Hong Kong recorded a nearly 18 per cent rise in ransomware cases in the first three quarters of 2026, police in the city have said, even as overall technology crime fell over the same period.

Chief Superintendent Raymond Lam Cheuk-ho, of the Hong Kong police force's cybersecurity and technology crime bureau, said officers had recorded cases involving AI agents and other forms of artificial intelligence being used in cyberattacks as recently as last month.

The figures, reported by the South China Morning Post on 9 November, show ransomware moving in the opposite direction to the wider trend in technology crime. Police did not publish an absolute case count alongside the percentage rise, so the scale of the increase in raw numbers has not been disclosed.

According to the police account, criminals are increasingly relying on generative AI tools to draft convincing phishing messages, write malicious code and design extortion schemes more quickly than before. Lam warned that the use of AI increases the speed, volume and intrusiveness of attacks, and makes them more effective.

"We understand that the use of AI obviously increases the speed of attacks, the volume and intrusiveness. The attacks will be more effective," Lam said.

The warning echoes concerns raised by cybersecurity researchers elsewhere that AI is lowering the technical barrier for less experienced attackers to run sophisticated ransomware campaigns. Where a ransomware operation once needed skilled operators to craft each stage of an attack, automated tools can now generate phishing lures, adapt malware and personalise extortion demands at scale.

Police said they would keep monitoring emerging AI-driven attack techniques and urged businesses to strengthen their cyber defences. Authorities are also encouraging companies to report incidents faster and to train staff to recognise AI-assisted scam attempts, including phishing messages that are harder to spot because they are well written and tailored to the recipient.

The rise in Hong Kong comes against a busy global backdrop for ransomware. Leak-site trackers recorded hundreds of claimed victims in the first nine days of November alone, with manufacturing, professional services and technology among the most targeted sectors worldwide.

For businesses, the police message is a practical one: assume phishing attempts will look more convincing than they used to, keep software and backups up to date, and make sure staff know how to report a suspicious message quickly. A faster report can be the difference between a blocked attempt and an encrypted network.

Hong Kong police have not linked the rise to any single ransomware group, and no specific incident was named in the latest figures. The bureau said monitoring of AI use in cyberattacks would continue.