Orova Ransomware Breaches Five Hong Kong Firms; SFC's First Cyber Fine Lands Same Day

A ransomware group named Orova listed five Hong Kong organizations on its dark web extortion portal on Aug. 4, the same week the Securities and Futures Commission fined a licensed broker for cybersecurity failures tied to a 2022 ransomware attack. Threat intelligence firm FalconFeeds.io said it first flagged Orova on Aug. 4 when the group posted a bulk alert announcing 24 victims across six countries. Ransomware monitoring platform ransomware.live independently confirmed each listing and assigned estimated attack dates stretching back to late May 2026. The SFC published details of a HKD 2.1 million fine against Luk Fook Securities (HK) Limited on Aug. 5 for cybersecurity control failures that preceded and worsened the impact of a 2022 ransomware attack. Law firm A&O Shearman's analysis confirmed it was the SFC's first enforcement action arising from an actual cyberattack disrupting a licensed corporation's trading systems. The two events landed within 24 hours of each other. Orova's Hong Kong victims include Sanrio Hong Kong Co. Ltd., JK Capital Management Limited, Tat Fung Textile Co. Ltd., SSI Holding (Far East) Limited, and Sure Travel Company Limited. Ransomware.live assigns estimated attack dates between July 27 and Aug. 3. JK Capital Management is regulated by the SFC, making it the most regulatory-sensitive listing. Sure Travel's entry lists 25.50 gigabytes of data exfiltrated. WatchGuard Technologies' ransomware tracker classifies Orova as an emerging and active group first seen in May 2026 and categorizes it as a Data Broker operation. Ransomware.live statistics show 13 victims in the United States, five in Hong Kong, four in Taiwan, and one each in Brazil, Egypt, and Japan as of Aug. 5.