SG Incident Monitor / A continuously updated index of publicly reported cybersecurity incidents affecting organisations in Singapore. en-sg Hugo Sat, 07 Nov 2026 04:00:00 +0000 SingHealth : An APT attacker (phishing-style email + custom malware, first access Aug 2017) exfiltrated 1,495,364 patients' particulars (name, NRIC, address, gender, race, DOB) from IHiS-managed systems between 27 Jun and 4 Jul 2018; ~159,000 also had dispensed-medication records taken; exploited a weak local-admin password, a cleartext password in a script and dormant accounts; PDPC fine S$250,000 (DP-1807-B2435) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-singhealth-and-ihis sgim:cd38bf441b554249 Tue, 03 Jul 2018 16:00:00 +0000 unauthorized access / data leak Confidence: high (100). Potential records: 1.495364e+06. Integrated Health Information Systems (IHiS) : Central IT agency and data intermediary managing SingHealth's systems, where the 2018 APT breach occurred; found to have missed clear warning signs and delayed response; PDPC fine S$750,000 (the largest penalty at the time) (DP-1807-B2435) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-singhealth-and-ihis sgim:e984038679f3767c Tue, 03 Jul 2018 16:00:00 +0000 unauthorized access / data leak Confidence: high (90). Potential records: 1.495364e+06. M1 Limited : Website security incident during iPhone 6 pre-orders — unauthorized access https://www.straitstimes.com/singapore/m1-hit-by-data-breach sgim:ca0df2c95aa144c1 Sun, 14 Sept 2014 16:00:00 +0000 unauthorized access Confidence: medium (50). Potential records: 12. MyRepublic : Threat actor accessed KYC documents (scanned NRICs/work passes, proof-of-address) in an AWS bucket using an access key exposed in the portal's source code, then deleted them and demanded a ransom; 79,388 customers; PDPC fine S$60,000 — unauthorized access / data leak https://www.channelnewsasia.com/singapore/myrepublic-data-breach-nric-personal-information-2168531 sgim:edafecb90972a34b Sat, 28 Aug 2021 16:00:00 +0000 unauthorized access / data leak Confidence: high (80). Potential records: 79388. Singapore Red Cross : Blood-donor registration site hacked via a weak phpMyAdmin password ('12345') left connected after development; ~4,297 donors (name, contact, email, blood type); vendor unsupervised; also a retention breach (~900 kept unnecessarily); PDPC fine S$5,000 (DP-1905-B3865) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-retention-limitation-obligations-by-singapore-red-cross sgim:348d416317cb4972 Tue, 07 May 2019 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: 4297. Singapore Land Authority (SLA) : Test data in an IBM-managed cloud environment (STARS/ELS); not anonymised as intended — unauthorized access / data leak https://www.sla.gov.sg/news/press-release/security-incident-involving-an-ibm-managed-cloud-environment-/ sgim:9dfbc63747c6ec4e Thu, 02 Jul 2026 16:00:00 +0000 unauthorized access / data leak Confidence: high (75). Potential records: 70000. Singapore Airlines (SIA) : Booking records via third-party reservation provider Amadeus; ~620 records also had contact/travel-doc data — data leak / unauthorized access https://www.channelnewsasia.com/singapore/sia-singapore-airlines-amadeus-data-breach-booking-records-6517151 sgim:776aca87309df532 Mon, 02 Nov 2026 16:00:00 +0000 data leak / unauthorized access Confidence: high (85). Potential records: 46000. MoneySmart : Internal IT systems; SG & HK users; number affected not disclosed — unauthorized access / data leak https://www.channelnewsasia.com/singapore/moneysmart-data-breach-security-incident-6515356 sgim:c00cfacfe615be44 Wed, 28 Oct 2026 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: not stated. Singapore telecommunications sector (Singtel, StarHub, M1, SIMBA) : APT actor UNC3886; only a small amount of technical/network data exfiltrated; no evidence customer data was taken (Operation Cyber Guardian) — unauthorized access / other https://www.csa.gov.sg/news-events/press-releases/largest-multi-agency-cyber-operation-mounted-to-counter-threat-posed-by-advanced-persistent-threat--apt--actor-unc3886-to-singapore-s-telecommunications-sector/ sgim:6c14107d46343b91 Sun, 08 Feb 2026 16:00:00 +0000 unauthorized access / other Confidence: high (90). Potential records: not stated. Alliance Medinet : Third-party claims/benefits administrator; membership database; some NRIC, bank and one medical record affected — unauthorized access / data leak https://www.channelnewsasia.com/singapore/alliance-medinet-cyber-incident-hsbc-life-singlife-income-insurance-6489076 sgim:991af82d50f3c350 Fri, 23 Oct 2026 16:00:00 +0000 unauthorized access / data leak Confidence: high (90). Potential records: 110000. HSBC Life Singapore : Affected via Alliance Medinet (2,614 individual policyholders + 1,381 group members) — data leak https://www.channelnewsasia.com/singapore/alliance-medinet-cyber-incident-hsbc-life-singlife-income-insurance-6489076 sgim:4a949a6a838189e0 Fri, 23 Oct 2026 16:00:00 +0000 data leak Confidence: high (75). Potential records: 3995. Singlife : Affected via Alliance Medinet (Employee Benefits group health) — data leak https://www.channelnewsasia.com/singapore/alliance-medinet-cyber-incident-hsbc-life-singlife-income-insurance-6489076 sgim:38dc721561249c06 Fri, 23 Oct 2026 16:00:00 +0000 data leak Confidence: high (75). Potential records: 323. Income Insurance : Affected via Alliance Medinet (one corporate account) — data leak https://www.channelnewsasia.com/singapore/alliance-medinet-cyber-incident-hsbc-life-singlife-income-insurance-6489076 sgim:8ce69865e3a255bf Fri, 23 Oct 2026 16:00:00 +0000 data leak Confidence: high (75). Potential records: 70. Tokio Marine Life Singapore (TMLS) : 6,103 insured members affected via Alliance Medinet (full name, NRIC, DOB, contact, email, membership/policy IDs, coverage dates, company name); no bank or medical data; TMLS's own systems not affected — data leak https://www.tokiomarine.com/content/dam/tokiomarine/sg/life/about-us/media-centre/Cyber%20Incident%20(Alliance%20Medinet).pdf sgim:a8a2a3b277045d81 Fri, 23 Oct 2026 16:00:00 +0000 data leak Confidence: high (70). Potential records: 6103. Great Eastern : Affected via Alliance Medinet (bank-account info of 3 corporate-benefit members) — data leak https://www.greateasternlife.com/sg/en/privacy-and-security-policy/customer-advisory-alliance-medinet-cyber-incident.html sgim:ac38aec5559bd8e6 Fri, 23 Oct 2026 16:00:00 +0000 data leak Confidence: high (70). Potential records: 3. Courts (Singapore) : Ransomware on disaster-recovery servers; 941,513 customers + 5,459 staff; PDPC fine S$178,000 — ransomware / data leak https://www.straitstimes.com/singapore/courts-fined-178000-for-massive-data-leak-affecting-close-to-1-million-customers-employees sgim:f5aa20b6b94feec9 Tue, 20 Sept 2022 16:00:00 +0000 ransomware / data leak Confidence: high (85). Potential records: 946972. Courts (Singapore) : The Guest Checkout System (live Apr 2014 - Aug 2017) used a customer's email as the sole login credential, so entering a matching email displayed the stored contact number and address even with a wrong name; 14,104 data sets (email, contact, address) exposed unauthenticated; no penetration tests or scans; PDPC fine S$15,000 (DP-1707-B0917) — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-courts-2020-10 sgim:8f3b36db6f2b850b Sat, 08 Jul 2017 16:00:00 +0000 data leak / unauthorized access Confidence: high (65). Potential records: 14104. Courts (Singapore) : An eDM to 76,844 Homeclub members carried a link containing a live session identifier (the 'Use SID on Storefront' default was left on and an employee copied the link); 128 recipients clicked and could reach account data; PDPC fine S$9,000 (DP-1909-B4731) — unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-courts sgim:1b8d1b4e3024fe82 Fri, 30 Aug 2019 16:00:00 +0000 unauthorized access Confidence: high (65). Potential records: 76844. Bee Cheng Hiang : Bulk marketing email built with an AI-written script that failed to hide recipients; SG's first AI-related breach notification (human error, not AI malfunction) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-bee-cheng-hiang-marketing-pte-ltd sgim:bd1b0113cb656897 Fri, 24 Apr 2026 16:00:00 +0000 data leak Confidence: high (80). Potential records: 95364. Simba Telecom : Customer data incl. names, IC numbers, dates of birth, mobile numbers and emails; no card/bank data; discovered 24 Sep 2026 — data leak https://simba.sg/files/newsroom/notice-from-simba-2026-09-25.pdf sgim:5986bde91db988eb Wed, 23 Sept 2026 16:00:00 +0000 data leak Confidence: high (70). Potential records: 23549. Cycle & Carriage Singapore : A threat actor used the credentials of a compromised backend service account to access Cycle & Carriage's Salesforce tenant on 12 Jul 2025, created a new system-administrator account and ran data-export reports; 147,110 individuals' data was taken (names, addresses, emails, phone numbers and about 1,935 NRIC numbers); root causes were an unrotated, poorly audited service account and over-retention of records in a legacy Salesforce object; no evidence of public exposure or misuse; PDPC accepted a voluntary undertaking (executed 23 Jan 2026, published 26 Feb 2026; no financial penalty) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-cycle-carriage-industries-pte-ltd sgim:0c004e50fd7251c5 Fri, 01 Aug 2025 16:00:00 +0000 unauthorized access / data leak Confidence: high (90). Potential records: 147110. K Box Entertainment Group : Membership database leaked online; hosted/managed by IT vendor Finantech; PDPC fine S$50,000 — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-and-openness-obligations-by-k-box-entertainment-group-and-finantech-holdings sgim:9f60305eb27247b6 Tue, 22 Apr 2014 16:00:00 +0000 data leak / unauthorized access Confidence: high (75). Potential records: 317000. Finantech Holdings : IT vendor / data intermediary for K Box (built CMS, hosted site); PDPC fine S$10,000 — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-and-openness-obligations-by-k-box-entertainment-group-and-finantech-holdings sgim:6f79d87ba2a85468 Tue, 22 Apr 2014 16:00:00 +0000 data leak Confidence: high (75). Potential records: not stated. KLP LLP : Audit firm; ransomware via a former employee's reactivated VPN account; PDPC fine S$17,500 — ransomware / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-accountability-obligations-by-klp-llp sgim:cf9ef5d1f0244fa7 Wed, 17 Jan 2024 16:00:00 +0000 ransomware / data leak Confidence: high (70). Potential records: 606619. People Central Pte Ltd : HR/payroll provider; AWS databases accessed/deleted (SQL injection, open RDP); 95,000 client employees + 24,765 contacts/children; PDPC fine S$17,500 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-people-central-pte-ltd sgim:3faf8d498d3f2e70 Sun, 28 Apr 2024 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: 119765. Doctor Anywhere : Telemedicine; name, email, IC/passport, DOB, emergency contacts, bank details; clinical records not affected; incl. Adept Health corporate-benefit members — unauthorized access / data leak https://www.straitstimes.com/singapore/doctor-anywhere-hit-by-data-breach sgim:b3e992c4571f65d5 Wed, 28 Oct 2026 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: not stated. Goldheart Jewelry Pte Ltd : Customer database exfiltrated and published online; unpatched Magento RCE (CVE-2022-24086); PDPC fine S$58,000 — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-goldheart-jewelry-pte-ltd sgim:0b86d2cc96fa6fde Thu, 18 May 2023 16:00:00 +0000 data leak / unauthorized access Confidence: high (75). Potential records: 41379. Air Sino-Euro Associates Travel (ASA Holidays) : Legacy booking system accessed (likely via RDP) with exfiltration; incl. full NRIC/passport/birth-cert images; PDPC fine S$47,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-accountability-and-protection-obligations-by-air-sino-euro-associates-travel-pte-ltd sgim:5f1e33771bde084f Tue, 19 Dec 2023 16:00:00 +0000 unauthorized access / data leak Confidence: high (75). Potential records: 336759. SESAMi (Singapore) Pte Ltd : B2B e-commerce provider; shared network drive encrypted (ransom note); data intermediary that managed the network holding Abecha's ESSO data; PDPC fine S$8,750 — ransomware / unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-sesami-singapore-pte-ltd-and-abecha-pte-ltd sgim:7065d5abbee4a933 Mon, 12 Aug 2024 16:00:00 +0000 ransomware / unauthorized access / data leak Confidence: high (70). Potential records: 18837. Abecha Pte Ltd : ESSO Programme operator (SESAMi subsidiary); customer data compromised via the SESAMi-managed network; no separate penalty — ransomware / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-sesami-singapore-pte-ltd-and-abecha-pte-ltd sgim:d7c16223726431f0 Mon, 12 Aug 2024 16:00:00 +0000 ransomware / data leak Confidence: high (70). Potential records: 20471. Singapore Data Hub Pte Ltd : SaaS POS/CRM vendor to SMEs; two intrusions (Apr & Jun 2024) via SQL injection/LFI/path traversal; data posted on hacking forums; 9,122 also had gender/health data; PDPC fine S$17,500 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-singapore-data-hub-pte-ltd sgim:52371fa20b0b222e Sat, 27 Apr 2024 16:00:00 +0000 unauthorized access / data leak Confidence: high (75). Potential records: 698112. Marina Bay Sands : Sands Rewards Lifestyle loyalty data exfiltrated and sold on the dark web; password spraying + middleware misconfiguration; PDPC fine S$315,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-marina-bay-sands-pte-ltd sgim:9a0798faa5ea4f6e Wed, 18 Oct 2023 16:00:00 +0000 unauthorized access / data leak Confidence: high (85). Potential records: 665495. Ezynetic Pte Ltd : SaaS IT provider to licensed moneylenders; ransomware deleted databases, borrower data (incl. MLCB credit reports) exfiltrated and sold on the dark web; PDPC fine S$17,500 — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-ezynetic sgim:f6664b639ba56a6d Sun, 23 Jun 2024 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (75). Potential records: 190589. Amadeus (reservation platform) : Global travel reservation technology provider; a vulnerability in its booking-display environment exposed booking data across multiple airlines (incl. SIA, Cathay Pacific, JAL, ANA, Qantas); Amadeus reported no payment data accessed — unauthorized access / data leak https://www.channelnewsasia.com/singapore/sia-singapore-airlines-amadeus-data-breach-booking-records-6517151 sgim:1aaf3025033c8e43 Thu, 29 Oct 2026 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: not stated. IBM (managed cloud environment) : IBM-managed development/cloud environment supporting SLA's STARS/ELS systems; the unauthorised access occurred within this environment — unauthorized access https://www.sla.gov.sg/news/press-release/security-incident-involving-an-ibm-managed-cloud-environment-/ sgim:916a98f0fa2a39af Thu, 02 Jul 2026 16:00:00 +0000 unauthorized access Confidence: high (70). Potential records: not stated. HMI Institute of Health Sciences : Inadvertent exposure (no attacker): an Excel file left publicly accessible and search-indexed in the website directory after the Students' Career Portal was decommissioned (Dec 2019); inadequate vendor oversight; PDPC fine S$10,000 — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-hmi-institute-of-health-science sgim:ddde5686528130ef Wed, 01 May 2024 16:00:00 +0000 data leak Confidence: high (70). Potential records: 761. GrabCar : Marketing emails showed the wrong customer's name and mobile number; an SQL query wrongly equated verified_email_user_id with passengers_id, pairing one customer's email with another's name and mobile; 120,747 of 399,751 marketing emails; operational/human error, not a cyberattack; PDPC fine S$16,000 (DP-1801-B1526) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-grabcar-financial-penalty sgim:75f556ac0f1ff99e Sat, 16 Dec 2017 16:00:00 +0000 data leak Confidence: high (70). Potential records: 120747. GrabCar (GrabHitch drivers) : Two GrabHitch drivers posted passengers' personal data to Facebook groups without consent; Grab's only safeguard was a Driver's Code of Conduct clause the drivers were unaware of, with no guidance or training, which the PDPC held was not a reasonable security arrangement; 2 passengers affected; no fine, directions only (DP-1702-B0508/B0613, [2019] SGPDPC 14) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-grabcar-directions sgim:8e55907c3fccab4f Tue, 31 Jan 2017 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 2. GrabCar (GrabHitch) : A GrabHitch app update dropped the userID from an API URL; the caching layer then served one driver's data to others inside each 10-second window; 21,541 drivers/passengers (profile pics, names, vehicle plates, wallet balances); PDPC fine S$10,000 + data-protection-by-design direction (DP-1909-B4675) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-grabcar sgim:ad7c1ae498b9e206 Thu, 29 Aug 2019 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: 21541. Keppel Telecommunications & Transportation : Personal data left undeleted on a former subsidiary's (GLS) server after divestment; threat actor entered via a compromised vendor account; ransomware group published files; up to 7,184 possibly exfiltrated; PDPC fine S$120,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-keppel-telecommunications-transportation sgim:2fbf5d9ac1d4bde3 Sun, 04 Sept 2022 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: 22659. Academy of Medicine Singapore : Ransomware via an unpatched FortiOS firewall vulnerability and RDP; 4.4TB encrypted, ~12.7GB exfiltrated; full card details incl. CVV for 1,083 people; PDPC fine S$9,000 — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-academy-of-medicine-singapore sgim:6ebd1264554bcc41 Wed, 12 Jul 2023 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (70). Potential records: 6574. Consumers' Association of Singapore (CASE) : Two incidents: (1) email accounts compromised via phishing, exposing up to 22,542 addresses; (2) ~12,218 individuals' data likely exposed during a vendor data migration; PDPC fine S$20,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-accountability-obligations-by-consumers-association-of-singapore sgim:315db5fcccf4455d Fri, 07 Oct 2022 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: 22542. CH Offshore : Ransomware (ALPHV/BlackCat) via employee and outsourced-IT-vendor VPN accounts; ~2.38TB exfiltrated incl. seamen's health and financial data; PDPC fine S$18,000 — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-ch-offshore sgim:db0ba5e694caab5f Mon, 27 Mar 2023 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (70). Potential records: 5906. Tok Leng Leng (Top Mobile Gallery) : Insider misuse: shop employees used foreign workers' work-permit data to register 44 M1 pre-paid SIM cards (some without the person's purchase); PDPC fine S$7,000 — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/protection-obligation-by-tok-leng-leng-ta-top-mobile-gallery sgim:877c24a419750180 Thu, 14 Jan 2021 16:00:00 +0000 data leak Confidence: high (65). Potential records: 33. Cortina Watch : LockBit 3.0 ransomware via a brute-forced 'test' VPN account; 5.82GB exfiltrated and posted on the dark web; no financial penalty (remediation directions issued) — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-cortina-watch sgim:015d3d3793d55575 Fri, 26 May 2023 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (65). Potential records: 3953. Horizon Fast Ferry : Design flaw after a booking-site revamp: entering a passport number auto-populated a returning passenger's full details; ~295,151 passengers exposed; no evidence of exfiltration; PDPC fine S$54,000 — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-horizon-fast-ferry sgim:3d5ea3db94245762 Sat, 30 Sept 2017 16:00:00 +0000 data leak Confidence: high (70). Potential records: 295151. Horizon Fast Ferry : Malware on the computer used for the shared booking email account let an attacker send phishing emails to three customers; the account password was shared by 11 employees and unchanged for nearly three years; warning (no