1. I wonder the 430 cards stolen - of which 427 were claimed to have expired - were "expired" as a result of the breach (that is - the cards were valid, but CX's acquirer contacted the issuers to replace the cards)?

2. My info stolen - HKID (how did CX have that...) phone number email - may not be enough to create new card accounts/identity documents for identity theft but coupled with pretty lax security at other HK companies, someone may get my other non-public info like bank balance or card balance. Other than that, and the fact my phone and email may be spammed, I really can't think of any objective consequences of the breach.