# Shenwan Hongyuan (Hong Kong) Holdings Limited — 申万宏源(香港) **Listed: HKEX 218.HK | Parent: Shenwan Hongyuan Group Co., Ltd. (SZSE: 000166, SEHK: 6806)** **State-Owned Enterprise — Controlled by Central Huijin Investment Ltd. (China Investment Corporation)** **Industry: Securities, Investment Banking, FICC Trading, Derivatives, Asset Management** **Regulator: Securities and Futures Commission (SFC), Hong Kong — Types 1, 2, 4, 5, 6, 9** **Headquarters: Admiralty Centre, 18 Harcourt Road, Hong Kong** **Offices: Hong Kong (Admiralty, Hennessy Rd, United Centre, PP3), Singapore, London, Tokyo, Seoul** **Branches: Tsuen Wan, Shatin, Yuen Long** **Website: swhyhk.com** **Employees: 896** --- ## Summary Shenwan Hongyuan (H.K.) Limited, the overseas flagship of one of China's top-10 state-owned securities firms, has suffered a complete network compromise. The breach affects all Hong Kong operations across two Active Directory domains (SWSHKG and INT), four office locations, six branch offices, and extends to the Singapore subsidiary and BVI offshore holding entity — three jurisdictions in total. **21,002,068 files totaling 9.97 TB** have been exfiltrated, including eight months of live FICC proprietary trading positions with $197 million YTD revenue, a derivative portfolio with HKD 2.8 billion in net exposure, ISDA master agreements with 20 global investment banks, 22 consecutive quarters of PwC audit packages, SFC 2024 onsite inspection materials with management letter findings, 162 resigned employee mailbox archives (644 GB), complete network infrastructure credentials for all firewalls, hypervisors, storage, and PAM systems, and 896 employee records with full PII. **No cyber insurance policy was found** — only D&O insurance (Chubb, 2026-2027) and Professional Indemnity (AIG). The full cost of this incident will be borne entirely by the company. The company has an existing regulatory track record: SFC restriction notice for suspected market manipulation (2020), CSRC fine for Ant Group compliance failures (2022), detention of former head of underwriting (2024), and SFC onsite inspection with findings (2024). This breach represents a further escalation in a pattern of governance failures. --- ## Financial Profile | Metric | Value | Source | |---|---|---| | Group Net Assets (parent equity) | **HKD 4,550,050,068** (~USD 583M) | ROE Budget 2026 | | HK Company Net Assets | **HKD 2,804,126,319** | Budget sheet | | International Group Net Assets | **HKD 4,623,800,846** | Budget sheet | | Singapore Subsidiary Net Assets | **HKD 243,488,705** | Budget sheet | | BVI Holding Company Equity | **HKD 570,155,822** | BVI accounts | | 2026 Budget Revenue | **HKD 559,500,000** | Budget | | 2026 Budget Net Profit | **HKD 256,451,356** | Budget | | 2026 Target ROE | **6.53%** | Budget | | Bond Portfolio Scale | **HKD 6,500,000,000** | Budget | | Derivative Assets | **HKD 433,255,032** | PwC Q2/2026 | | Derivative Liabilities | **HKD 2,802,748,775** | PwC Q2/2026 | | Annual Staff Salary | **HKD 42,000,000** | Budget | | Annual Staff Bonus | **HKD 31,500,000** | Budget | | Cyber Insurance | **NOT FOUND** | Insurance review | --- ## FICC Proprietary Trading — Monthly P&L (USD), January–August 2026 | Month | PROP P&L | ASIA P&L | TRAD P&L | REPO P&L | Cumulative Revenue | Cumulative Profit | |---|---|---|---|---|---|---| | January | $2,889,070 | $521,774 | $182,655 | $1,287,181 | — | — | | February | $2,604,536 | $472,410 | $147,954 | $1,173,587 | $56,160,133 | $36,529,885 | | March | $2,868,967 | $525,238 | $42,185 | $1,276,888 | $83,960,918 | $56,094,752 | | April | $2,794,155 | $512,145 | $154,431 | $1,261,209 | $111,415,071 | $73,692,902 | | May | $2,943,604 | $529,743 | $117,785 | $1,345,446 | $139,783,483 | $91,490,743 | | June | $2,881,433 | $516,094 | $104,481 | $1,332,600 | $167,791,605 | $110,014,649 | | July | $2,988,583 | $535,438 | $174,511 | $1,390,672 | $197,018,166 | $127,934,265 | | August | $3,113,536 | $537,252 | $122,094 | $1,478,185 | $197,018,166 | $127,934,265 | Bond positions include: ANZ 5.731% 2034, Mizuho Float 2031, HSBC 2.357% 2031, AIA 3.6% 2029, AIA 5.375% 2034, Alibaba 2.125% 2031, Alibaba 4.875% 2030, Tencent 2.39% 2030, Xiaomi 3.375% 2030, Saudi Arabia (KSA) 4.125% 2029, Morgan Stanley 3.622% 2031, Citigroup 4.412% 2031, Standard Chartered 4.644% 2031, China Construction Bank 2.85% 2032, MTRC 5.625% PERP, HUANEN 4.15% PERP, and dozens more. Portfolio yield approximately 4.8%, repo financing rate 3.8%. --- ## Scope of Compromise ### Infrastructure — Total Network Takeover - **2 Active Directory domains**: SWSHKG (swshkg.com.hk) and INT (int.swshkg.com.hk) — 1,091 computers - **796 NTLM password hashes** from NTDS.dit, **509 plaintext credentials** from workstations - **All network devices**: 6 firewalls (Palo Alto, Checkpoint, FortiGate), 5 F5 load balancers, 8 ESXi hypervisors, 5 SAN arrays (3PAR, Nimble, HP), 30+ managed switches across 4 offices - **PAM system**: TPAM (PARAdmin/Admin4PAR) — **RSA Auth Manager** (2FA for VPN) — **PRTG** — **Kaspersky Admin** — all compromised - **RedHat Satellite**: controls patching for ALL Linux servers - **SQL SA production** (SunSystems ERP), **Veeam Backup** infrastructure, **Bomgar Remote Support** ### Email — 813+ GB Total - **Mail Gateway Veeam backup**: 99.5 GB — full corporate Exchange email (July 2026) - **162 resigned employee mailbox archives**: 644 GB — including **Roy Luo (MD FICC, 16.5 GB)**, WuYang (32.1 GB), JohnnyChan (23.8 GB), ChenXiEric (15.2 GB), AvisLAW (14.0 GB), HenryLau (13.8 GB), and 156 more - Department mailboxes: CorporateFinanceHK, HelpDesk.Support, SWHY.Research - **387,335 .msg files** across file shares (304 GB) ### Client Data — SFC Regulatory Impact - **Fubon Life Insurance Co Ltd** — margin facility escalating from HKD 2.7B to **HKD 20 billion** (documented in credit committee memos from Aug-Dec 2025) - **Korea Investment Securities Co Ltd** — HKD 130M facility with annual reports - **CITIC Securities Brokerage (HK) Limited** — HKD 80M (Geek+ IPO related) - **Auerbach Grayson** — HKD 268M - **Best Investment / Flourish Investment / Bellwether Ltd** — HKD 750M combined - **Zhongjia U-Home Investment Limited** — HKD 130M - Named individual margin clients: Cheung Tin Hang (HKD 100M), Texson Ltd (HKD 65M), Noble Trade (HKD 50M), Liu Xiaoyun (HKD 20M), Cao Jing (HKD 12M), Pan Jian, Gong Cheng, and others - Monthly margin facility letters issued January–December 2025 (all on file) - Credit Committee meeting minutes and Terms of Reference - Full margin ratio model for all HKEX-listed stocks (Wind terminal integration) - **55+ active Corporate Finance mandates** including IPO sponsors for Hingtex (1968.HK), Huajin (2738.HK), Palace Banquet (1703), ITP (8446), Kimou Environmental (6805), Miricor (1827), Trukker, and 40+ confidential project-based mandates (Project Transformer, Project Dragon, Project Eagle, Project Phoenix, Project Caring, Project Star, Project 上海石化收购). Each mandate contains due diligence materials, Virtual Data Room contents, verification documents, and SFC correspondence. ### Derivatives Portfolio — PwC Q2 2026 Audit Package - **Derivative financial assets: HKD 433,255,032** - **Derivative financial liabilities: HKD 2,802,748,775** - **Net derivatives position: HKD -2,369,493,743** (net liability) - OTC Options with UBS and Jinchuang (customized index