penalty) — unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-horizon-fast-ferry-2020-10 sgim:98b917275e3c30c0 Sat, 30 Nov 2019 16:00:00 +0000 unauthorized access Confidence: medium (50). Potential records: 3. Horizon Fast Ferry : External attack: a still-active Ubuntu root account was used to access the booking server and exfiltrate data, followed by extortion/ransomware emails; 108,488 ticket buyers; PDPC fine S$28,000 — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-horizon-fast-ferry-2024-05 sgim:86387058203cb6cc Tue, 28 Mar 2023 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (70). Potential records: 108488. PPLingo (LingoAce) : External attacker brute-forced an admin account (password 'lingoace123') on the OPS system and created new admin accounts; 557,144 students/parents/teachers/staff; no evidence of exfiltration; PDPC fine S$74,000 — unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-accountability-and-protection-obligations-by-pplingo sgim:058df99915fae60b Mon, 25 Apr 2022 16:00:00 +0000 unauthorized access Confidence: high (75). Potential records: 557144. Carousell : Human error: a chat-function code change appended users' email (and PH mobile numbers) to messages sent to listing owners; 44,477 users; part of the same PDPC decision as the API-scraping incident; combined fine S$58,000 — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-carousell sgim:c80153b65f64129c Wed, 17 Aug 2022 16:00:00 +0000 data leak Confidence: high (70). Potential records: 44477. Carousell : Misconfiguration: a public API launched during a migration lacked a required filter, letting a threat actor scrape non-public emails, phone numbers and DOBs of at least 2.6 million users (estimated up to ~3.39M); combined fine S$58,000 — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-carousell sgim:9a6495a8450223d1 Fri, 06 May 2022 16:00:00 +0000 data leak / unauthorized access Confidence: high (70). Potential records: 2.6e+06. Whiz Communications : External attacker used Python scripts from overseas IPs to extract ID-document images (NRIC/passport/passes) and supporting documents from the customer management system; 24,323 individuals; PDPC fine S$9,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-whiz-communications sgim:8e5612a40789cc5c Fri, 21 Apr 2023 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 24323. Payroll2U : Payroll SaaS vendor; LockBit-affiliate ransomware via a compromised account with RDP to AWS servers; a client's 5,640 employees' payroll, bank and NRIC data affected; PDPC fine S$4,000 — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-payroll2u sgim:ba2dfcbba1e38784 Wed, 28 Dec 2022 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (65). Potential records: 5640. Tipros : Purpose-limitation breach: the business posted customers' personal data (address, mobile number) in its public replies to Google reviews; directed to remove it (no financial penalty) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-purpose-limitation-obligation-by-tipros sgim:70f2e272297a8493 Wed, 20 Jul 2022 16:00:00 +0000 data leak Confidence: high (60). Potential records: not stated. Ascentis : CRM/loyalty vendor that ran Starbucks Singapore's rewards platform; a subcontractor's (Kyanon) dormant admin account with a weak password was used to export data, later sold on the dark web; PDPC fine S$10,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-ascentis sgim:2a1207cd4ea9c06b Fri, 09 Sept 2022 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: 332774. Starbucks Singapore : ~330,000 rewards-programme customers' data compromised via its CRM vendor Ascentis and sold online (reportedly for ~$3,500) — data leak https://www.straitstimes.com/singapore/330000-starbucks-customers-data-leaked-sold-online-for-3500 sgim:60f750f46889494d Fri, 09 Sept 2022 16:00:00 +0000 data leak Confidence: high (75). Potential records: 332774. Tokyo Century Leasing (Singapore) : Ransomware via an unpatched FortiOS VPN (CVE-2018-13379); at least 3 servers encrypted; customers, guarantors and employees affected; no exfiltration found; PDPC fine S$82,000 — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-tokyo-century-leasing sgim:9d4dc0cc75ef4015 Sat, 11 Jun 2022 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (70). Potential records: 141412. Century Evergreen : A long-standing IDOR web vulnerability (present since the 2015 launch) let URLs be manipulated to download 96,889 ID-document images (incl. NRICs); PDPC fine S$9,000 — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-century-evergreen sgim:8c82b288e00eaaa9 Fri, 09 Dec 2022 16:00:00 +0000 data leak / unauthorized access Confidence: high (65). Potential records: 23940. Autobahn Rent A Car (Shariot) : Threat actor used a dormant ex-employee admin account (not revoked, no MFA) to export Shariot users' data, incl. NRIC and location; PDPC fine S$3,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-autobahn-rent-a-car sgim:98b7a845825459ef Thu, 20 Oct 2022 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 53000. ShopBack (E-Commerce Enablers) : Threat actor used a full-admin AWS key an engineer had accidentally committed to GitHub (left usable ~15 months) to access data; ~1.46M emails plus names, bank and partial-card data for subsets; PDPC fine S$74,400 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-ecommerce-enablers sgim:4e2f851a368b6e04 Tue, 08 Sept 2020 16:00:00 +0000 unauthorized access / data leak Confidence: high (75). Potential records: 1.457637e+06. Agape CP Holdings : Call-centre/BPO vendor and data intermediary for Fullerton Health; its internet-facing 'Online Drive' had its password inadvertently disabled for ~20 months, leaving Fullerton patient data openly accessible and exfiltrated; PDPC fine S$10,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-fullerton-healthcare-and-agape-cp-holdings sgim:3137089e1985eb9e Thu, 14 Oct 2021 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: not stated. Fullerton Healthcare Group : 133,866 patients + 23,034 corporate-client employees; data (incl. NRIC, bank, health/diagnosis codes) exposed via its call-centre vendor Agape and sold on the dark web; PDPC fine S$58,000 — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-fullerton-healthcare-and-agape-cp-holdings sgim:339eb5382745f106 Thu, 14 Oct 2021 16:00:00 +0000 data leak / unauthorized access Confidence: high (75). Potential records: 156900. Kingsforce Management Services : ~54,900 jobseeker datasets taken via outdated website code with critical vulnerabilities and sold on RaidForums; remediation directions issued (no financial penalty) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-kingsforce-management-services sgim:8e2fe8f2241c0817 Sun, 26 Dec 2021 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 54900. OrangeTee & Tie : Real-estate firm; threat actor 'ALTDOS' exfiltrated data via SQL injection/XSS and outdated MSSQL 2012, then demanded a ransom; 245,752 customers, 10,526 agents, 305 employees; PDPC fine S$37,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-orangetee-and-tie sgim:a9c03ee767fa2104 Mon, 02 Aug 2021 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: 256583. The Law Society of Singapore : Threat actor used a compromised IT-admin account (likely via an unpatched VPN) to deploy Netwalker ransomware; 16,009 current and former members' NRIC/address/DOB affected; remediation directions issued (no financial penalty) — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-the-law-society-of-singapore sgim:9f83d593fcac9369 Tue, 26 Jan 2021 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (65). Potential records: 16009. Shopify Commerce Singapore : Data sub-processor/intermediary for retailer Supernova; two Philippines-based Shopify contractors illegally accessed and exfiltrated customers' data from Shopify's systems; PDPC found a Transfer Limitation breach (directions, no penalty) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-transfer-limitation-obligation-by-shopify-commerce-singapore-and-supernova sgim:0ca1f2ddb7ff0a29 Mon, 14 Sept 2020 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 23928. Supernova (SNPL) : Online retailer; 23,928 customers' data exfiltrated from its Shopify platform by Shopify's contractors; PDPC found a Transfer Limitation breach (directions, no penalty) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-transfer-limitation-obligation-by-shopify-commerce-singapore-and-supernova sgim:e498423d689178b7 Mon, 14 Sept 2020 16:00:00 +0000 data leak Confidence: high (65). Potential records: 23928. Fortytwo : Furniture e-commerce; malicious code injected via unpatched Magento 1.9 vulnerabilities captured 6,241 logins (email/password) and full card details for 98 people; PDPC fine S$8,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-fortytwo sgim:10a16d834f9b1e40 Thu, 23 Dec 2021 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 6241. RedMart : Threat actor compromised a DevOps GitHub account, found AWS keys in repos/S3, and reached the RedMart database; 898,791 customers (names, addresses, partial card, hashed passwords); PDPC fine S$72,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-redmart sgim:f44037a33d704c0d Sat, 05 Sept 2020 16:00:00 +0000 unauthorized access / data leak Confidence: high (75). Potential records: 898791. Thomson Medical : An in-house developer left visitor data in a publicly accessible CSV on the web server (default config), exposed 16 Apr-8 Sep 2020; 44,679 visitors incl. NRIC and COVID declarations; remediation directions (no penalty) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-thomson-medical sgim:6981beac03625de9 Wed, 15 Apr 2020 16:00:00 +0000 data leak Confidence: high (65). Potential records: 44679. CPR Vision Management : CRM vendor/data intermediary for L'Oreal and L'Occitane; ransomware via a compromised VPN account; no endpoint security on the affected network; 118,719 customers affected; remediation directions (no penalty) — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-cpr-vision-management-pte-ltd sgim:ebde927f9b2e3b01 Thu, 14 Oct 2021 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (70). Potential records: 118719. L'Occitane (Singapore) : 83,640 customers affected via CRM vendor CPR Vision — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-cpr-vision-management-pte-ltd sgim:92d79b04cc280894 Thu, 14 Oct 2021 16:00:00 +0000 data leak Confidence: high (65). Potential records: 83640. L'Oreal (Singapore) : 35,079 customers affected via CRM vendor CPR Vision — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-cpr-vision-management-pte-ltd sgim:727056edb013b138 Thu, 14 Oct 2021 16:00:00 +0000 data leak Confidence: high (65). Potential records: 35079. L'Oreal (Singapore) : November 2018 website code changes introduced a caching flaw that showed one customer's data (name, email, address, mobile, DOB) to subsequent customers; user-acceptance testing only covered single-user login, not sequential logins; 7 individuals at risk; warning (DP-1812-B3091) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-l-oreal-singapore sgim:46dd3817c69ec520 Wed, 31 Oct 2018 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 7. Eatigo International : ~2.76M users in a legacy database that was internet-reachable and outside the security architecture; accessed by a threat actor and offered for sale; names, emails, phones, MD5 passwords; PDPC fine S$62,400 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-eatigo-international sgim:99b5d97b7f67adca Wed, 28 Oct 2020 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: 2.76e+06. Farrer Park Hospital : Two employees' Office 365 accounts were accessed without authorisation and auto-forwarded ~9,271 emails to an external address (Mar 2018-Oct 2019); 1,923 had medical info disclosed; no MFA until after; PDPC fine S$58,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-farrer-park-hospital sgim:468dd65540834416 Wed, 07 Mar 2018 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: 3539. Cognita Asia Holdings : Schools group; ransomware after a threat actor used compromised admin credentials over VPN (no MFA); 1,195 students among 1,260 affected; ID/passport copies, salaries, bank details; PDPC fine S$26,000 — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-cognita-asia-holdings sgim:069f056d526743c4 Sat, 12 Jun 2021 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (65). Potential records: 1260. Budgetcars : Insecure Direct Object Reference: changing digits of a Tracking ID exposed other individuals' names, addresses, contact numbers and signatures; 44,357 at risk; remediation directions (no penalty) — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-budgetcars sgim:796db299f83e9819 Tue, 24 Aug 2021 16:00:00 +0000 data leak / unauthorized access Confidence: high (65). Potential records: 44357. Crawfort : A publicly accessible S3 bucket (open port, no access control during a migration) exposed NRIC images, loan contracts and income documents of 5,421 customers; remediation directions (no penalty) — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-crawfort sgim:ffb38a512b07c45f Tue, 14 Apr 2020 16:00:00 +0000 data leak / unauthorized access Confidence: high (65). Potential records: 5421. Audio House Marketing : Ransomware on the customer database via SQL-injection vulnerabilities in the website (possibly present since 2017); ~98,000 customers' contact details; PDPC fine S$10,000 — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-audio-house sgim:eba1a3c72c1c289d Mon, 31 May 2021 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (65). Potential records: 98000. Terra Systems : Call-centre vendor to ICA for Stay-Home-Notice checks; a disgruntled ex-employee used a shared daily password to access SHN records (125 at risk) and alter 4; PDPC fine S$12,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-terra-systems sgim:a95fce2f0ac40dbe Mon, 13 Jul 2020 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 125. Quoine : Crypto exchange; attacker social-engineered a third-party domain provider to seize the domain, then took over a DevOps account without 2FA and reached the database; 652,564 customers (incl. 362,035 KYC document images); PDPC fine S$67,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-quoine sgim:bca3cac867cd8273 Thu, 12 Nov 2020 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: 652564. Vhive : Furniture retailer; ransomware via an outdated, vendor-hosted e-commerce webserver and an unpatched firewall (no written vendor contract); ~186,281 customers; PDPC fine S$22,000 — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-vhive sgim:2782cdac41f0da0e Thu, 25 Mar 2021 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (65). Potential records: 186281. Toll (Singapore entities) : Toll Logistics (Asia), Toll Global Forwarding, Toll Offshore Petroleum Services and Toll (TZ); group-wide ransomware at Toll Holdings (Australia) via stolen vendor credentials encrypted servers incl. Singapore; 1,748 employees' HR data; breach of the Transfer Limitation Obligation (warning, no penalty) — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-transfer-limitation-obligation-by-toll-logistics-and-others sgim:bcade5095df6aac4 Sat, 25 Apr 2020 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (65). Potential records: 1748. Singtel (My Singtel app) : A system-migration timeout in the My Singtel app returned the current holder's service info for reassigned/historical numbers; 750 subscribers at risk (39 accessed); PDPC fine S$9,000 — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-singtel sgim:f1c66ed21292e16c Mon, 19 Feb 2018 16:00:00 +0000 data leak Confidence: high (65). Potential records: 750. Accellion FTA (file-transfer appliance) : Legacy third-party file-sharing appliance; zero-day vulnerabilities exploited in a global campaign (Clop) exfiltrated data from many organisations worldwide, including Singtel — unauthorized access / data leak https://www.singtel.com/about-us/media-centre/news-releases/singtel-addresses-data-breach-moves-to-support-affected-stakeholders sgim:5aee7113696a1e66 Tue, 19 Jan 2021 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: not stated. Singtel (Accellion FTA) : ~129,000 customers' data (NRIC, name, DOB, mobile, address) plus 28 former employees' bank details taken via the breached third-party Accellion file-sharing system; also some data from 23 enterprises — data leak / unauthorized access https://www.singtel.com/about-us/media-centre/news-releases/singtel-addresses-data-breach-moves-to-support-affected-stakeholders sgim:56e172223f97e39e Tue, 19 Jan 2021 16:00:00 +0000 data leak / unauthorized access Confidence: high (75). Potential records: 129000. Trinity Christian Centre : Ransomware via an IT vendor's admin account over an exposed RDP port; 72,285 individuals incl. ~8,300 minors; name, full ID, medical condition and more; PDPC fine S$20,000 — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-trinity-christian-centre sgim:934a11e602682e86 Tue, 16 Feb 2021 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (65). Potential records: 72285. GeniusU : Threat actor accessed a developer's GitHub (weak/compromised password) and used database credentials stored in the codebase to exfiltrate a staging database; ~1.26M users (name, email, location, last sign-in IP); PDPC fine S$35,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-geniusu sgim:a6cf95ea989f4991 Mon, 11 Jan 2021 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: 1.26e+06. Love, Bonito : Magecart-style attack: a compromised Magento admin account let an attacker inject card-skimming JavaScript on checkout and export order data; 5,561 customers (556 incl. full card details); PDPC fine S$24,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-lovebonito sgim:c8c54f57efed33a0 Thu, 21 Nov 2019 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 5561. PINC Interactive : A staging database exposed via an unauthenticated internet-facing test API (and copies kept on developers' personal devices) was exfiltrated; 3,916 real users (name, email, password hash, contact); PDPC fine S$12,500 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-accountability-and-protection-obligations-by-pinc-interactive sgim:8d15ec89327fc0ca Mon, 30 Sept 2019 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 3916. NUS & NTU (university research networks) : Advanced Persistent Threat (APT) intrusions into NUS (detected 11 Apr) and NTU (19 Apr) networks, assessed as seeking government/research-related information; no evidence student data was targeted; operations unaffected; no attribution — unauthorized access / other https://www.csa.gov.sg/news-events/press-releases/action-taken-following-breach-of-two-universities-it-networks/ sgim:4a87709b1987dda2 Mon, 10 Apr 2017 16:00:00 +0000 unauthorized access / other Confidence: high (80). Potential records: not stated. StarHub : ~57,191 customers' data from a 2007 file found exposed on a third-party data-dump site (name, NRIC, mobile, email); how it was exfiltrated was not established; StarHub offered identity monitoring — data leak https://www.straitstimes.com/tech/more-than-57000-starhub-customers-personal-data-leaked sgim:f9f5b084041bec7d Mon, 05 Jul 2021 16:00:00 +0000 data leak Confidence: high (65). Potential records: 57191. Southaven Boutique : Ransomware on the point-of-sale server encrypted customer data (outdated OS/anti-virus, no POS-vendor data-protection terms); 4,709 customers; PDPC fine S$2,000 — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-southaven-boutique sgim:348aebcdb4c5f41d Wed, 03 Feb 2021 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (65). Potential records: 4709. Tanah Merah Country Club : Password-spraying attack compromised an employee email account (password unchanged since 2016), used to send phishing emails; 467 individuals (incl. 28 with NRIC/email in the emails); PDPC fine S$4,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-by-tanah-merah-country-club sgim:250f39c467757a44 Sun, 21 Feb 2021 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 467. Tanah Merah Country Club : An unknown party gained access to the marketing EDM system