messages, how the account was misused, how many people received them, or how recipients were selected.
It has also not confirmed that the website's underlying patient or user information database was compromised.
Those distinctions matter. The incident is a suspected misuse of an email account, not a confirmed mass breach of HIV testing records.
No evidence of a data leak is not proof that a leak is impossible
The department's statement that investigators have found no evidence of data loss or leakage is reassuring, but it is necessarily limited to what has been established so far.
There is a difference between investigators detecting no unauthorized access to information and proving conclusively that no information could have been exposed. The department has not published technical findings sufficient to settle that question.
Nor has it explained whether the suspect messages were distributed using compromised email credentials, another weakness in the service, or some other mechanism.
The distinction is especially important for HIV testing. Privacy and confidentiality can determine whether people feel comfortable seeking testing in the first place.
The government service describes its testing as anonymous and confidential. It is not yet known whether any identifying information held by its online service was accessed in this incident.
For now, the accurate conclusion is narrow: officials have not found evidence of a leak, and an investigation remains underway.
How to recognize the suspicious messages
According to the Department of Health, the messages claim that recipients have been exposed to HIV and should obtain medical advice and testing urgently.
The department explicitly says it did not send these warnings and does not contact individuals in this manner.
Anyone receiving such a message should avoid clicking links, downloading unexpected attachments, replying with personal details, or entering information into a page opened from the message.
A professional-looking logo, official-sounding language or familiar sender name is not sufficient proof that a message is genuine. Because the precise mechanism of the suspected misuse has not been established publicly, recipients should not rely solely on the sender address to determine authenticity.
Instead, independently check information through an official government source or call the Department of Health's AIDS Hotline on 2780 2211.
There is no need to use a link supplied in the suspicious message to obtain testing.
If you have already provided personal information, passwords or payment details, stop interacting with the message, preserve a copy for reference, and contact the police. Change any exposed passwords through the relevant service's independently accessed website or app, and contact your bank promptly if financial details were involved.
Hong Kong Police also operates the 24-hour Anti-Scam Helpline on 18222 for advice about suspected deception.
The website is suspended. HIV testing is not.
The government's HIV Testing Service website, www.hivtest.gov.hk, was suspended from noon on October 24 for a cybersecurity review.
Its suspension notice identifies three affected online functions: booking HIV tests, obtaining HIV self-test kits, and uploading self-test results.
The website is expected to resume operations after the security review is completed, but no definite reopening date has been announced.
Importantly, the department's in-person HIV counselling and testing service continues to accept telephone bookings.
People can call 2780 2211, Monday to Friday, 8:30 a.m. to 5:15 p.m., excluding public holidays, to arrange free, anonymous and confidential HIV antibody testing.
The Department of Health’s AIDS Counselling and Testing Service operates by appointment. Its published location is the Yau Ma Tei Jockey Club Polyclinic, 145 Battery Street, Kowloon.
The service offers counselling, an assessment of potential HIV exposure, and appropriate blood tests. Depending on the assessment, a rapid HIV antibody test can produce a result in approximately 20 minutes. Laboratory-based HIV and syphilis testing may also be offered, with results taking longer.
The service identifies clients by code number rather than requiring them to be identified by name for testing. Results are provided in person, not by telephone.
Anyone who already has a self-test kit but cannot upload the result through the suspended website should call the hotline for instructions rather than attempting to send potentially sensitive information to an unverified address.
What if you genuinely think you were exposed to HIV?
The suspicious messages and a real medical exposure are two separate matters.
Receiving one of these warnings does not establish any medical risk. But if you have independently experienced a potentially significant exposure—for example, through unprotected sexual contact or sharing injection equipment—you should seek appropriate medical advice.
If the possible exposure occurred within the past 72 hours, seek urgent medical assessment rather than waiting for the government testing website to reopen or for a routine testing appointment.
Post-exposure prophylaxis, known as PEP, is a course of antiretroviral medication that can reduce the likelihood of HIV infection after certain exposures. It must be started promptly, within 72 hours of a possible exposure. A clinician must assess whether it is appropriate.
A separate issue is the testing window period. HIV tests do not necessarily detect an infection immediately after exposure. The Department of Health advises that antibody testing within three months of a suspected exposure may require a repeat test.
That means a negative early test cannot always exclude a recent infection. A clinician or trained counsellor can advise on testing timing and follow-up.
What remains unanswered?
The department's initial announcement provides an outline of its response but leaves several questions unresolved.
How did the apparent misuse occur? Were the messages sent from a genuine departmental email account, or was the government's identity impersonated by another means? How many emails and text messages were distributed? Did recipients have any previous connection to the HIV testing service? Were any personal identifiers accessed? What testing, oversight and security obligations applied to the outsourced service provider?
The department has not publicly answered those questions in the material available as of October 26.
They matter because an incident involving a health service has consequences beyond technical cybersecurity. A fabricated warning about HIV exposure can cause unnecessary anxiety, exploit concerns about privacy and stigma, and potentially discourage people from seeking legitimate testing.
An effective response therefore has two parts: investigating the technical incident and maintaining clear, accessible public health advice.
Hong Kong residents should not have to choose between protecting themselves from suspicious messages and obtaining confidential medical care.
For now, the central advice is straightforward: do not trust unsolicited HIV-exposure warnings claiming to come from the Department of Health, do not follow their links, and use the independently verified AIDS Hotline, 2780 2211, for testing arrangements.
The website may be temporarily offline. The need for accurate information, privacy and access to testing has not gone away.