products) - US Treasury Futures: 30-Year T-Bond, 2Y/5Y/10Y T-Notes (September 2026 expiry) - Commodity Futures: LME Zinc (HKD 28M), Cotton, TSI Iron Ore CFR China - FX Futures: USD/CNH — HKD 1.63B short (CME) + HKD 1.37B + HKD 640M long (SGX) - Equity Index Futures: E-mini Dow (HKD 473M), E-mini NASDAQ (HKD 137M), E-mini S&P 500 (HKD 56M), Hang Seng Index, **Hang Seng TECH Index (HKD 770M)** - TRS via CLSA (equity), CGML/Citi (commodity — palm oil, LLDPE, polypropylene, copper, rubber, zinc, sugar), Hongyuan Hengli (LME Zinc HKD 192M) - Commodity TRS notionals: Palm oil DCE HKD 231M, Sugar ZCE HKD 233M, Rubber SHFE HKD 39M ### Legal & ISDA Agreements **20 global investment bank counterparties** with full ISDA Master Agreements, CSA (Credit Support Annex), and VM (Variation Margin) documentation: Goldman Sachs (10 documents), Barclays (signed 2022), Citigroup/CGML (5 documents including VM CSA), Nomura (execution copy), Morgan Stanley (ISDA MA + SWHYI comments), DBS (VM CSA execution draft), CLSA (23 documents), Credit Suisse, Merrill Lynch / Bank of America (8 documents), Huatai (11 documents), CICC (7 documents), UBS (3 documents), Standard Chartered (14 documents), Societe Generale, PAX, EIP China Convertible Bond Fund, GF Global **32 bank facility agreements**: HSBC, BOC, CCBA, Chiyu, PingAn, SPD, OCBC, Standard Chartered, Dah Sing, China Minsheng, Chong Hing, China Everbright, ICBC, Industrial Bank, China Merchants, BOC Macau ### SFC Regulatory Inspection Materials - **SFC 2024 Onsite Inspection** — materials for SWHYS, SWHYF, SWHYN: FAQ (13 compliance areas), Stock Watch/Restricted List, Management Letter with remediation tracking - **SFC 2018 Inspection** — full Document Request Lists and responses - Compliance manuals, sales handling guidelines, product approval lists - **CITIC/Central Huijin comprehensive inspection** (2023) — 15 phases of findings, ongoing remediation through 2026 ### Financial & Audit — 7 Years - **22 consecutive PwC quarterly audit packages**: Q2/2021 through Q2/2026 - Latest package (Q2/2026) contains: complete derivatives list (衍生金融工具清单), financial assets holdings by subsidiary (金融资产持仓清单), mid-year KPMG review requirements - **Annual audit and tax filings**: 2020, 2021, 2022, 2023, 2024, 2025, 2026 - **P&L forecasts**: 2022–2026 with actual monthly results and subsidiary breakdowns (中性/悲观 scenarios) - **Budget 2026**: detailed by team — FICC revenue HKD 320M, Derivatives HKD 229.5M, repo cost HKD 194M, USD bond interest HKD 166M - General Ledger with department-level breakdowns and bank account references - **Salary and bonus details by team**: Global Financial Markets HKD 9.72M, FICC Team HKD 9.09M, Sales HKD 8.64M, General/Admin HKD 22.68M, Outsourced HKD 7.74M — total compensation **HKD 57.87M** ### BVI Offshore Entity **Shenwan Hongyuan Holdings (B.V.I.) Limited** — administered by **Trident Trust Pacific** - Investment in subsidiaries: **HKD 659,988,769** - Total equity: **HKD 570,155,822** (Share Premium HKD 314M + Retained Earnings HKD 256M) - Creditors: HKD 91,008,410 - **2024 anomaly**: Legal fees surged to HKD 188,000 (from zero in 2023), professional fees increased 14x to HKD 415,852 — suggesting significant legal activity - Bank account closure notice found (银行通知书) - Monthly management accounts from October 2022 through December 2024 - Full audit accounts package (申万宏源控股BVI审计账目) ### Internal Governance - **CPC Party documents**: ideological rectification campaign (思想认识专项整顿) — assignments from parent company, study group meeting minutes, implementation reports - **Executive Management Committee meeting notices and materials** (July-August 2024) - **Derivatives weekly meeting