and sent unauthorised spam; the shared login password had not been changed since 2010 and was known to two marketing staff and a support vendor; PDPC fine reduced from S$8,000 to S$4,000 (DP-1906-B4115) — unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-tanah-merah-country-club sgim:f1228cb71d1326ba Sat, 08 Jun 2019 16:00:00 +0000 unauthorized access Confidence: high (65). Potential records: not stated. Vimalakirti Buddhist Centre : Ransomware encrypted the membership database (~8,500: 4,500 members + 4,000 non-members); name, address, contact, NRIC, DOB and donation details; no procedural or technical safeguards in place; PDPC fine S$5,000 (DP-2004-B6193) — ransomware / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-vimalakirti-buddhist-centre sgim:c47a5a4b10a64d60 Mon, 30 Mar 2020 16:00:00 +0000 ransomware / unauthorized access Confidence: high (65). Potential records: 8500. Interauct! : A vendor server misconfiguration exposed migration backup files on a public sub-domain that should have been deleted after 2012/2016 migrations; ~8,750 individuals (3,380 matched to a telco's customers); NRIC/passport, mobile, address, DOB, email; warning for breaching the Retention Limitation Obligation (DP-1911-B5268) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-retention-obligation-by-interauct sgim:322528083b216dd6 Sun, 31 Mar 2019 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 8750. North London Collegiate School (Singapore) : Admission documents left in a web directory that search engines indexed (relied only on robots.txt), exposed Dec 2019-Jul 2021; passports 1,742, NRICs 1,714, plus birth certificates, academic and immunisation records (minors' data); PDPC fine S$10,000 — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-north-london-collegiate-school sgim:f8983773e4b4d154 Sat, 30 Nov 2019 16:00:00 +0000 data leak Confidence: high (65). Potential records: 1742. Nature Society (Singapore) : Likely SQL injection on an unpatched website exfiltrated the member database (names, emails, phones, DOB, encrypted passwords), later offered on hacking forums/Telegram; 5,131 individuals; PDPC fine S$14,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-accountability-obligations-by-nature-society sgim:f961b729837a7abc Thu, 05 Nov 2020 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 5131. Belden Singapore : Malware intrusion into Belden Group servers (US and elsewhere) exfiltrated employee and supplier/vendor data (Sep-Nov 2020); 126 individuals in Singapore (189 across the group); breach of the Transfer Limitation Obligation (warning, no penalty) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-transfer-limitation-obligation-by-belden-singapore sgim:eecae8a156253a0b Wed, 11 Nov 2020 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 126. ChampionTutor : Suspected SQL injection (a vulnerability flagged in a Dec 2020 pentest but left unfixed) exfiltrated the student database, offered for sale on the dark web; 4,625 students (name, email, contact, address); PDPC fine S$10,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-championtutor sgim:50394b90ddf4d433 Tue, 23 Feb 2021 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 4625. National Kidney Foundation : Phishing compromised an employee's work email; the attacker synced and downloaded a 23,145-email mailbox holding patients', employees' and nurses' data (medical conditions, bank, income, IDs); ~500 individuals; warning (no penalty) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-the-national-kidney-foundation sgim:9453624105dc5d61 Sat, 16 May 2020 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 500. Commeasure (RedDoorz) : Singapore's largest breach: a threat actor used an AWS key embedded in a public (defunct) Android app that had live production-database access; ~5.89M customer records (names, contacts, DOB, hashed passwords, bookings); PDPC fine S$74,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-commeasure sgim:c60d67e89a443ff2 Fri, 18 Sept 2020 16:00:00 +0000 unauthorized access / data leak Confidence: high (75). Potential records: 5.892843e+06. Specialized Asia Pacific : The 'Specialized Cadence' app was built with a development tool whose default privacy setting left user/developer data visible; a member of the public intercepted app traffic to access it; 2,445 individuals; warning (no penalty) — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-specialized-asia-pacific sgim:a25e7739b9039edc Thu, 28 Jan 2021 16:00:00 +0000 data leak / unauthorized access Confidence: high (65). Potential records: 2445. NUInternational Singapore & Newcastle Research and Innovation Institute : Ransomware at the group's overseas databases (UK parent and a Malaysian related company) exfiltrated names and account IDs of 1,277 Singapore staff/students; breach of the Transfer Limitation Obligation; directions (no penalty) — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-transfer-limitation-obligation-by-nuinternational-singapore-and-newcastle-research-and-innovation-institute sgim:9e76ce445591443b Sat, 29 Aug 2020 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (65). Potential records: 1277. Sendtech : A compromised AWS access key (created in 2015, never rotated) gave admin access to storage buckets; 64,196 customers (incl. last-4 card) and 3,401 contractors/employees (NRIC/work-permit copies); no exfiltration found; PDPC fine S$9,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-sendtech sgim:82e81c832fe7b4e5 Tue, 09 Feb 2021 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 67597. Seriously Keto : Ransomware; an unprotected file held unencrypted server login credentials that were accessed; ~3,073 individuals (name, address, email, phone); PDPC fine S$8,000 — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-seriously-keto sgim:40772e96ade7ec9d Sun, 14 Jun 2020 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (65). Potential records: 3073. SAP Asia : A payslip programme built only for single-employee issuance sent 43 former employees' payslips (NRIC, bank account, salary) to the wrong recipients; human error/design flaw, no attacker; PDPC fine S$13,500 — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-sap-asia sgim:3b7a3b8ca390502d Mon, 30 Mar 2020 16:00:00 +0000 data leak Confidence: high (65). Potential records: 43. Stylez : A testing database sat in a publicly accessible directory (no access controls), crawled/indexed by search engines and exfiltrated to the dark web; admin password kept in cleartext; 9,983 individuals; PDPC fine S$37,500 — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-accountability-and-retention-limitation-obligations-by-stylez sgim:3ec2d915b155fbf5 Tue, 24 Dec 2019 16:00:00 +0000 data leak / unauthorized access Confidence: high (65). Potential records: 9983. J & R Bossini Fashion : Attackers exploited an unpatched VPN vulnerability (patch available since Sep 2019) to deploy ransomware; 154,213 Singapore customers' data encrypted and at least 14,082 exfiltrated to the dark web, plus 120 employees; directions (no penalty) — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-transfer-limitation-obligations-by-j-r-bossini-fashion sgim:2c2b9c8afbdd9834 Tue, 26 May 2020 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (65). Potential records: 154213. ST Logistics : Logistics provider to MINDEF/SAF; phishing installed Emotet malware on staff laptops (missing endpoint protection); working files held 2,400 MINDEF/SAF personnel's data incl. NRIC; PDPC fine S$8,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-st-logistics sgim:aa9652949176ae5d Tue, 01 Oct 2019 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 2400. HMI Institute of Health Sciences : Ransomware on a file server after a brute-forced admin password via an open RDP port (3389); ~110,080 participants and 253 employees (NRIC, bank/CPF, course and employment data); PDPC fine S$35,000 — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-hmi-institute-of-health-sciences sgim:66b323bd91df8b47 Tue, 03 Dec 2019 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (70). Potential records: 110333. Webcada : Ransomware uploaded through a misconfigured IPMI interface left open to the public internet (and omitted from vulnerability scans); 522,722 individuals (names, phones, DOB, addresses, order histories); PDPC fine S$25,000 — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-accountability-obligation-by-webcada sgim:c75572069242c3dd Fri, 28 Aug 2020 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (70). Potential records: 522722. Larsen & Toubro Infotech : Recruitment data mishandled by email: 13 past applicants' forms (incl. medical status and criminal-records disclosure) were sent to 74 other applicants, and a reminder email exposed all recipients' addresses; human error; PDPC fine S$7,000 — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-consent-obligation-by-larsen-toubro-infotech sgim:413fc25cd8124b58 Tue, 24 Nov 2020 16:00:00 +0000 data leak Confidence: high (65). Potential records: 87. Greatearth Corporation : A safety coordinator misread an instruction and pasted a list of 8 crane operators' data (name, NRIC, contact, photo ID) with a 'BANNED' header on a worksite's external facade for ~2 months; Consent Obligation breach; warning (no penalty) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-consent-obligation-by-greatearth-corporation sgim:3b4511e9177bb630 Tue, 23 Jul 2019 16:00:00 +0000 data leak Confidence: high (65). Potential records: 8. Flying Cape : An employee stored an unencrypted Excel export of 191 users (names, emails, contacts) in a publicly accessible storage bucket, against IT policy; human error; warning (no penalty) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-flying-cape sgim:6bcd441e5a861b4f Thu, 24 Sept 2020 16:00:00 +0000 data leak Confidence: high (65). Potential records: 191. St. Joseph's Institution International : A staff member deployed a Chrome extension from VirusTotal that forwarded scanned data to VirusTotal premium members, exposing 3,155 parents' and students' data (incl. students' DOB and grades); human error; warning (no penalty) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-st-josephs-institution-international sgim:30dc261e165ec778 Mon, 12 Oct 2020 16:00:00 +0000 data leak Confidence: high (65). Potential records: 3155. Mobile Guardian (MOE device-management vendor) : Mobile device-management vendor for MOE Personal Learning Devices; its user-management portal was breached (Apr 2024), exposing names/emails of parents and staff across 5 primary and 122 secondary schools; a separate Aug 2024 compromise was used to remotely wipe ~13,000 students' devices, after which MOE removed Mobile Guardian from all devices — unauthorized access / data leak / other https://www.moe.gov.sg/news/press-releases/20240419-no-sensitive-data-compromised--from-unauthorised-access-into-mobile-guardians-systems sgim:ef4ec264a0883c61 Tue, 16 Apr 2024 16:00:00 +0000 unauthorized access / data leak / other Confidence: high (80). Potential records: not stated. iApps : Vendor/data intermediary for Sport Singapore's ActiveSG app; an engineer deployed a fix directly to production (bypassing the test stage), exposing 108 users' data (name, NRIC; incl. 9 minors) to other logged-in users; human error; PDPC fine S$9,000 — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-iapps sgim:f5cd9e4e5cf3e8a6 Thu, 28 Feb 2019 16:00:00 +0000 data leak / unauthorized access Confidence: high (65). Potential records: 108. Jigyasa : Appraisal/360-feedback reports left publicly accessible and search-indexed after a 2017 website redesign (no password protection); 671 employees of clients; PDPC fine reduced on reconsideration to S$30,000 — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-accountability-obligations-by-jigyasa sgim:91b49e6039362cd7 Sun, 09 Jul 2017 16:00:00 +0000 data leak Confidence: high (65). Potential records: 671. Tripartite Alliance : CRM server hit by ransomware after hacking attempts; ~12,000 individuals (and ~8,000 companies; ~20,000 total) with name, ID, salary and employment-dispute details on an unencrypted database; no exfiltration evidence; PDPC fine S$29,000 — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-tripartite-alliance sgim:37091085bb0f11d7 Sun, 16 Feb 2020 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (65). Potential records: 12000. Chapel of Christ the Redeemer : A staff member accidentally uploaded an internal file (815 members' name, NRIC, DOB, contact) to a publicly accessible, search-indexed sub-directory; human error; directions (no penalty) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-accountability-obligations-by-chapel-of-christ-the-redeemer sgim:7b2c852b2a2d5eea Sat, 23 Nov 2019 16:00:00 +0000 data leak Confidence: high (65). Potential records: 815. BLS International Services Singapore : Visa/consular-services vendor for the High Commission of India; a booking-system URL-encryption flaw let users manipulate confirmation URLs to view others' data (name, passport number, contacts); 3,357 at risk; PDPC fine S$5,000 — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-bls-international-services-singapore sgim:c4b0b5f654731d6b Sun, 07 Jun 2020 16:00:00 +0000 data leak / unauthorized access Confidence: high (65). Potential records: 3357. The Future of Cooking : A WordPress plugin bug wrote a temporary file into a publicly accessible directory, exposing 178 customers' data (name, email, addresses, orders, phone) for ~3 months; no pre-launch testing; PDPC fine S$9,000 — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-the-future-of-cooking sgim:39bc35ae020a2bb1 Mon, 30 Sept 2019 16:00:00 +0000 data leak Confidence: high (65). Potential records: 178. Water + Plants Lab : An employee opened a ransomware email attachment that encrypted the server (no patching/scanning in the prior 12 months); 28 employees' data (NRIC/FIN/WP, address, DOB, photo); warning (no penalty) — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-water-plants-lab sgim:61c3523098530b94 Sun, 29 Mar 2020 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (65). Potential records: 28. R.I.S.E Aerospace : Ransomware encrypted the network-storage server (no security scans, firmware updates or IT policies); 21 employees' data (NRIC, work-permit/passport, redacted bank, a child's DOB); warning (no penalty) — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-rise-aerospace sgim:bbaf3bd79a7f518d Sat, 22 Aug 2020 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (65). Potential records: 21. Hello Travel : The member database (71,002 users, 2015-2018) was posted on an internet forum, likely taken via vulnerabilities in a free WordPress plugin; names, emails, nationality, DOB; PDPC fine S$8,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-hello-travel sgim:5c341c1d981c24f4 Tue, 07 Apr 2020 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 71002. Worksmartly : A GitHub repository holding a Roche HR file (308 employees and dependents: NRIC/FIN/passport, salary, bank account) was switched from private to public by mistake and exposed for five days; the file was also a 2017 migration leftover that should have been deleted; PDPC fine S$5,000 — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-retention-limitation-obligations-by-worksmartly sgim:c12f27c92ef5f89a Thu, 27 Feb 2020 16:00:00 +0000 data leak / unauthorized access Confidence: high (65). Potential records: 308. Novelship : A registered seller manipulated the public listing URLs (an insecure-direct-object-reference / OWASP Top 10 flaw that adequate pre-launch testing would have caught) to reach six other sellers' data: names, emails, shipping addresses, hashed passwords, bank account numbers; PDPC fine S$4,000 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-novelship sgim:6cc9e457b7858819 Tue, 30 Apr 2019 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 6. Chan Brothers Travel : A March 2018 Salesforce update enabled an SEO feature; three web forms inherited the site's 'Public' access setting, so submissions (names, emails, mobiles, ~50 NRIC; 5,593 individuals) were indexed and cached by search engines; warning (DP-1905-B3936) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-chan-brothers-travel sgim:701fa0abd17b2fda Wed, 22 May 2019 16:00:00 +0000 data leak Confidence: high (65). Potential records: 5593. Clarity Radiology : System vendor to NovenaMRI: its overseas IT vendor removed access restrictions on a network folder to patch the system and never restored them, so spreadsheets (~4,099 patients: names, NRIC, scan types) were indexed by Google; warning + directed to appoint a DPO and adopt data-protection policies (Accountability breach, DP-1811-B2975) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-mri-diagnostics-and-breach-of-the-accountability-obligation-by-clarity-radiology sgim:17d12a8aa5fa5ef2 Tue, 06 Nov 2018 16:00:00 +0000 data leak Confidence: high (65). Potential records: 4099. MRI Diagnostics (NovenaMRI) : Principal clinic whose patient spreadsheets (~4,099: names, NRIC, radiology scan types) were exposed through its system vendor Clarity Radiology after Clarity's IT vendor left a network folder publicly accessible and Google-indexed; warning (Protection Obligation, DP-1811-B2975) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-mri-diagnostics-and-breach-of-the-accountability-obligation-by-clarity-radiology sgim:d7cea4363bc96707 Tue, 06 Nov 2018 16:00:00 +0000 data leak Confidence: high (65). Potential records: 4099. Security Masters : A security officer used eight building visitors' mobile numbers (collected for passes) to chase returned passes and send Chinese New Year greetings; the firm had no SOP governing retrieval and use of visitor data; breach of the Protection Obligation, directed to revise training (DP-2002-B5875) — other https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-security-masters sgim:4dfaec83eb92f29f Sun, 16 Feb 2020 16:00:00 +0000 other Confidence: medium (50). Potential records: 8. Majestic Debt Recovery : Staff filmed a debt-recovery visit on a tablet and posted the footage (identifiable debtors) to the firm's public Facebook page despite the complainant's objections; no valid consent, no DP policies or DPO; PDPC fine S$7,500 (DP-1903-B3570). Consent/disclosure case, not a security breach — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-consent-and-accountability-obligations-by-majestic-debt-recovery sgim:0f035200d93a4968 Wed, 20 Mar 2019 16:00:00 +0000 data leak Confidence: high (65). Potential records: not stated. Secur Solutions Group : IT vendor / data intermediary to the Health Sciences Authority (HSA): a test/dev server holding copies of HSA's blood-donor database was internet-reachable and unsecured (unpatched, no perimeter firewall, no access controls), letting an outside expert reach ~800,000 donors' data (236k-328k records exfiltrated): name, NRIC, gender, phone, donation history, some blood type/height/weight; PDPC fine S$120,000 (DP-1903-B3501) — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-secur-solutions-group sgim:32435fba79f7419a Tue, 12 Mar 2019 16:00:00 +0000 data leak / unauthorized access Confidence: high (70). Potential records: 800000. Singapore Medical Association : An Office 365 account was compromised (believed brute-forced; no logs) and a rule set to forward incoming mail externally; 68 individuals across 137 emails (NRIC, DOB, indemnity, education, financial data); no password rotation or anti-brute-force controls; warning (DP-2001-B5770) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-singapore-medical-association sgim:e4d00226255e697d Mon, 27 Jan 2020 16:00:00 +0000 unauthorized access / data leak Confidence: medium (55). Potential records: 68. Civil Service Club : During remote troubleshooting an IT vendor engineer left a member directory publicly reachable and wrongly reported it disabled; ~1,770 members' profile photos plus NRIC/FIN used as the file names were exposed; CSC had set no data-protection requirements for the vendor; PDPC fine S$20,000 (DP-1907-B4180) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-civil-service-club