There's a small moment at the start of every theme park day that most of us barely notice. You hold up your phone, a scanner beeps, the gate opens, and just like that, you're in.
At Hong Kong Disneyland, that moment usually leads straight toward the Castle of Magical Dreams. Since opening on Lantau Island in 2005, the park has grown to include attractions like World of Frozen, and plenty of guests now arrive with a QR code ticket ready on their phones.
But what happens when the system behind those codes gets breached? Hong Kong Disneyland is facing that question right now, and the answer has changed how guests can buy their way in, at least for the time being.
The Breach, Explained
On Friday, Hong Kong Disneyland announced it had detected a cybersecurity incident and taken immediate protective measures, according to The Standard. Reports since then, including from the South China Morning Post, say roughly 17,000 e-ticket QR codes were stolen from the resort's online ticketing system.
The problem was caught internally. People familiar with the matter told Dim Sum Daily that the park's IT team, which handles day-to-day network security, noticed abnormal activity on company computers. When they looked into it, they found that about 17,000 QR codes stored in the system had been taken.
The resort shut down online ticketing right away to prevent further damage.
Police on the Case
Hong Kong Disneyland has reported the incident to police. Officers have classified it as access to a computer with criminal or dishonest intent, and the case is being handled by the Lantau district crime squad. The Standard reported that no arrests had been made.
Privacy regulators are involved too. The resort said it plans to notify Hong Kong's Office of the Privacy Commissioner for Personal Data. A spokesman for the privacy watchdog told the South China Morning Post it hadn't yet received a report from the resort but would reach out to learn more about what happened.
What It Means for Your Visit
“Our online store is currently undergoing system maintenance. In the meantime, if you would like to book tickets or hotel stays, please make your reservations through our contracted travel agents and platforms, official WeChat mini program, Fliggy official store, Douyin authorized store, or Main Entrance Ticket Booths.”
So if you're planning a trip, you can still book through Hong Kong Disneyland's contracted travel agents and platforms, its official WeChat mini program, its Fliggy official store, or its Douyin authorized store. You can also buy at the ticket booths at the main entrance.
The resort is urging guests to “purchase park tickets directly through official channels,” a spokeswoman told the South China Morning Post. That's especially important now, since stolen codes could be floating around. Buying from an unofficial seller could leave you with a ticket that causes problems at the gate.
Speaking of the gate, Hong Kong Disneyland has tightened ticket verification for guests entering the park. Dim Sum Daily noted the stricter checks are designed to stop stolen codes from being reused, though they may slow entry lines a bit.
Scott Gustin noted, “NEW: Hong Kong Disneyland’s online ticket sales and hotel bookings remain suspended after 17,000 park admission ticket QR codes were stolen from its online ticketing system.
The theft was discovered after an IT worker detected unusual activity in the resort’s computer system. Local police are investigating the cyber incident, and Disney is advising guests to purchase tickets through official channels or authorized travel agents.”
NEW: Hong Kong Disneyland’s online ticket sales and hotel bookings remain suspended after 17,000 park admission ticket QR codes were stolen from its online ticketing system.
The theft was discovered after an IT worker detected unusual activity in the resort’s computer system. Local police are investigating the cyber incident, and Disney is advising guests to purchase tickets through official channels or authorized travel agents.
— Scott Gustin (@ScottGustin) November 15, 2026
The Questions Still Hanging Over This
Several big details are still up in the air.
Was personal information exposed? That hasn't been confirmed. So far, reports only describe the theft of ticket QR codes.
How did the thieves get in? It's not yet clear. According to Dim Sum Daily, Cityline runs the resort's online ticket bookings, while Hong Kong Disneyland's IT department manages its internal network. Francis Fong, honorary president of the Hong Kong Information Technology Federation, suggested in comments reported by the outlet that the case may point to weak spots in how ticketing QR codes are generated, stored, and checked.
When will online sales return? Hong Kong Disneyland hasn't announced a date.
Are tickets I already bought affected? We haven't seen specific guidance on that yet. If you have an online ticket for an upcoming visit, it's a good idea to watch Hong Kong Disneyland's official channels for updates.
Before You Head to Lantau
Nobody wants their Disney day to start with a ticket problem. Until online sales are back, the safest approach is to buy only through the channels Hong Kong Disneyland has listed and to arrive with a little extra time for entry.
We'll keep watching this story and pass along updates as police and the resort share more.
Have you bought Hong Kong Disneyland tickets recently, or are you planning a visit soon? Does news like this make you think twice about digital tickets? Share your thoughts in the comments. And if you've been to the park since the breach, we'd love to hear what entry was like.