minutes** (申万衍生品委周会会议纪要) — weekly from June-August 2024 - **Senior management personal conversation records** (谈心谈话记录): CEO Wu Meng and Executive Hu Jing - **Whistleblowing case WB202001**: anonymous complaint (匿名投诉) from November 2020, documented investigation - **Accountability office** (问责办事机构): violation case reports, accountability committee meeting records, typical violation case notifications - **Departure audits** (离任审计) for senior management — audit programs, procedures, external firm engagement - Employee disciplinary regulations: 《申万宏源（国际）集团有限公司员工违规行为责任追究办法（2024年修订）》 ### External System Connections - FTP credentials to **Interactive Brokers** and **RJ O'Brien** — external trading platforms - **VisualCron** automation: 20 connections to Bloomberg, IB, Marex, SunGard, Telegram - VPN credentials for vpn.swhyhk.com and sslvpn.swhysc.com (Shanghai) - **SFC Portal**, **ISDA.org**, and client trading portal credentials --- ## Affected Jurisdictions | Entity | Location | SFC Licenses | Status | |---|---|---|---| | Shenwan Hongyuan (H.K.) Limited | Hong Kong | Types 1, 2, 4, 5, 6, 9 | **Full compromise** | | SWHY Securities (H.K.) Limited | Hong Kong | Type 1 | **Full compromise** | | SWHY Futures (H.K.) Limited | Hong Kong | Type 2 | **Full compromise** | | SWHY Asset Management (Asia) Ltd | Hong Kong | Types 4, 9 | **Full compromise** | | SWHY Capital (H.K.) Limited | Hong Kong | Type 6 | **Full compromise** | | Shenwan Hongyuan Singapore Pte Ltd | Singapore | MAS regulated | **Partial (data on HK shares)** | | Shenwan Hongyuan Holdings (B.V.I.) Ltd | British Virgin Islands | — | **Financial records obtained** | --- ## Regulatory & Legal Exposure The company holds **six types of SFC licenses** — the broadest possible scope for a Hong Kong securities firm. Under applicable regulations: **Personal Data (Privacy) Ordinance (PDPO)**: Mandatory breach notification for 896+ employee records and unknown number of client records. The Privacy Commissioner for Personal Data (PCPD) has authority to investigate and impose compliance orders. **Securities and Futures Ordinance (SFO)**: The compromised trading P&L data, position details, and derivative portfolio constitute market-sensitive information. Publication could trigger insider dealing investigations under SFO Part XIII. **SFC Code of Conduct**: Licensed corporations must safeguard client assets and information. The 2024 inspection already identified compliance gaps — this breach demonstrates continued failure to maintain adequate cybersecurity controls. **SFC Fit and Proper Requirements**: All licensed persons and responsible officers must be fit and proper. A breach of this magnitude, combined with the 2020 market manipulation freeze, 2022 CSRC fine, and 2024 executive detention, raises serious questions about the continued fitness of the company's management. **Third-Party Notifications**: Each of the 20 ISDA counterparties, 32 bank facility providers, and all margin facility clients have contractual rights to be notified of material data breaches. Several ISDA agreements contain termination event clauses triggered by regulatory action or material adverse change. **Parent Company Exposure**: Shenwan Hongyuan Group Co., Ltd. (SZSE: 000166, SEHK: 6806) is controlled by Central Huijin Investment Ltd. and subject to CSRC oversight. The breach of CPC party documents and internal governance materials creates additional political and regulatory exposure at the mainland level. --- *21,002,068 files. 9.97 TB. Three jurisdictions. No cyber insurance. Data available for verification upon contact. Resolution discussions welcome prior to full publication and regulatory notification.*