sgim:670ef5aad08c7192 Sun, 23 Jun 2019 16:00:00 +0000 data leak Confidence: high (65). Potential records: 1770. Singapore Accountancy Commission : A folder of 6,541 Singapore Chartered Accountant Qualification candidates (names, NRIC, DOB, contact, education/employment, exam results) was mistakenly attached to emails sent to 41 unintended recipients over four months; no supervisory checks; PDPC fine S$5,000 (DP-1911-B5296) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-singapore-accountancy-commission sgim:162bd1e67d4593ba Tue, 11 Jun 2019 16:00:00 +0000 data leak Confidence: high (65). Potential records: 6541. Actstitude : A recruitment microsite stored 160+ applicants' uploaded resumes with no access controls; URLs could be altered to reach other files and Google indexed them; no vulnerability scanning; warning (DP-1910-B5129) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-actstitude sgim:309300d8e39e0c43 Thu, 24 Oct 2019 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 160. Jean Yip Salon : An internal-only system server was exposed to the internet with a well-known default username/password and unremoved user accounts; 28 individuals' data (name, NRIC, residence status, DOB, nationality, gender, mobile, job title); warning (DP-1907-B4281) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-jean-yip-salon sgim:9be4b41a0dd9361d Mon, 15 Jul 2019 16:00:00 +0000 unauthorized access / data leak Confidence: medium (50). Potential records: 28. FWD Singapore : A software logic error (introduced while fixing an earlier one) put the wrong mailing addresses on 42 payment-advice letters, disclosing 71 individuals' names and ID numbers; inadequate code review and unit testing; warning (DP-1907-B4352) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-fwd-singapore sgim:4b94ea23f6d90b0b Wed, 19 Jun 2019 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 71. MDIS Corporation : A vulnerability in the website CMS admin backend let Google crawl and index a spreadsheet of 304 individuals (name, NRIC/FIN, email, employer, billing address, course details); MDIS had not set data-protection requirements for its developer and skipped pre-launch testing; PDPC fine S$10,000 (DP-1905-B3832) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-mdis-corporation sgim:a50db1306010c1f2 Wed, 01 May 2019 16:00:00 +0000 data leak Confidence: high (65). Potential records: 304. The Central Depository (CDP) : After a post-trade system migration, the Dividend Cheque Module failed to consistently pull updated addresses, so 211 account holders' dividend mailers (name, NRIC, CDP account number, security name, quantity, dividend amount) went to outdated addresses; inadequate pre-migration testing; PDPC fine S$32,000 (DP-1905-B3847) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-cdp sgim:700ab86bfeead33a Tue, 19 Mar 2019 16:00:00 +0000 data leak Confidence: high (65). Potential records: 211. IP Tribe : Platform vendor / data intermediary to the MVNO Zero1 (and subcontractor of the billing system to Openet): a coding error left previously migrated data undeleted and the new platform reissued duplicate Batch IDs, emailing 118 invoices (name, address, subscriber ID, mobile, charges, call details) to the wrong subscribers; inadequate pre-launch testing; warning (DP-1908-B4431) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-zero1-and-ip-tribe sgim:5d775c0662e33605 Thu, 31 Jan 2019 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 118. Zero1 : Mobile virtual network operator whose Feb 2019 billing migration (handled by its vendor IP Tribe) emailed 118 invoices to the wrong subscribers after duplicate Batch IDs were reissued; ~12,000-15,000 subscribers were in the migration; warning (DP-1903-B3630) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-zero1-and-ip-tribe sgim:7687f64a2f9e1915 Thu, 31 Jan 2019 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 118. MCST 3400 : A NAS used for internal file sharing was reachable from the internet with no login; 562 individuals (12 council members + 550 proprietors): names, NRIC/passport, contact, unit numbers, ownership and account details, car plates; no prior security reviews; warning (DP-1909-B4797) — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-mcst-3400 sgim:a4348d7b72092450 Sun, 01 Sept 2019 16:00:00 +0000 data leak / unauthorized access Confidence: high (65). Potential records: 562. SSA Group International : A course-registration webpage (created April 2018) had no authentication limiting access and sat publicly exposed for over a year; 53 individuals' course-registration data (names, course titles, sponsorship type, transaction date); warning (DP-1909-B4729) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-ssa-group-international sgim:e75ce84155d185b1 Thu, 05 Sept 2019 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 53. Times Software : Payroll-software vendor / data intermediary to Dentons and TMF: after a hard-disk failure and server restore, password protection was not re-enabled and default settings left the file server publicly reachable (23 Dec 2017 - mid-Feb 2018), exposing 616 employees (400 Dentons, 162 Red Hat, 54 LIU): name, NRIC, address, salary, and for some bank/tax details; PDPC fine S$20,000 — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-retention-limitation-obligations-by-times-software-breach-of-the-protection-obligation-by-dentons-and-tmf sgim:d4f5c6a4dbc97f08 Fri, 22 Dec 2017 16:00:00 +0000 data leak / unauthorized access Confidence: high (65). Potential records: 616. Dentons Rodyk & Davidson : Law firm whose 400 employees' data (name, NRIC, address, contact, designation, salary) was exposed through its long-time payroll vendor Times Software; found in breach for having no written contract covering Times' electronic storage of the data; warning — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-retention-limitation-obligations-by-times-software-breach-of-the-protection-obligation-by-dentons-and-tmf sgim:5d8ec2446ed3d2d3 Fri, 22 Dec 2017 16:00:00 +0000 data leak Confidence: high (60). Potential records: 400. TMF Singapore : Payroll/HR provider and data intermediary for Red Hat and LIU: passed 216 of their employees' data (name, NRIC, DOB, nationality, salary, bank, tax, address) to Times Software for a migration without a written contract; exposed via Times' server; warning — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-retention-limitation-obligations-by-times-software-breach-of-the-protection-obligation-by-dentons-and-tmf sgim:ee8ffcefcadc6fda Fri, 22 Dec 2017 16:00:00 +0000 data leak Confidence: high (60). Potential records: 216. Everlast Projects (EPPL) : Hosted the server and ran centralised payroll for the Everlast group; ransomware (entry point never identified) encrypted the server holding 141 of its own employees' data (name, NRIC/FIN, DOB, bank, salary); no firewall, security reviews or IT policies; directions only, no fine (DP-1908-B4369) — ransomware / unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-accountability-and-protection-obligations-by-everlast-projects sgim:70e883719f225ac5 Fri, 09 Aug 2019 16:00:00 +0000 ransomware / unauthorized access / data leak Confidence: high (65). Potential records: 141. Everlast Industries (S) (EIPL) : Group company whose 239 employees' payroll data was processed and held by Everlast Projects when ransomware struck; found in breach for failing to supervise EPPL; directions only, no fine — ransomware / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-accountability-and-protection-obligations-by-everlast-projects sgim:b34e713f6b27633f Fri, 09 Aug 2019 16:00:00 +0000 ransomware / unauthorized access Confidence: high (60). Potential records: 239. ELG Specialist (ESPL) : Group company whose 4 employees' payroll data was processed and held by Everlast Projects when ransomware struck; found in breach for failing to supervise EPPL; directions only, no fine — ransomware / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-accountability-and-protection-obligations-by-everlast-projects sgim:06ef9a445399391a Fri, 09 Aug 2019 16:00:00 +0000 ransomware / unauthorized access Confidence: medium (55). Potential records: 4. A Best Security Management : Security vendor / data intermediary to MCST 4375: a staff member made an unauthorised disclosure of CCTV footage of an accident (an injured woman) by posting it online; no staff training or procedures for handling CCTV footage; directions only (DP-1903-B3437) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-accountability-obligations-by-mcst-4375-and-breach-of-the-protection-obligation-by-a-best-security-management sgim:0a09076ea213a175 Mon, 25 Feb 2019 16:00:00 +0000 data leak Confidence: medium (55). Potential records: not stated. MCST 4375 : Condominium management corporation and data controller for the CCTV footage disclosed by its security vendor A Best Security Management; found in breach for having no data-protection policies or written instructions to its agent/vendor on handling CCTV access and disclosure; directions only — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-accountability-obligations-by-mcst-4375-and-breach-of-the-protection-obligation-by-a-best-security-management sgim:4233e20f1ff5756e Mon, 25 Feb 2019 16:00:00 +0000 data leak Confidence: medium (55). Potential records: not stated. New-E Security : Security vendor / data intermediary to MCST 3593: a security supervisor copied CCTV lobby footage to his phone and sent it to a resident against instructions; no written policies or staff data-protection training; directions only (DP-1903-B3554) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-accountability-obligations-by-mcst-3593-and-breach-of-the-protection-obligation-by-new-e-security sgim:824fe1e6f6b41cc8 Thu, 31 Jan 2019 16:00:00 +0000 data leak Confidence: medium (55). Potential records: not stated. MCST 3593 : Condominium management corporation and data controller whose CCTV footage was leaked by a supervisor at its security vendor New-E; found in breach for no data-protection clauses in the contract, no written instructions, no DPO and no policies; PDPC fine S$5,000 — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-accountability-obligations-by-mcst-3593-and-breach-of-the-protection-obligation-by-new-e-security sgim:b9646ed988d86727 Thu, 31 Jan 2019 16:00:00 +0000 data leak Confidence: high (60). Potential records: not stated. Henry Park Primary School Parents' Association : A weakness in access control let Google crawl and index member data (parents' names and contact numbers, child's name and class); found via a Google search; no DPO or data-protection policies; directions only (DP-1903-B3531) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-accountability-obligations-by-henry-park-primary-school-parents-association sgim:8a7eef577e5b0bb6 Thu, 14 Mar 2019 16:00:00 +0000 data leak Confidence: medium (50). Potential records: not stated. AXA Insurance : An internal record document was scanned together with a customer's and emailed out; 87 policyholders' names, NRIC, policy numbers and servicing-agent details disclosed; no process to separate internal from customer documents during scanning; warning (DP-1907-B4201) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-axa-insurance sgim:ed6c25a299fb10d8 Thu, 27 Jun 2019 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 87. NTUC Income : A website enquiry enhancement ('poor quality codes') attached 17 users' uploaded files to the acknowledgement emails of 123 later users (names, policy numbers, premiums, sum assured, coverage, email, address); manual review and testing missed it; warning (DP-1907-B4288). Same company as Income Insurance — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-ntuc-income sgim:65e8f4dad03ceea6 Tue, 09 Jul 2019 16:00:00 +0000 data leak Confidence: high (60). Potential records: 17. Royal Caribbean Cruises (Asia) : A receipt system was hacked by exploiting admin credentials stored unprotected on the same server and an unpatched phpMyAdmin; 6,004 customers (440 with passport/credit-card data) and 25 employees exposed; PDPC fine S$16,000 (DP-1904-B3721) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-royal-caribbean-cruises-asia sgim:a4d38e0e54f8f330 Wed, 10 Apr 2019 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 6004. SPH Magazines : An attacker used a senior HardwareZone forum moderator's credentials (found in a credential-leak database) to make 704,764 profile-view attempts against 685,393 user profiles (usernames, emails, optional profile fields; names/passwords were MD5-hashed); no password enforcement or security testing; PDPC fine S$26,000 (DP-1802-B1731) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-sph-magazines sgim:591a3098be4d8ab7 Thu, 21 Sept 2017 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: 685393. SCAL Academy : A freelance vendor's website enhancement did not restrict access to the folder holding scanned registration documents and omitted bot-crawler blocking, so search engines indexed 3,628 participants' data (name, race, nationality, DOB, NRIC/work-permit, address, occupation, employer); PDPC fine S$15,000 (DP-1811-B3061) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-scal-academy sgim:011ba0555151bf1f Wed, 28 Nov 2018 16:00:00 +0000 data leak Confidence: high (65). Potential records: 3628. Creative Technology : A SQL-injection attack exploited a known vBulletin forum vulnerability left unpatched since May 2015; 484,512 user accounts were extracted (username, email, IP, MD5-hashed password, optional profile data); the org deleted the database prematurely (an aggravating factor); PDPC fine S$15,000 (DP-1811-B3058) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-creative sgim:828febb7609afd5e Thu, 24 May 2018 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: 484512. Society of Tourist Guides : Images of 111 members' identification documents (NRIC with thumbprint, driving and vocational licences, some passports/SAF ID) sat in publicly accessible web directories; no vendor requirements, security testing, DPO or policies; PDPC fine S$20,000 (DP-1903-B3445) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-accountability-obligations-by-society-of-tourist-guides sgim:e6091dfb32e4feab Sat, 02 Mar 2019 16:00:00 +0000 data leak Confidence: high (65). Potential records: 111. PeopleSearch : Ransomware exploited vulnerabilities on a VM server with no security scans, penetration testing or patching for at least 12 months; ~944 individuals (472 employees: NRIC, address, bank, salary; plus 472 next-of-kin); PDPC fine S$5,000 (DP-1903-B3521) — ransomware / unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-peoplesearch sgim:22b7e4cae380a9f1 Thu, 28 Feb 2019 16:00:00 +0000 ransomware / unauthorized access / data leak Confidence: high (65). Potential records: 944. National Healthcare Group : A web configuration file lacked an access-restriction setting (live since Dec 2015), exposing a list of 134 individuals (129 GPs: full name, NRIC, DOB, photo, SMC registration, contact; plus 5 members of the public); a penetration test had flagged it over a year earlier but it was never fixed; PDPC fine S$6,000 (DP-1802-B1703/B1765) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-national-healthcare-group sgim:5832ffc81b202287 Tue, 06 Feb 2018 16:00:00 +0000 data leak Confidence: high (65). Potential records: 134. SAFRA National Service Association : During a manual, undocumented mass-email process an employee failed to delete an attached spreadsheet, sending 780 members' data (name, NRIC, DOB, address, phone, email) to 491 other members; PDPC fine S$10,000 (DP-1809-B2711) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-safra-national-service-association sgim:1c1d720b12ef24bf Sat, 08 Sept 2018 16:00:00 +0000 data leak Confidence: high (65). Potential records: 780. Globalsign.in (G2M) : Email-marketing platform (Global2Mail): its admin account was compromised and used to blast spam to 359,364 addresses belonging to MSIG (149,172) and three other client firms (201,192); shared admin credentials, no password policy, no security scans, no post-campaign purge; MSIG found compliant; PDPC fine S$34,000 (DP-1708-B1066/B1086) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-retention-obligations-by-globalsignin-pte-ltd sgim:c9a5532f9b3ebb7f Thu, 17 Aug 2017 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: 359364. Honestbee : Customer data was placed in an AWS storage bucket with no access restrictions, leaving ~8,000 individuals' names, emails, residential addresses and mobile numbers reachable by anyone with AWS CLI knowledge; PDPC fine S$8,000 (DP-1905-B3827) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-honestbee sgim:b668272c9610628c Wed, 01 May 2019 16:00:00 +0000 data leak Confidence: high (65). Potential records: 8000. Global Outsource Solutions : Customer data (name, email, mailing address, contact, purchase details) was exposed through a website the org gave no security requirements for, never reviewed and never security-tested; vendor-built, root cause not identified; directions only (DP-1809-B2767) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-accountability-obligations-by-global-outsource-solutions sgim:1e9c05ca7e4f3278 Sat, 22 Sept 2018 16:00:00 +0000 data leak Confidence: medium (50). Potential records: not stated. Chizzle : An attacker reached the mobile app's database through an internet-exposed phpMyAdmin with a guessable password (org name + year), copied and deleted it and left a ransom demand; ~2,213 users (names, DOB, gender, email, some mobile/address); PDPC fine S$8,000, affirmed on reconsideration (DP-1807-B2495, [2019] SGPDPC 44 / [2020] SGPDPCR 1) — ransomware / unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-chizzle sgim:6685c511ea2ede36 Sun, 29 Jul 2018 16:00:00 +0000 ransomware / unauthorized access / data leak Confidence: high (70). Potential records: 2213. The Travel Corporation (2011) : An employee lost an unencrypted laptop and portable hard disk; 18,630 individuals (5,437 customers, 11,000 prospects, 1,900 suppliers, 30 employees; 263 with passport/NRIC): names, email, phone, DOB, address; no portable-storage procedures or encryption; PDPC fine S$12,000 (DP-1810-B2821) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-accountability-obligations-by-the-travel-corporation-2011 sgim:f242b3bfb5d6953f Tue, 24 Jul 2018 16:00:00 +0000 data leak Confidence: high (65). Potential records: 18630. i-vic International : An error in the automated batch email-generation code attached the wrong documents to queued emails, sending 3 individuals' data (name, NRIC, signature, address, contact, age, race; 2 with bank accounts) to 9 unauthorised recipients; queued-processing behaviour was never tested; PDPC fine S$6,000 (DP-1804-B1991) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-i-vic-international sgim:f350e4b35ba8ed9b Sun, 15 Apr 2018 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 3. Toppan Next Tech (printing vendor) : A printing vendor that produces customer statements and letters for Singapore banks and handles print jobs for government agencies; an Apr 2025 ransomware attack on its systems exposed data it held for DBS, Bank of China and (surfacing later) the Traffic Police; the clients' own systems were not breached — ransomware / unauthorized access / data leak https://www.dbs.com/newsroom/DBS_made_aware_of_ransomware_attack_at_printing_vendor_Toppans_systems_affecting_mainly_statements_related_to_DBS_Vickers_accounts sgim:0b9d94306550b0cc Sun, 06 Apr 2025 16:00:00 +0000 ransomware / unauthorized access / data leak Confidence: high (65). Potential records: not stated. DBS Bank : ~8,200 customers (mostly DBS Vickers, some Cashline) had printed-statement data (first/last name, postal address, equities and loan details; no login credentials, NRIC, balances or total holdings) exposed via a ransomware attack at printing vendor Toppan Next Tech; affected statements dated Dec 2024-Feb 2025; DBS's own systems were not breached — ransomware / data leak https://www.dbs.com/newsroom/DBS_made_aware_of_ransomware_attack_at_printing_vendor_Toppans_systems_affecting_mainly_statements_related_to_DBS_Vickers_accounts