The Hong Kong company, which operates internationally, admitted on Wednesday that it had found “suspicious activity” on its network in March 2018. Two months later, it confirmed that a slew of personal information—which included passport details—had been accessed.