sgim:e2ecda3acc6c5e61 Sun, 06 Apr 2025 16:00:00 +0000 ransomware / data leak Confidence: high (70). Potential records: 8200. Bank of China (Singapore) : ~3,000 Bank of China Singapore customers whose paper letters were printed and distributed by Toppan Next Tech had their name, address and in some cases loan account number exposed via the ransomware attack on Toppan; BOC's own banking systems were not breached; part of the 11,000+ records compromised across DBS and BOC — ransomware / data leak https://www.boc.cn/sg/bocinfo/bi1/202504/t20250407_25314577.html sgim:b18346f8d14c8395 Sun, 06 Apr 2025 16:00:00 +0000 ransomware / data leak Confidence: high (70). Potential records: 3000. Singapore Traffic Police : ~1,300 individuals' traffic-related data, handled by the Traffic Police and printed via Toppan Next Tech, was found circulating online in Jul 2025 as a consequence of the earlier Apr 2025 ransomware attack on Toppan; the Police systems themselves were not breached — ransomware / data leak https://www.police.gov.sg/media-hub/news/2025/07/20250724_leak_of_traffic_polices_data_due_to_previous_ransomware_attack_on_toppan_next_pte_ltd sgim:3ca80b056377cb9b Wed, 23 Jul 2025 16:00:00 +0000 ransomware / data leak Confidence: high (70). Potential records: 1300. Tokio Marine Insurance Singapore (TMiS) : A ransomware attack hit Tokio Marine Insurance Singapore; the group reported no indication of a customer-information breach (scope verified by a third party), isolated the affected network and reported to authorities; only TMiS was affected (official press release, 16 Aug 2021) — ransomware https://www.tokiomarinehd.com/en/newsroom/release/k82ffv000000az4g-att/20210816_e.pdf sgim:26cb765ef85f76d1 Sun, 15 Aug 2021 16:00:00 +0000 ransomware Confidence: high (65). Potential records: not stated. Learnaholic : MOE-contracted attendance/e-learning vendor for schools: a firewall port left open and the VNC password disabled during troubleshooting exposed a guard-post system; email-login credentials sat in a shared folder and unencrypted data in a work email, so a hacker retrieved the credentials and exfiltrated data on ~47,802 students/parents/staff (name, NRIC, contact, email, address) including 372 students' medical data; discovered by police in Feb 2017; PDPC fine S$60,000 (DP-1703-B0567) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-learnaholic sgim:f90bb0951e76de5a Tue, 31 Jan 2017 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: 47802. CampVision : An unknown third party accessed the server of CampVision's form vendor Typeform, exposing 106 individuals' data (names, NRIC, email, schools); CampVision had no written contract or protection instructions with its processor (SHINE); warning (DP-1808-B2508) — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-campvision sgim:3a955d663957413c Thu, 31 May 2018 16:00:00 +0000 data leak / unauthorized access Confidence: medium (55). Potential records: 106. SearchAsia Consulting : A folder on the recruitment firm's web server holding job-seekers' resumes had no access controls, so search engines indexed the files and the public could open them (names, phone, employment/education history, and in one case nationality, DOB, marital status, salary); no security instructions to the developer/host, no testing; PDPC fine S$7,000 (DP-1809-B2790) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-searchasia-consulting sgim:fdf29f48ea4dad31 Tue, 25 Sept 2018 16:00:00 +0000 data leak Confidence: high (60). Potential records: not stated. Tan Tock Seng Hospital : Staff mail-merged appointment letters but sorted only the address column in the spreadsheet, so names and addresses no longer matched; 85 patients' letters (name, NRIC, appointment details) went to the wrong addresses; no pre-print checks; warning (DP-1902-B3372) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-tan-tock-seng-hospital sgim:cfbbe5f72a41db8b Mon, 11 Feb 2019 16:00:00 +0000 data leak Confidence: high (60). Potential records: 85. Ninja Logistics (Ninja Van) : Delivery tracking pages used the tracking ID as the sole authentication; changing digits exposed other recipients' records for close to two years; ~1,262,861 individuals with completed deliveries (names, signatures, potentially addresses); no procedure to purge completed records; PDPC fine S$90,000 (DP-1804-B2020) — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-ninja-logistics sgim:54482595177116e6 Sun, 22 Apr 2018 16:00:00 +0000 data leak / unauthorized access Confidence: high (70). Potential records: 1.262861e+06. EU Holidays : Tax invoices for 1,077 customers sat in publicly accessible web directories with no access controls (name, email, address, contact, booking/travel details, passport, DOB, amount payable); EU Holidays left security entirely to its IT vendor and never assessed the risk; PDPC fine S$15,000 (DP-1901-B3254, [2019] SGPDPC 38) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-accountability-obligations-by-eu-holidays sgim:a68e490adf9ac55f Fri, 04 Jan 2019 16:00:00 +0000 data leak Confidence: high (65). Potential records: 1077. iClick Media : IT vendor to EU Holidays, whose web directories exposed customer invoices; found in breach of the Accountability Obligation for having developed no internal data-protection policies or practices; directed to adopt policies and PDPA training (DP-1901-B3254) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-accountability-obligation-by-iclick-media sgim:0e851ae245b1c647 Fri, 04 Jan 2019 16:00:00 +0000 data leak Confidence: medium (55). Potential records: not stated. Singtel (mobile app API) : A Direct-Object-Reference flaw in a previous My Singtel app API let a logged-in user change the mobile/billing-account parameters to retrieve another customer's billing data; ~330,000 customers at risk (4 accounts confirmed accessed): name, billing address, account number, mobile, plan/usage; flagged by an anonymous tip; PDPC fine S$25,000 (DP-1705-B0781, [2019] SGPDPC 36) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-singtel-2019-11 sgim:869b1fec110c0b17 Tue, 16 May 2017 16:00:00 +0000 unauthorized access / data leak Confidence: high (70). Potential records: 330000. Marshall Cavendish Education : An engineer changed a firewall rule to allow internet access to a backup server and never reversed it; an attacker brute-forced in and uploaded ransomware; the database held ~250,928 student accounts (login ID = birth-cert/NRIC, name, school, level, class; some email/address/mobile/parent details); no evidence of exfiltration; PDPC fine S$40,000 (DP-1704-B0699) — ransomware / unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-marshall-cavendish-education sgim:4cd64f88b873d515 Tue, 31 Jan 2017 16:00:00 +0000 ransomware / unauthorized access / data leak Confidence: high (70). Potential records: 250928. Barnacles : A restaurant's vendor-built reservation website had no security arrangements (never instructed or checked), leaving 149 diners' data (names, contact, email, reservation details) searchable online; data was also kept after the business closed; warning (DP-1904-B3652) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-barnacles sgim:bd67bb41b7ae6620 Sun, 31 Mar 2019 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 149. ERGO Insurance : Employees did not follow the correct restart procedure for the application and printer servers after scheduled downtime; with no defined process and weak document-ID generation, duplicate IDs misdirected documents for 57 individuals (name, address, car registration, NRIC, DOB, contact); warning (DP-1810-B2869) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-ergo-insurance sgim:3f73f4846bc7f829 Mon, 10 Sept 2018 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 57. XDEL Singapore : Courier vendor / data intermediary to the MVNO Zero1: its in-house delivery-notification webpage checked only partial confirmation codes, so a blank code plus a guessed sequential membership number exposed ~292 recipients' data (name, NRIC, delivery address, contact, SIM number); 175 URLs accessed by 82 IPs over ~34 hours; PDPC fine S$7,000 (DP-1803-B1866) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-zero1-and-xdel sgim:12ff3e57b4906539 Sun, 11 Mar 2018 16:00:00 +0000 unauthorized access / data leak Confidence: high (60). Potential records: 292. Zero1 : MVNO whose subscriber/recipient data was exposed through a flaw in its courier vendor XDEL's delivery-notification webpage; Zero1 had not verified XDEL's security; ~292 individuals (name, NRIC, delivery address, contact); PDPC fine S$4,000 (DP-1803-B1866) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-zero1-and-xdel sgim:021c9e66dfe18650 Sun, 11 Mar 2018 16:00:00 +0000 unauthorized access / data leak Confidence: high (60). Potential records: 292. Advance Home Tutors : A developer migrated tutors' educational certificates to a publicly accessible directory with no access controls and a disclosure script with no consent check, so search engines indexed 152 tutors' data (name, NRIC, institutions attended, grades); inadequate security requirements and testing; PDPC fine S$1,000 (DP-1806-B2218) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-accountability-obligations-by-advance-home-tutors sgim:798652584e6359cd Wed, 06 Jun 2018 16:00:00 +0000 data leak Confidence: high (60). Potential records: 152. Amicus Solutions : A consultancy compiled and sold personal-data lists without consent or notification (22,658 records across three lists: partial NRIC, partial DOB, gender, mobile); a financial adviser bought two lists for Eldershield telemarketing (fined S$10,000); Amicus fined S$48,000 and ordered to stop selling and delete the data (DP-1610-B0290). Consent/data-brokering case, not a security breach — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-consent-and-notification-obligations-by-amicus-solutions-and-a-financial-consultant sgim:3d189ed2240c2bcf Mon, 21 Mar 2016 16:00:00 +0000 data leak Confidence: high (65). Potential records: 22658. O2 Advertising : A customer database sat in the Public_HTML directory with no access controls and was indexed by Google; 1,568 individuals (403 exposed, 1,165 at risk): name, NRIC, email, address, gender, DOB, mobile, skin type; no vulnerability scanning since launch; PDPC fine S$10,000 (DP-1807-B2376) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-retention-and-accountability-obligations-by-o2-advertising sgim:49d21c2f78de244f Mon, 09 Jul 2018 16:00:00 +0000 data leak Confidence: high (60). Potential records: 1568. Executive Link Services : The firm's IT vendor opened the server's FTP port as a VPN workaround and left the folders without passwords, so a third-party security scan retrieved 367 resumes and ~150 draft contracts (name, address, contact, education, salary, employment history); found in breach of the Accountability Obligation (no DPO or policies); PDPC fine S$5,000 (DP-1806-B2237) — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-accountability-obligation-by-executive-link-services sgim:8c968fca08bedcfa Sun, 10 Jun 2018 16:00:00 +0000 data leak / unauthorized access Confidence: medium (55). Potential records: 367. Friends Provident International : A faulty JavaScript exposed a hidden 'Report' tab with no separate authorisation or backend check, letting policyholders generate others' reports; ~240 individuals at risk (42 reports downloaded by 21 users; 11 policy numbers disclosed): names, policy numbers, region; inadequate testing; warning (DP-1805-B2112) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-friends-provident-international sgim:b468aaefb0f56f51 Mon, 11 Dec 2017 16:00:00 +0000 unauthorized access / data leak Confidence: medium (55). Potential records: 240. Avant Logistic Service : A delivery employee sent one customer's data to another customer; 9 individuals' mobile numbers (and an Ezbuy user ID enabling indirect identification) disclosed; no reasonable security arrangements; directions only (DP-1802-B1709) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-avant-logistic-service sgim:74b83cd99a5df0d9 Wed, 08 Nov 2017 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 9. Genki Sushi : A 'Dharma' ransomware variant entered through the server's internet link; ~360 current/former employees' HR data (name, NRIC/FIN, bank account, DOB, salary; some passport/address/relatives) was affected; no firewall for a period, unused ports open, no penetration testing or patching; PDPC fine S$16,000 (DP-1809-B2684) — ransomware / unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-genki-sushi sgim:3be9aecdd3ead5d3 Wed, 29 Aug 2018 16:00:00 +0000 ransomware / unauthorized access / data leak Confidence: high (65). Potential records: 360. Toppan Security Printing (TSP) : Printing vendor / data intermediary to CDP: its letter-layout program assumed exactly four data lines per account, so letters with fewer lines pulled in another account holder's details; 1,358 account holders (names, CDP securities account numbers, some securities names and dividend amounts) got misprinted notification letters; PDPC fine S$18,000 reduced to S$12,000 on reconsideration (DP-1706-B0895/B0908) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-cdp-and-toppan-security-printing sgim:2ec5e4c3e78179a6 Mon, 26 Jun 2017 16:00:00 +0000 data leak Confidence: high (65). Potential records: 1358. The Central Depository (CDP) : Misprinted notification letters from its printing vendor Toppan Security Printing disclosed 1,358 account holders' data (names, CDP securities account numbers, some securities names and dividend amounts) to the wrong holders; CDP's ambiguous print specification and four-line test data contributed; PDPC fine S$24,000 (DP-1706-B0895/B0908) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-cdp-and-toppan-security-printing sgim:618e2fac448c2eb4 Mon, 26 Jun 2017 16:00:00 +0000 data leak Confidence: high (65). Potential records: 1358. Spize Concepts : Someone logged into the managing director's admin account (a weak 8-digit password, no policy, shared among several people) and made an internal-only 'Call Center' link publicly accessible from Feb to Aug 2017; ~148 customers' data (names, contact, email, residential address) exposed; vendor Novadine hosted it but Spize was held responsible; PDPC fine S$20,000 (DP-1708-B1027) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-openness-and-transfer-limitation-obligations-by-spize-concepts sgim:9795c81f8b6c7ca8 Wed, 08 Feb 2017 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 148. SME Motor : The firm reused scrap paper containing personal data, so an invoice printed on the reverse disclosed two individuals' details (name, NRIC, insurance policy/claim numbers) to a customer; no guidelines on scrap documents, no staff training; directions only (DP-1901-B3318) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-sme-motor sgim:9fdd3d18e15a35d6 Wed, 30 Jan 2019 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 2. AIA Singapore : A software fix to the Integral Life System introduced a logic error that copied one letter's despatch address onto later letters in the batch, so ~244 letters went to the wrong addresses (name, policy number, policy type, premium amount and dates); inadequate testing and no accuracy checks; PDPC fine S$10,000 (DP-1801-B1530) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-aia sgim:4c0a5662800fe143 Thu, 21 Dec 2017 16:00:00 +0000 data leak Confidence: high (60). Potential records: 244. AIA Singapore : When requesting a medical report from a claimant's chiropractor, AIA also disclosed his bank-account details (collected only for direct crediting of claims) - a purpose unrelated to that stated; one individual, disclosed to one third party under confidentiality; purpose-limitation breach, warning (DP-1509-A533) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-purpose-limitation-obligation-by-aia-singapore sgim:2d7481a8badb58b8 Tue, 31 May 2016 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 1. InfoCorp Technologies : A token-sale registration form did not authenticate users downloading KYC documents, and sequential file IDs in the URL let participants alter it to reach others' files; 21 participants' KYC documents (photo ID, proof of residence, selfie holding ID) were downloaded by 15 others during a ~15-minute window; the vendor built the form but InfoCorp stayed responsible; PDPC fine S$6,000 (DP-1802-B1674) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-infocorp sgim:a7ff6437f13b749e Sun, 04 Feb 2018 16:00:00 +0000 unauthorized access / data leak Confidence: high (60). Potential records: 21. DS Human Resource : A MongoDB database was run on default settings with no access controls or admin password and inadequate patching, leaving it reachable over the internet; a hacker accessed and deleted the entire database of ~2,100 individuals (name, NRIC, DOB, bank account, work/education history, front/back NRIC images); no backup existed; PDPC fine S$33,000 (DP-1802-B1756) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-openness-and-protection-obligations-by-ds-human-resource sgim:17333d3669930cc2 Fri, 23 Feb 2018 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 2100. Ncode Consultant : Data intermediary / vendor to Victoria School (MOE): a student exploited an SQL-injection flaw in the NTRIX system with a public tool to obtain admin credentials (passwords were only Base64-encoded), making 84 unauthorised logins and altering 11 exam results; 2,792 student records (name, admission number, address, parents' contacts, exam scores); PDPC fine S$30,000 (DP-1712-B1471) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-ncode-consultant sgim:0e7ddf3963d4fac8 Tue, 10 Oct 2017 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 2792. Option Gift : A coding error in a script written to regenerate redemption confirmation emails kept earlier recipients' addresses in the 'To:' field, disclosing up to 426 individuals' data (portal login ID, email, delivery address, mobile); testing used a single hardcoded address and a service-account password had lapsed; PDPC fine S$4,000 (DP-1806-B2242/B2243/B2244) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-option-gift sgim:142d0514c370b8be Mon, 21 May 2018 16:00:00 +0000 data leak Confidence: high (60). Potential records: 426. Skinny's Lounge : A KTV bar replayed randomly selected recorded CCTV footage of patrons on a public lounge screen for a day or two after a camera malfunction; patrons had been told of live streaming but not of later replay; consent/notification/purpose-limitation breach, not a security breach or external exposure; warning (DP-1806-B2267) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-consent-and-notification-obligations-by-skinny-s-lounge sgim:dc376525433a700c Mon, 18 Jun 2018 16:00:00 +0000 data leak Confidence: medium (50). Potential records: not stated. H3 Leasing : A vehicle-rental firm posted a customer's scanned NRIC (full name, address, DOB, NRIC number, photo and thumbprint) on a public Facebook page to 'warn others' and trace a missing rental after the customer fell into arrears; one individual's data publicly exposed; consent/disclosure breach, warning (DP-1803-B1859) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-consent-obligation-by-h3-leasing sgim:9fafd4164b6b2131 Wed, 07 Mar 2018 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 1. PAP Community Foundation : A teacher shared a photo of a school-trip attendance list in a WhatsApp parent group, disclosing 15 students' and 30 parents' data (contact numbers, and 5 parents' NRIC numbers); no specific policies for handling personal data; warning (DP-1807-B2434) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-pap-community-foundation sgim:8080fee1a894f940 Sat, 30 Jun 2018 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 45. Matthew Chiong Partnership : A law firm's staff mistyped a recipient email address twice, and a scanner left on double-sided mode added an extra page of other clients' names, misdirecting four individuals' data (name, NRIC, address, bank/loan details, redemption statement) across three emails; no data-protection policies; PDPC fine S$8,000 (DP-1709-B1138) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-openness-and-protection-obligations-by-matthew-chiong-partnership sgim:8a2d724854ad13ac Sun, 27 Aug 2017 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 4. Tutor City : The directory holding uploaded tutor certificates had no access controls and was not blocked from search-engine indexing, so 50 tutors' data (name, NRIC, educational institutions, grades) was publicly accessible via Google; warning (DP-1806-B2228) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-tutor-city sgim:bb0df6a3fb739bbf Thu, 07 Jun 2018 16:00:00 +0000 data leak Confidence: high (60). Potential records: 50. Toppan Forms (S) : Printing/mailing vendor to AIG: a gap in its enveloping process (a similar-looking but wrong business-reply envelope inserted, supervisor/manager checks bypassed) sent 87 AIG policyholders' renewal letters with a reply envelope addressed to a third party; data included name, address, vehicle/policy details (and, if returned, ID/passport and credit-card details); AIG not penalised; Toppan fined S$5,000 (DP-1702-B0537) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-toppan-forms sgim:3b2fce56e61a43bf Sun, 09 Oct 2016 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 87. Bud Cosmetics : A membership list drawn from the online database sat in an unsecured, publicly accessible image folder that search engines could index; ~2,300 members' data (name, DOB, contact, email, address); no security arrangements, scans or policy; PDPC fine S$11,000 (DP-1704-B0660) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-bud-cosmetics sgim:05c3761ba8b2c9c8 Wed, 05 Apr 2017 16:00:00 +0000 data leak Confidence: high (60). Potential records: 2300. Funding Societies : A website component did not check that the authentication and authorisation tokens carried the same MemberID, so a registered member could access others' data; 2 members' data (customer ID, name, NRIC, address) was extracted and over 4,000 members' data (bank, wallet, agreements) was at risk over ~37 days; PDPC fine S$30,000 (DP-1708-B1035) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-funding-societies sgim:439e269ed4071f42 Mon, 24 Jul 2017 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 4000. Institute of Singapore Chartered Accountants (ISCA) : An employee's email auto-complete selected a same-first-name contact at a telco instead of the intended recipient, sending an unencrypted Excel file of 1,906 exam candidates (NRIC, passport, name, DOB, address, email, mobile, employment, qualifications, exam results); PDPC fine S$6,000 (DP-1711-B1367) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-institute-of-singapore-chartered-accountants sgim:171972f6c53f464e Thu, 23 Nov 2017 16:00:00 +0000 data leak Confidence: high (60). Potential records: 1906. SLF Green Maid Agency : On two occasions an employee reused scrap paper containing personal data, disclosing ~10 individuals' details (front/back NRIC photocopies, names, FIN, passport numbers, signatures, a family-circumstances letter); no processes, policies or training; directions only (DP-1806-B2265) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-slf-green-maid-agency sgim:a4e2b839e4a691c0 Sat, 07 Apr 2018 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 10. WTS Automotive Services : Its developer ZNO left out the authentication for several URL links during development, so three databases were indexable by search engines: Kaki Bukit (2,472), Gul Circle (2,223) and a master car database (3,764 owners) with names, NRIC/FIN, address, contact, email, car plate and vehicle details; no penetration testing; PDPC fine S$20,000 (DP-1706-B0834) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-wts-automotive-services sgim:629cba071b2cd245 Thu, 08 Jun 2017 16:00:00 +0000 data leak Confidence: high (65). Potential records: 8459. Big Bubble Centre : During a dispute with a former employee, the scuba-diving sole proprietor posted two Facebook posts (one in a public divers' group) disclosing the ex-employee's and his friend's data (name, NRIC, passport, DOB, contact, address; the friend's car make) without consent; publicly exposed until mid-March 2018; consent/disclosure breach, warning (DP-1802-B1770) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-consent-obligation-by-big-bubble-centre sgim:9712f4d94d83993b Wed, 28 Feb 2018 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 2. GrabCar (appeal form) : A 'GrabHitch SG Appeal Form' in Google Forms was set to let respondents see summary and text responses, so every appealing driver could view all others' appeal data; ~20 suspended Hitch drivers (name, NRIC, mobile, vehicle plate, reasons for suspension) exposed for under 8 hours; PDPC fine S$6,000 (DP-1706-B0871, [2018] SGPDPC 23) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-grabcar sgim:3098003ca6215d4e Thu, 15 Jun 2017 16:00:00 +0000 unauthorized access / data leak Confidence: high (60). Potential records: 20. Club the Chambers : A LAN gaming shop displayed photocopies of 11 banned members' identity documents on notices in its premises (name, photo, NRIC/FIN, student ID, mobile, employer, occupation and the reason for each ban); deliberate disclosure with no data-protection policies; PDPC fine S$7,000 (DP-1701-B0439) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-chambers sgim:38ed809d7c07fdcb Tue, 10 Jan 2017 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 11. Flight Raja Travels : A software change that was not fully integration-tested caused 45 booking records belonging to 72 other individuals (name, passport number, booking/flight details, amount paid) to be shown to one user; directions only (DP-1705-B0730) — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-flight-raja-travels sgim:0b4987a3bea1baac Wed, 30 Nov 2016 16:00:00 +0000 data leak / unauthorized access Confidence: medium (55). Potential records: 72. Spring College International : A private school posted at least four students' data (minors aged 8-11) on its public Facebook page to promote courses: full names, masked passport/FIN, DOB, photos, AEIS results, assigned schools, study levels; one post was Google-indexed; consent/purpose-limitation breach, directions only (DP-1705-B0799) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-consent-and-purpose-limitation-obligations-by-spring-college-international sgim:f3d8e3e35ef0b8b8 Mon, 30 Apr 2018 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 4. Singapore Taekwondo Federation : Championship result PDFs posted online had NRIC columns merely minimised rather than removed in the source Excel, so the hidden NRIC numbers of 782 participating students (minors) could be copied out of the PDF; no DPO, policies or training; PDPC fine S$30,000 (DP-1705-B0810) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-singapore-taekwondo-federation sgim:47d2065a45505993 Thu, 18 May 2017 16:00:00 +0000 data leak Confidence: high (60). Potential records: 782. Singapore Cricket Association : New player-profile pages (built by developer Massive Infinity from registration-form fields) published up to ~100 players' private data (NRIC/FIN, DOB, email, mobile) that should not have been shown; SCA gave no field specification and never reviewed the pages before launch; the vendor was not found in breach; directions only (DP-1704-B0707) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-singapore-cricket-association sgim:1134e4f4a13b06ae Wed, 16 Nov 2016 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 100. Dimsum Property : Two web directories holding users' identity documents had no access controls, exposing 31 individuals' data (photo, passport, NRIC, thumbprint, DOB and more) from Nov 2015 until the site was taken down in May 2018; warning (DP-1805-B2096) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-dimsum-property sgim:1591852d1264078e Tue, 08 May 2018 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 31. Jade E-Services (Zalora) : A newly introduced bot manager lacked the setting that prevents account pages with personal data from being cached, and misidentified some logged-in users as bots, so ~23 customers' data (name, contact, DOB, email, address) was served from cache to others; warning (DP-1801-B1632) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-jade-e-services-singapore sgim:0293b471f13aac60 Mon, 29 Jan 2018 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 23. Galaxy Credit and Investments : A moneylender mistagged a borrower's photograph (treated as sensitive, as it revealed he was an existing borrower) and attached it to three letters of demand left at a third party's residence; an end-of-day tagging practice created the mistagging risk; warning (DP-1803-B1886) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-and-purpose-limitation-obligations-by-galaxy-credit-and-investments sgim:6bdefdd583e6b234 Mon, 16 Oct 2017 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 1. Aviva : An administrative staff member enclosed four underwriting letters addressed to different clients in a single envelope, disclosing three clients' data (full name, address, medical conditions, sum assured) to one unintended recipient; no security arrangements in the enveloping process; PDPC fine S$30,000 (DP-1706-B0860) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-aviva-apr sgim:579f222d9728fef3 Tue, 31 Jan 2017 16:00:00 +0000 data leak Confidence: high (60). Potential records: 3. SMU Alumni Association : A membership webpage (live Feb-Jun 2017) authenticated access using only an identification number with no other security, exposing ~297 applicants' data (name, FIN/NRIC, contact, email, address, education details, application status); PDPC fine S$5,000 (DP-1706-B0828) — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-smu-alumni-association sgim:f8b65e82e5c66912 Tue, 06 Jun 2017 16:00:00 +0000 data leak / unauthorized access Confidence: high (60). Potential records: 297. AIG Asia Pacific : An incorrect fax number entered into renewal-notice templates misdirected an estimated 25-125 notices to a third party (Tokyu Hands) over six months; policyholders' and family members' data (names, addresses, policy, payment and contact details); PDPC fine S$9,000 (DP-1707-B0901) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-aig sgim:229a4b0753f710dd Mon, 28 Nov 2016 16:00:00 +0000 data leak Confidence: high (60). Potential records: not stated. NTUC Income : A print-room operator chose duplex instead of simplex for a batch of 426 letters, so two different clients' letters printed on each sheet; 214 clients' data (name, full address, policy type/number, premium - treated as sensitive) misdelivered; no check to catch it; PDPC fine S$10,000 (DP-1706-B0894) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-ntuc-income-2018-05 sgim:3c7ff43338e16cb7 Sun, 04 Jun 2017 16:00:00 +0000 data leak Confidence: high (60). Potential records: 214. Habitat for Humanity Singapore : A single PDF containing all volunteers' letters was emailed to all 32 volunteers with their addresses in the 'cc' field (full names, NRIC, email), after a manager did not brief staff on the usual batch-splitting procedure; no documented procedures or training; directions only (DP-1707-B0971) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-openness-and-protection-obligations-by-habitat-for-humanity-singapore sgim:a831f1ff1a6c6f0e Wed, 19 Jul 2017 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 32. Information Technology Management Association (Singapore) : A delegate list was inadvertently left attached when an email was forwarded to 49 delegates, disclosing 28 delegates' data (full name, gender, nationality, DOB, passport number); staff did not check attachments before sending; warning (DP-1708-B1019) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-information-technology-management-association-singapore sgim:abc842d1928af9ab Wed, 09 Aug 2017 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 28. Watami Food Service Singapore : A staff list sat on an unrestricted website server (possibly exposed since 2013) and was indexed by search engines, making 405 employees' full names and staff codes publicly searchable; inadequate staff training; warning (DP-1711-B1312) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-watami-food-service-singapore sgim:6ca6ca85bfc88922 Thu, 09 Nov 2017 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 405. Credit Counselling Singapore : An admin staff member pasted recipient addresses into the 'To' field instead of 'Bcc', exposing 96 debt-management clients' emails and some names (revealing their debt status - treated as sensitive); two more clients' questionnaire responses were disclosed via Reply-All; no checks or controls; PDPC fine S$10,000 (DP-1610-B0261) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-the-protection-obligation-by-credit-counselling-singapore sgim:8d291c7017252b07 Thu, 29 Sept 2016 16:00:00 +0000 data leak Confidence: high (60). Potential records: 96. ComGateway : Shipping-page URLs used predictable, Base64-encoded Shipment IDs that could be altered to reach other customers' pages, which had no authentication or access controls (flaw live from Jul 2014); ~108,085 customers' data (names, contact, addresses, shipping details) could have been exposed; PDPC fine S$10,000 (DP-1611-B0368) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-comgateway sgim:aa6e482573071697 Mon, 28 Nov 2016 16:00:00 +0000 unauthorized access / data leak Confidence: high (60). Potential records: 108085. Social Metric : Event-registration webpages had no access controls (no password protection), leaving ~558 individuals' data (names, email, contact, employer, occupation) publicly viewable online from 2014 to 2016; two pages included the names and ages of ~155 children; the org's external-hack claim was rejected; PDPC fine S$18,000 (DP-1604-A713) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-and-retention-obligations-by-social-metric sgim:ff50a15d7d7e40c6 Tue, 23 Dec 2014 16:00:00 +0000 data leak Confidence: high (60). Potential records: 558. M Stars Movers : A moving company publicly replied to a customer's negative Facebook review, disclosing her full name and residential address, and refused to remove it until advised by the Commission; no data-protection policy, DPO or PDPA awareness; consent/disclosure breach, directions only (DP-1612-B0418) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-consent-and-openness-obligations-by-m-stars-movers sgim:a7fb288695f310b1 Wed, 30 Nov 2016 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 1. Aviva : A processing staff member enclosed one policyholder's documents with follow-up letters addressed to a different policyholder, disclosing 2 individuals' data (NRIC, CPF account, DOB, nationality, occupation) to the wrong recipient; enveloping SOPs had no second-level checks; PDPC fine S$6,000 (DP-1611-B0323) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-aviva-oct sgim:3b04670af08f9010 Mon, 31 Oct 2016 16:00:00 +0000 data leak Confidence: high (55). Potential records: 2. Orchard Turn Developments (ION Orchard) : An attacker used valid 'admin' credentials to access the EDM (marketing email) application and send phishing emails; 24,913 subscribers received them and up to 47,635 could have been impacted (name, email, birthdate, registration date); the vendor Super-E's role was reviewed separately; PDPC fine S$15,000 (DP-1512-A612) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-orchard-turn-developments sgim:abe1339d75f4b036 Fri, 25 Dec 2015 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 47635. Hazel Florist & Gifts : A new employee used order forms meant for disposal as packing filler, disclosing ~24 individuals' data (names, delivery addresses, phone numbers, order reasons, and one NRIC) to a customer; no measures to ensure staff followed the disposal instruction, no training; warning (DP-1609-B0194) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-hazel-florist-and-gifts sgim:027d8973bb071a69 Sun, 31 Jul 2016 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 24. Eagle Eye Security Management Services : A visitor logbook recording swimming coaches' NRIC numbers and entry/exit times was left open and unattended on a table while no guard was posted (8pm-10.30pm); Eagle Eye acted as data intermediary for MCST 3696; unclear instructions and a thin policy; warning (DP-1610-B0275) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-eagle-eye-security-management-services sgim:7354f8d5fdd755c7 Sat, 15 Oct 2016 16:00:00 +0000 data leak Confidence: medium (50). Potential records: not stated. DataPost : Print/mail data intermediary to OCBC: an operator wrongly assumed three statements in one envelope belonged to one person and moved it out of the reject bin, bypassing QC, so two other OCBC customers' SRS statements (name, address, cash balance, asset holdings) went to one recipient; PDPC fine S$3,000 (DP-1606-B0061) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-datapost sgim:b99570e1b5172338 Tue, 03 May 2016 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 2. Furnituremart.sg : A signed invoice left in a printer feed tray was reused to print another customer's invoice, disclosing one customer's data (surname, home and delivery address, phone, email); no written policy, training or supervision; directions only (DP-1611-B0319) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-furnituremart sgim:4de6b4a5a9725906 Mon, 31 Oct 2016 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 1. Asia-Pacific Star : A Tigerair ground-handling employee ran out of paper printing a flight manifest and discarded the partial printout in a gate hold-room bin; it exposed passenger names and PNRs (which via 'Manage My Booking' could reach passport, address and partial card data); number affected undetermined; directions only (DP-1607-B0129) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-asia-pacific-star sgim:6e3474f62985229a Mon, 25 Jul 2016 16:00:00 +0000 data leak Confidence: medium (50). Potential records: not stated. National University of Singapore (NUS) : A Freshman Orientation Camp Google Sheet (fed by a Google Form) meant for student leaders had its sharing setting changed from 'specific people' to 'anyone with the link', exposing ~143 volunteers' data (names, mobile, matric numbers, DOB, dorm room numbers, emails); no formal data-protection training for student leaders; directions only (DP-1605-B0028) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-the-national-university-of-singapore sgim:7661f107669e49ec Sat, 30 Apr 2016 16:00:00 +0000 data leak Confidence: high (60). Potential records: 143. Tech Mahindra (Singapore) : Singtel's ONEPASS IT vendor / data intermediary: an employee left a required 'where' clause out of a database script (untested, with review steps skipped), modifying ~2.78 million ONEPASS profiles and copying one customer's NRIC/account/billing data into others; 2,518 users viewed that NRIC via the MySingtel app; Tech Mahindra fined S$10,000, Singtel not penalised (DP-1603-A652) — data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-tech-mahindra-singapore sgim:fd9e34dd75cc8f14 Thu, 25 Feb 2016 16:00:00 +0000 data leak / unauthorized access Confidence: high (65). Potential records: 2518. Executive Coach International : A director shared a former trainee's highly sensitive personal history (a past drug problem and relationship issues) in a WhatsApp group of at least 58 staff and trainees, without consent, following a dispute after her departure; the organisation was held responsible; consent/disclosure breach, warning (DP-1504-A426) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-consent-and-notification-obligations-by-executive-coach-international sgim:e9a8ef7ddfba524d Mon, 06 Apr 2015 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 1. PropNex Realty : The VO System applied user authentication only to web pages, not to document files, so a Do-Not-Call list PDF (1,765 individuals: name, mobile, address, email, internal notes) was reachable by direct link and search-engine indexing; the org relied on robots.txt, which does not restrict access; PDPC fine S$10,000 (DP-1512-A613) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-propnex-realty sgim:6342a668c18d000b Sun, 27 Dec 2015 16:00:00 +0000 data leak Confidence: high (60). Potential records: 1765. Global Interactive Works : Web/IT vendor and data intermediary to The Cellar Door that built the site and hosted its customer database; a subset was exfiltrated and posted on Pastebin (names, phones, addresses, emails, passwords); security gaps included no firewall, open ports, cleartext credentials and a six-character DB admin password; PDPC fine S$3,000 (DP-1409-A099) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-the-cellar-door-and-global-interactive-works sgim:cfd1f05c929c183a Sun, 31 Aug 2014 16:00:00 +0000 unauthorized access / data leak Confidence: high (60). Potential records: not stated. The Cellar Door : Principal / data controller whose customer database (names, phones, addresses, emails, passwords) was exfiltrated and posted on Pastebin through its web vendor Global Interactive Works' insecure server; held to have primary responsibility; PDPC fine S$5,000 (DP-1409-A099) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-the-cellar-door-and-global-interactive-works sgim:e8bbbb1cf7080ff6 Sun, 31 Aug 2014 16:00:00 +0000 unauthorized access / data leak Confidence: high (60). Potential records: not stated. JP Pepperdine Group : A membership webpage (live from a 2013 event to Oct 2015) had no access controls; an unpatched bug let blank searches return random member records and member numbers were sequential, and a brochure link pointed the public to it; ~30,000 members' data (name, NRIC/passport, DOB, race, address, contact) exposed; PDPC fine S$10,000 (DP-1510-A558) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-jp-pepperdine sgim:ff034b52ea44a0bd Sat, 24 Oct 2015 16:00:00 +0000 data leak Confidence: high (65). Potential records: 30000. Jump Rope (Singapore) : The society's President emailed about 30 government schools stating a former part-time instructor had been blacklisted and his certification revoked, disclosing two individuals' full names and NRIC numbers plus disciplinary details without consent; consent/disclosure breach, warning (DP-1411-A265) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-consent-and-notification-obligations-by-jump-rope-singapore sgim:d593628b40078a14 Thu, 27 Nov 2014 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 2. Smiling Orchid : The code protecting site content was repeatedly removed (root cause never ascertained; hypotheses were an admin-module hack or staff password sharing), recurrently exposing order details (full name, residential and workplace address, mobile, work email); the whole database was potentially at risk; weak password protection; PDPC fine S$3,000 (DP-1411-A250) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-smiling-orchid sgim:9e97dfb62ff017cc Sun, 23 Nov 2014 16:00:00 +0000 data leak Confidence: medium (50). Potential records: not stated. GMM Technoworld : A warranty-registration plug-in (added 2014) was misunderstood and misused, with its security settings left unconfigured, exposing ~190 individuals' data (names, emails, mobile numbers, residential addresses); PDPC fine S$3,000 (DP-1603-A656) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-gmm-technoworld sgim:8e15f0c17ede5a10 Wed, 02 Mar 2016 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 190. My Digital Lock : An employee posted screenshots disclosing a customer's mobile number and residential address on Facebook; the Commission treated it as a single employee's error of judgment, not wilful; consent/protection breach, warning (DP-1601-A628) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-my-digital-lock sgim:9a507946b463e788 Sun, 03 Jan 2016 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 1. ABR Holdings : A children's membership site used sequential membership/UIN numbers as both identifier and authentication with no password, so numbers could be simulated to reach other members' data (names, DOB, stamps, redemption status of children aged 4-12); warning (DP-1408-A030) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-data-protection-obligation-by-abr-holdings sgim:3bcb5d8345e549ad Mon, 14 Jul 2014 16:00:00 +0000 data leak Confidence: medium (50). Potential records: not stated. Pixart : IT vendor / data intermediary that built and hosted Fu Kwee's ordering system: order-preview URLs did not expire and used short sequential order IDs, so changing the number exposed other customers' orders (name, postal address, contact); no access controls or testing in scope; PDPC fine S$1,000 (DP-1410-A163) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-data-protection-and-other-obligations-by-fu-kwee-kitchen-catering-services-and-pixart sgim:083835bde1dfc517 Tue, 16 Sept 2014 16:00:00 +0000 data leak Confidence: medium (55). Potential records: not stated. Fu Kwee Kitchen Catering Services : Catering principal whose online-order customer data (name, postal address, contact) was exposed through its vendor Pixart's order-preview URL design flaw (non-expiring, sequential order IDs); no data-protection policies or DPO; PDPC fine S$3,000 (DP-1410-A163) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-data-protection-and-other-obligations-by-fu-kwee-kitchen-catering-services-and-pixart sgim:5ea60415aa2c6450 Tue, 16 Sept 2014 16:00:00 +0000 data leak Confidence: medium (55). Potential records: not stated. Toh-Shi Printing Singapore : Print/mail data intermediary to Aviva (POGIS group-insurance scheme): staff made an incomplete account-info selection and skipped verification samples, with QC comparing the wrong file, so 2015 annual premium statements were mismatched; 8,022 policyholders and dependants had data disclosed (dependant/beneficiary names, sum assured, premium, coverage - sensitive); Toh-Shi fined S$25,000, Aviva not in breach (DP-1603-A661) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-toh-shi-printing-singapore-sep sgim:87aaa82ea249fc22 Mon, 07 Mar 2016 16:00:00 +0000 data leak Confidence: high (65). Potential records: 8022. Toh-Shi Printing Singapore : Print/mail data intermediary to the Central Depository (CDP): page misalignment during sorting combined pages from different holders and a Fan Fold Operator mailed the erroneous statements; 195 CDP account holders affected (92 also had securities holdings and transaction/payment summaries disclosed); name, address, account number; manual single-person sorting found inadequate; Toh-Shi fined S$5,000, CDP not in breach (DP-1506-A456) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-toh-shi-printing-singapore-jul sgim:3198dafba6716105 Thu, 30 Apr 2015 16:00:00 +0000 data leak Confidence: high (60). Potential records: 195. Spear Security Force : Security guards repeatedly left a condominium visitor log book open and unattended near the guard post (visitor names, mobile numbers, entry time, unit visited, purpose), with no safeguards until after complaints; no evidence of actual exposure; warning (DP-1602-A642) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-spear-security-force sgim:063b344e54af44e1 Wed, 23 Dec 2015 16:00:00 +0000 data leak Confidence: medium (50). Potential records: not stated. Universal Travel Corporation : While helping four customers claim travel insurance for a cancelled flight, staff emailed them an unredacted passenger list for all 37 tour passengers (name, nationality, DOB, passport number/expiry, PNR) without consent; no data-protection policy; directions only (DP-1508-A496) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-consent-and-other-obligations-by-universal-travel-corporation sgim:fafc2fbcb730b67d Sat, 28 Feb 2015 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 37. Singapore Computer Society : An employee forwarded an event confirmation email with the (unprotected) registration list still attached, disclosing ~214 registrants' data (full names, NRIC, contact, email, organisation and designation); warning (DP-1504-A390) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-singapore-computer-society sgim:e24cfaa0de40a866 Sun, 15 Mar 2015 16:00:00 +0000 data leak Confidence: medium (55). Potential records: 214. Institution of Engineers Singapore : Two Pastebin posts exposed a member ID/password list (6,000+ users) and a list of 60,000+ phone numbers; cross-site scripting was suspected and a later scan found 48 high-severity vulnerabilities; passwords were stored unencrypted with no audits or testing; PDPC fine S$10,000 (DP-1411-A213) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-institution-of-engineers-singapore sgim:388f91ea04d6eaeb Mon, 29 Sept 2014 16:00:00 +0000 unauthorized access / data leak Confidence: high (65). Potential records: 60000. Xirlynx Innovations : Email-campaign vendor / data intermediary to Challenger: an Excel 'Remove Duplicates' step mismatched the name and email columns (and samples were not proof-read), so 165,306 ValueClub members' data (names, membership expiry, points) went to the wrong recipients; warning (DP-1409-A103) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-challenger-technologies-and-xirlynx-innovations sgim:61046f23a3151903 Sun, 31 Aug 2014 16:00:00 +0000 data leak Confidence: high (60). Potential records: 165306. Challenger Technologies : IT/electronics retailer whose 165,306 ValueClub members' data (names, membership expiry, points) was misdelivered through its email-campaign vendor Xirlynx's Excel error; Challenger remained responsible for failing to control the vendor's workflow; warning (DP-1409-A103) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-challenger-technologies-and-xirlynx-innovations sgim:e7ac827c27b0acaa Sun, 31 Aug 2014 16:00:00 +0000 data leak Confidence: high (60). Potential records: 165306. Metro : Metro's website was hacked in Feb 2014 and 445 customers' data (names, email, NRIC, mobile, DOB, Facebook IDs) was later found posted online; a SQL-injection vulnerability in the web applications was still present over a year later; warning (DP-1504-A421) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-metro sgim:0bc851d8e8861b20 Sat, 08 Feb 2014 16:00:00 +0000 unauthorized access / data leak Confidence: high (60). Potential records: 445. YesTuition Agency : Tutors' photographs were published on the public website with image files named after their NRIC numbers, so ~30 tutors' NRIC numbers and images were discoverable through a directory listing without consent; warning (DP-1407-A028) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-consent-obligation-by-yestuition-agency sgim:101de3bd75542945 Mon, 30 Jun 2014 16:00:00 +0000 data leak Confidence: medium (50). Potential records: 30. Full House Communications : Lucky-draw registration laptops at a Furniture Fair had browser auto-fill enabled, so the drop-downs displayed previous entrants' data (name, NRIC, contact, email) to later participants; warning (DP-1503-A368) — data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-full-house-communications sgim:25d57e2e636a68aa Sat, 28 Feb 2015 16:00:00 +0000 data leak Confidence: medium (50). Potential records: not stated. Fei Fah Medical Manufacturing : A hacker ('KAMI_HAXOR') posted Ripple Club member data online - 2,981 entries covering ~900 users (1,114 emails, 876 user IDs with MD5-hashed passwords, 836 phone numbers); the company acknowledged a program may have been seeded on its server; inadequate security; PDPC fine S$5,000 (DP-1409-A145) — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-protection-obligation-by-fei-fah-medical-manufacturing sgim:030a2fa5e3fb39ea Sun, 28 Sept 2014 16:00:00 +0000 unauthorized access / data leak Confidence: high (60). Potential records: 900. Ministry of Defence (I-net) : A targeted breach of MINDEF's I-net system (stand-alone terminals for personal internet access at MINDEF/SAF premises) stole the NRIC, telephone number and date of birth of about 850 national servicemen and employees; detected early 2017; classified military systems run on separate networks and were not affected — unauthorized access / data leak https://www.mindef.gov.sg/news-and-events/latest-releases/28feb17_nr/ sgim:a8f8c01e1fa47867 Mon, 27 Feb 2017 16:00:00 +0000 unauthorized access / data leak Confidence: high (85). Potential records: 850. Razer : A misconfigured Elasticsearch cluster left an estimated 100,000 customers' order and personal data (name, email, phone, order details and shipping address; no passwords or full card numbers) publicly accessible; discovered by a security researcher in Aug 2020 and secured after disclosure — data leak / misconfiguration https://www.channelnewsasia.com/singapore/data-leak-gaming-firm-razer-may-have-exposed-100000-gamers-personal-information-5667146 sgim:ce37c0e0a0281596 Thu, 10 Sept 2020 16:00:00 +0000 data leak / misconfiguration Confidence: high (75). Potential records: 100000. Shangri-La Hotel Singapore : A cyberattack on the guest database shared across eight Shangri-La hotels in Asia (discovered ~27 Jun 2022) exposed personal data of about 1,076,899 individuals tied to the Singapore property (name, contact details, email and some booking/ID information); PDPC accepted a remediation undertaking rather than issuing a fine — unauthorized access / data leak https://www.pdpc.gov.sg/undertakings/undertaking-by-shangrila-hotel-ltd sgim:1269254bd116f4a2 Sun, 26 Jun 2022 16:00:00 +0000 unauthorized access / data leak Confidence: high (90). Potential records: 1.076899e+06. Shook Lin & Bok : The Akira ransomware group compromised the law firm's systems (discovered ~9 Apr 2024); the firm reportedly paid a bitcoin ransom of about US$1.4M (S$1.89M); client and case data were at risk, though the exact number of records was not published — ransomware / data leak https://www.channelnewsasia.com/singapore/shook-lin-and-bok-akira-ransomware-paid-ransom-bitcoin-4308441 sgim:a8a871e0fcf3c652 Mon, 08 Apr 2024 16:00:00 +0000 ransomware / data leak Confidence: high (60). Potential records: not stated. Jumbo Group : The restaurant group disclosed a ransomware attack in a 23 May 2024 SGX filing; it activated its business-continuity plan and reported the matter to the Singapore Police Force, PDPC and CSA; preliminary investigations found no evidence of data exfiltration - recorded as a reported attack rather than a confirmed data exposure — ransomware https://links.sgx.com/1.0.0/corporate-announcements/F3C9LZ4R0J0F76FS sgim:57906b2660e4e2e2 Wed, 22 May 2024 16:00:00 +0000 ransomware Confidence: medium (45). Potential records: not stated. Mustafa Centre : An attacker on a hacker forum claimed (25 Apr 2024) to have stolen about 180GB of Mustafa customer and employee personal data; PDPC confirmed it is investigating and Mustafa engaged external cyber-security experts for a review of its IT systems; the precise number of records was not published — data leak / unauthorized access https://www.straitstimes.com/singapore/courts-crime/jumbo-group-mustafa-hit-by-cyber-attacks sgim:004687553429516c Wed, 22 May 2024 16:00:00 +0000 data leak / unauthorized access Confidence: medium (55). Potential records: not stated. HomeTeamNS : A ransomware attack discovered on 25 Feb 2025 hit servers of the ~260,000-member non-profit, affecting current and former employee data and the vehicle details of some members and affiliate members; the servers were isolated and HomeTeamNS reported no evidence of data extraction - recorded as a reported attack rather than a confirmed data exposure — ransomware https://hometeamns.sg/wp-content/uploads/2025/03/Media-Statement-HomeTeamNS-Respond-to-Cybersecurity-incident.pdf sgim:9567d18eafeb26c5 Sun, 02 Mar 2025 16:00:00 +0000 ransomware Confidence: medium (50). Potential records: not stated. X Star Financial Services : A ransomware threat actor brute-forced a bastion host that had been inadvertently exposed to the public internet by a misconfiguration during a configuration upgrade, moved laterally and exploited a known vulnerability in an internal service to exfiltrate data on 894 automobile-financing applicants (names, addresses, emails, phone, NRIC, DOB, gender, employment and financial details including financing amounts and hire-purchase data, and vehicle information); voluntary undertaking executed 14 Sep 2026 — ransomware / unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-x-star-financial-services-pte-ltd sgim:5cb51164b20c7a08 Sat, 08 Nov 2025 16:00:00 +0000 ransomware / unauthorized access / data leak Confidence: high (90). Potential records: 894. DCS Card Centre : A non-bank card issuer: a threat actor exfiltrated data from its Credit Card Management System by exploiting internal API endpoints that became publicly reachable after IP whitelisting was removed in Dec 2025 for a third-party solution; 22,076 individuals affected (names, address, email, passport/national ID numbers, mobile, DOB, nationality, some income data and some full credit-card numbers without CVV); no evidence of public exposure or misuse; voluntary undertaking — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-dcs-card-centre-pte-ltd sgim:b8363886e871dd11 Wed, 18 Feb 2026 16:00:00 +0000 unauthorized access / data leak Confidence: high (90). Potential records: 22076. Prosegur Singapore : A threat actor used compromised service-account credentials over VPN to reach file servers and exfiltrate a subset of data; 21,421 employees, former employees and contractors were affected (names, addresses, phone, NRIC/FIN/passport, countries of origin, photos, DOB, salary histories) with health/vaccination data among about 2,514 of them; root causes were no MFA on the service account and incomplete network segmentation; voluntary undertaking executed 28 Jul 2026 — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-prosegur-singapore-pte-ltd sgim:283ef1d766b2978c Sun, 22 Jun 2025 16:00:00 +0000 unauthorized access / data leak Confidence: high (90). Potential records: 21421. Grace Orchard School : A special-education school under Presbyterian Community Social Services: a threat actor exploited a known critical firmware vulnerability in the perimeter firewall, created admin accounts, moved laterally, harvested password hashes and accessed files on 1,011 people - current and former students (including minors; names and full NRIC) and staff (also addresses, emails, phone, photos, DOB, bank-account and insurance details, and health information such as discharge summaries); no evidence of exfiltration; unpatched firmware, no MFA and no DPO contributed; voluntary undertaking — unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-grace-orchard-school sgim:10a936635dc26ca2 Wed, 03 Sept 2025 16:00:00 +0000 unauthorized access Confidence: high (85). Potential records: 1011. Delugs : An e-commerce business: a threat actor used a shared administrator account's credentials to inject malicious JavaScript into the storefront theme, redirecting customers at checkout to a spoofed page that captured their data (a web-skimming / Magecart-style attack); 178 customers affected, with names, delivery addresses, emails, phone numbers and full credit-card details including CVV; credential sharing despite MFA was the key weakness; voluntary undertaking — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-delugs-pte-ltd sgim:d9114dc7842eab64 Wed, 03 Dec 2025 16:00:00 +0000 unauthorized access / data leak Confidence: high (85). Potential records: 178. Bud Studio : A design-and-build practice: a ransomware attack on its Network Attached Storage (NAS) server led to unauthorised access to and modification of files holding data on about 252 individuals (names, NRIC, phone, addresses, emails, plus signatures and NRIC copies of 2 people); no evidence of exfiltration or publication; the firm relied on its IT vendor and had no MFA, DPO or data-protection policies; voluntary undertaking — ransomware / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-bud-studio-pte-ltd sgim:6cf75176d37214e9 Sun, 26 Oct 2025 16:00:00 +0000 ransomware / unauthorized access Confidence: high (80). Potential records: 252. Ascentis : CRM platform provider: a threat actor accessed Ascentis's on-premises data-centre servers and encrypted data; the compromised servers held the databases of three other organisations that had contracted Ascentis for CRM services, so 9,886 of those organisations' customers were affected (name, email, mobile, DOB); no evidence of public exposure or misuse; no MFA on firewall-console accounts and weak firewall hardening contributed; voluntary undertaking (a separate, later incident from the 2022 Starbucks breach) — ransomware / unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-ascentis-pte-ltd sgim:fe9ab7593c6e11e2 Sat, 09 Aug 2025 16:00:00 +0000 ransomware / unauthorized access / data leak Confidence: high (85). Potential records: 9886. PSGourmet : A threat actor used compromised credentials for a dormant account over VPN to deploy ransomware and exfiltrate data on an estimated 3,122 current and former employees and non-corporate customers (names, addresses, emails, phone, DOB, NRIC and financial data including bank-account numbers and salary/CPF payments); no evidence the exfiltrated data was published; no MFA on the VPN; voluntary undertaking — ransomware / unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-psgourmet-pte-ltd sgim:4a5010ac40b3a976 Wed, 25 Jun 2025 16:00:00 +0000 ransomware / unauthorized access / data leak Confidence: high (85). Potential records: 3122. Olam Group : A threat actor connected to the VPN of an overseas entity using valid user-account credentials, moved laterally across the network and exfiltrated data on 42,351 individuals (largely former, current and prospective employees); data varied but included names, addresses, emails, phone, DOB, photos, national ID numbers, health, financial, insurance, demographic and professional/educational information; a delayed VPN-licence renewal in one jurisdiction contributed; voluntary undertaking — ransomware / unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-olam-group-limited sgim:0a58268548982646 Tue, 03 Dec 2024 16:00:00 +0000 ransomware / unauthorized access / data leak Confidence: high (85). Potential records: 42351. D'League : A threat actor accessed systems, exfiltrated data and then encrypted them; access was via a compromised dormant VPN account belonging to a staff member of the group's external IT consultant; the systems held data for D'League and its subsidiaries (Richard Mille Asia, Henry Jacques Asia, The Value of Time (Asia), Surrender, Three Pleasures, Inca Holdings, Le Mondo Ryori and Shinsetsu); 17,626 employees, former employees, non-employees and customers affected (names, NRIC, passport copies, nationalities, DOB, addresses, emails, contact, gender, transaction history, bank-account details and employees' hospitalisation documents and medical certificates); voluntary undertaking — ransomware / unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-dleague-pte-ltd-and-subsidiaries sgim:d65c9c731fd9463a Mon, 14 Jul 2025 16:00:00 +0000 ransomware / unauthorized access / data leak Confidence: high (85). Potential records: 17626. Meisei International : A threat actor gained access using compromised VPN credentials, exploited further vulnerabilities and encrypted files on a legacy HR Management System server holding data on 1,278 individuals (207 current and 1,071 former employees): names, ID-document copies, DOB, marital status, phone, email, addresses, employment records and financial data including bank-account numbers and salary records; weak passwords and no network segmentation contributed; voluntary undertaking — ransomware / unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-meisei-international-pte-ltd sgim:509ace423da3ac51 Sun, 07 Sept 2025 16:00:00 +0000 ransomware / unauthorized access / data leak Confidence: high (85). Potential records: 1278. Rotary Engineering : A ransomware threat actor gained unauthorised access to corporate systems, deployed ransomware and exfiltrated data on 2,209 current and former employees (names, addresses, DOB, signatures, image copies of passports, NRICs and birth certificates, resumes, pay slips and IR8A tax forms); the absence of MFA on VPN and critical accounts was a key weakness; voluntary undertaking — ransomware / unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-rotary-engineering-pte-ltd sgim:5afa0e46584c409b Mon, 02 Jun 2025 16:00:00 +0000 ransomware / unauthorized access / data leak Confidence: high (85). Potential records: 2209. Kingsmen Creatives : A ransomware threat actor used credentials from a compromised VPN account and further vulnerabilities to encrypt files holding data on 445 individuals (342 current and 103 former employees): names, NRIC numbers and copies, DOB, mobile numbers, emails, home addresses, bank-account details and next-of-kin details; voluntary undertaking — ransomware / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-kingsmen-creatives-ltd sgim:dc7ba964d722dd62 Fri, 25 Apr 2025 16:00:00 +0000 ransomware / unauthorized access Confidence: high (85). Potential records: 445. Algas Engineering : A ransomware attack encrypted a project manager's laptop (the only device encrypted) during an OS upgrade and, owing to several system inadequacies, the threat actor exfiltrated files on 500 individuals (70 current and 430 former employees): names, addresses, emails, phone, national ID copies, passport numbers, photos, DOB, bank-account numbers and next-of-kin contacts; voluntary undertaking — ransomware / unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-algas-engineering-pte-ltd sgim:fb5fb5774b1d67ee Mon, 14 Apr 2025 16:00:00 +0000 ransomware / unauthorized access / data leak Confidence: high (80). Potential records: 500. Meinhardt (Singapore) : A ransomware threat actor accessed servers, encrypted and exfiltrated data, and posted a sample on the dark web (names and designations of 73 employees); about 3,000 current and former employees were put at risk, with data including names, nationality, NRIC/FIN, PR-grant date, DOB, gender, marital status, race, religion, email, address, bank-account details, contact numbers, passport details, salary, education and emergency contacts; no MFA on remote VPN access contributed; voluntary undertaking — ransomware / unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-meinhardt-singapore-pte-ltd sgim:539a4622808d0ec7 Wed, 22 Oct 2025 16:00:00 +0000 ransomware / unauthorized access / data leak Confidence: high (85). Potential records: 3000. StepUp (Sup) : An unauthorised individual exfiltrated data from cloud databases and posted it on the organisation's Discord community channel; the database tables' Row Level Security was misconfigured so that anyone holding a public key could view all tables; about 607 individuals affected (names, emails and educational institutions); no DPO; voluntary undertaking — misconfiguration / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-stepup-sup-pte-ltd sgim:51eb7d034a098cc0 Fri, 06 Jun 2025 16:00:00 +0000 misconfiguration / data leak / unauthorized access Confidence: high (85). Potential records: 607. St Francis Methodist School (International) : An international school: a threat actor used a Server Message Block brute-force attack to compromise the main network-administrator account and another account, then encrypted and deleted files belonging only to past job applicants (no student data affected); about 761 applicants affected (name, mobile, email, education and work history, addresses, NRIC for 7, bank-account numbers for 46); no evidence of exfiltration; voluntary undertaking — ransomware / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-st-francis-methodist-school-international-ltd sgim:b8f035d0312249e6 Tue, 17 Dec 2024 16:00:00 +0000 ransomware / unauthorized access Confidence: high (85). Potential records: 761. Lian Beng Group : A ransomware attack by the RansomHub group, via brute force and other vulnerabilities, encrypted files across eleven Lian Beng Group subsidiaries (including Lian Beng Construction (1988), Deenn Engineering, Lian Beng Engineering & Machinery, United (CE), LB Property, Lian Beng Resources, L.S. Construction, Millennium International Builders, Sinmix, Tradewin Engineering and United Plus Steel Resources); 5,001 individuals affected (1,384 current and 3,617 former employees): names, bank-account numbers, addresses, emails, contact numbers, NRIC/FIN/passport numbers and letters of appointment; voluntary undertaking — ransomware / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-lian-beng-group-pte-ltd-and-subsidiaries sgim:fa08edcbad259436 Wed, 25 Dec 2024 16:00:00 +0000 ransomware / unauthorized access Confidence: high (85). Potential records: 5001. Bridgetek : A ransomware attack compromised servers across Singapore and overseas offices (all personal data was on the Singapore servers); the threat actor likely entered through a research-and-development device that imported development tools and reference software from external sources, and insufficient network segmentation allowed a system-wide compromise; about 300 individuals affected - 201 current and former employees (names, emails, contact, address, NRIC, bank-account, CV, passport and birth-certificate details) and fewer than 100 customers (basic contact info); voluntary undertaking — ransomware / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-bridgetek-pte-ltd sgim:7ea7e94771727063 Wed, 15 Jan 2025 16:00:00 +0000 ransomware / unauthorized access Confidence: high (80). Potential records: 300. Noel Gifts International : A threat actor gained unauthorised access to the web management consoles of Noel Gifts and its subsidiary by exploiting the login credentials of an authorised account, reached the Sales Report function and exfiltrated files on about 200,000 former and existing customers; only customers' personal email addresses (used to send order confirmations) were affected; voluntary undertaking — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-noel-gifts-international-ltd sgim:b0ab259f0a264136 Wed, 12 Feb 2025 16:00:00 +0000 unauthorized access / data leak Confidence: high (85). Potential records: 200000. Axxis Consulting (S) : A reseller and cloud host of SAP ERP systems: ransomware encrypted nine VMware ESXi servers, disrupting 74 corporate clients (including 54 Singapore companies) from reaching their hosted SAP systems; the threat actor entered via SSL-VPN on an End-of-Life firewall using a local admin account and deleted backups; client data on SAP was encrypted at rest and PDPC assessed the likelihood of the attacker accessing or exfiltrating personal data as low, with no dark-web exposure found; recorded as a reported attack rather than a confirmed exposure; voluntary undertaking — ransomware https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-axxis-consulting-s-pte-ltd sgim:9f6904d4fec21d56 Fri, 21 Jun 2024 16:00:00 +0000 ransomware Confidence: medium (45). Potential records: not stated. Megachem : A ransomware attack on Singapore servers encrypted file servers and exfiltrated data on 34 individuals who were the company's staff and service providers (names, phone numbers, emails and 2 scanned passport copies); incomplete MFA on remote VPN access contributed; voluntary undertaking executed 7 Nov 2025 — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-megachem-ltd sgim:9546e78bea4a96f2 Mon, 05 May 2025 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (70). Potential records: 34. Ardent IT : A system integrator and Infrastructure-as-a-Service provider: LockBit ransomware encrypted clients' virtual hard-disk files, rendering them inaccessible; the threat actor reached the hypervisor hosts through the Dell iDRAC using a compromised default root account (amid 91,939 password-spray and enumeration attempts) and deleted backups; recorded as a reported attack affecting client data availability; voluntary undertaking — ransomware https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-ardent-it-pte-ltd sgim:a3e786b292c97a03 Sat, 03 Aug 2024 16:00:00 +0000 ransomware Confidence: medium (45). Potential records: not stated. Aerospec Supplies & Jobsite.com : A manpower-supply company and its wholly-owned subsidiary Jobsite.com (shared server infrastructure): a ransomware attack, via a firewall firmware vulnerability left unpatched for about three years or remote-access software, exfiltrated and deleted the personal data of 3,885 Aerospec employees, ex-employees and job candidates (names, addresses, emails, NRIC/FIN, passport, employment history, DOB, bank-account and salary data) and 200 individuals held by Jobsite on behalf of 10 client companies for work-pass applications (names, passport, citizenship, occupation, DOB, salary, education); voluntary undertaking — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-aerospec-supplies-pte-ltd-jobsitecom-pte-ltd sgim:05b7d89bc3b8b858 Wed, 05 Feb 2025 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (85). Potential records: 4085. Kleen-Pak Products : A ransomware attack on company servers encrypted and exfiltrated data on about 330 current and former employees; the files were later published on the dark web (names, NRIC/FIN, DOB, mobile, email, addresses, dated salary details and bank-account numbers); over-retained data in a legacy storage location, a weak password policy and poor firewall/patch documentation contributed; voluntary undertaking — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-kleen-pak-products-pte-ltd sgim:80ceab62bb24d7db Wed, 05 Mar 2025 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (85). Potential records: 330. TJ Assurance Partners : A staff member fell for a phishing attack, letting a threat actor into a corporate mailbox for about an hour; the actor read emails and sent further phishing to address-book contacts; no file downloads were detected, but personal data in email attachments for 71 clients was exposed (full name, address, NRIC, passport, nationality and financial information); voluntary undertaking — unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-tj-assurance-partners-pac sgim:b32939c50d88ba0e Tue, 11 Mar 2025 16:00:00 +0000 unauthorized access Confidence: high (80). Potential records: 71. Nippon Paint (Singapore) : A threat actor exploited vulnerabilities in plug-ins used by the e-commerce platform to exfiltrate personal data; a plug-in had generated and hosted a file on the server matching datasets later found on the dark web; 13,695 individuals affected (names, contact numbers, addresses and emails); voluntary undertaking — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-nippon-paint-singapore-co-pte-ltd sgim:772d1b4f0312afef Sun, 28 Apr 2024 16:00:00 +0000 unauthorized access / data leak Confidence: high (85). Potential records: 13695. The Oddle Company : An F&B online-ordering platform: a threat actor used a compromised internal employee account to plant malicious code on certain merchants' checkout pages; on mobile browsers a third-party script hid the real payment form and overlaid fake input fields (a web-skimming attack), capturing 7,358 individuals' data across Singapore, Taiwan, Malaysia and Hong Kong (full name, email, contact number and full credit-card information); voluntary undertaking — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-the-oddle-company-pte-ltd sgim:faae527546d70eb0 Sun, 24 Mar 2024 16:00:00 +0000 unauthorized access / data leak Confidence: high (85). Potential records: 7358. Singapore Teachers' Co-operative Society : A threat actor exploited website vulnerabilities to perform SQL-injection attacks and exfiltrate the data of about 3,253 members (name, NRIC, address, email, phone, nationality, race, gender, marital status, DOB, age, academic qualification, designation, employment status, join date and membership type), then used it to send phishing emails to at least 153 members; voluntary undertaking — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-singapore-teachers-co-operative-society-limited sgim:56da73a28c38170e Sun, 10 Nov 2024 16:00:00 +0000 unauthorized access / data leak Confidence: high (85). Potential records: 3253. Canvas (Instructure) : The Canvas learning platform (owned by US edtech firm Instructure), used by Singapore schools, colleges and universities: Instructure detected unauthorised activity from 29 Apr 2026 and further activity on 7 May, in which the actor altered pages shown to some logged-in students and teachers; Canvas was taken offline to contain it and CSA reached out to affected Singapore organisations; no confirmed figure for exfiltrated personal data; recorded as a platform compromise reaching local institutions — unauthorized access / other https://www.channelnewsasia.com/singapore/canvas-cyberattack-data-breach-leak-sim-cybersecurity-csa-6110151 sgim:a457e8f04aa796dc Tue, 28 Apr 2026 16:00:00 +0000 unauthorized access / other Confidence: medium (50). Potential records: not stated. Singapore Institute of Management : SIM confirmed it was affected by the cyberattack on the Canvas / Instructure learning platform, disrupting access for its students and faculty; SIM put temporary arrangements in place (direct Zoom links, extended deadlines); the incident occurred within Instructure's environment rather than SIM's own systems — unauthorized access https://www.channelnewsasia.com/singapore/canvas-cyberattack-data-breach-leak-sim-cybersecurity-csa-6110151 sgim:507a9a8be3d145a8 Thu, 07 May 2026 16:00:00 +0000 unauthorized access Confidence: medium (45). Potential records: not stated. Ready Digital : A threat actor exploited an open port on a development server that had been misconfigured by Ready Digital's outsourced developer, PT Ekasa Teknologi Nusantara in Indonesia (remote access was allowed from any IP), and the backup database itself had no login credentials; the actor deleted data on 155 individuals - 58 senior customers (name, last four NRIC characters, contact, address, next-of-kin), 89 next-of-kin and caregivers, and 8 employees; voluntary undertaking — unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-ready-digital-pte-ltd sgim:ad729f8c40b12423 Wed, 16 Oct 2024 16:00:00 +0000 unauthorized access Confidence: high (80). Potential records: 155. Widex Singapore : A ransomware attack on a server owned and operated by sister company Active Hearing Pty Ltd (AHPL) in Australia - which provides retail systems to WS Audiology businesses including Widex Singapore - exfiltrated the data of 10,281 Widex Singapore customers (names, contact numbers, emails, addresses, DOB, health-card numbers that may include NRIC numbers, and brief hearing-loss notes); voluntary undertaking — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-widex-singapore-pte-ltd sgim:330bd364a5a1286e Sun, 14 Jul 2024 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (85). Potential records: 10281. Yamato Transport (Singapore) : The logistics firm, acting as a data intermediary for its clients, was breached when a threat actor exploited a zero-day vulnerability for initial access, exploited further vulnerabilities and executed ransomware; the exfiltrated files held the personal data of 320,482 individuals - the clients' customers and Yamato's own employees (name, address, email, phone and other information); voluntary undertaking — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-yamato-transport-pte-ltd sgim:2baaceefd9fdd5fb Thu, 05 Sept 2024 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (85). Potential records: 320482. Poh Heng Jewellery : A threat actor probing the e-commerce site for exposed /git resources found a configuration folder and deployment file that led to the GitHub repository of the website vendor A&C Atelier, obtained the site's source code containing hardcoded API keys and integration credentials, and used them to reach an integrated HubSpot middleware application and download 81,465 customers' data (name, contact number, address, email, DOB, country of residence, membership ID and last five purchase transactions); voluntary undertaking — unauthorized access / data leak https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-poh-heng-jewellery-pte-ltd sgim:8f06464f766f2e75 Thu, 28 Mar 2024 16:00:00 +0000 unauthorized access / data leak Confidence: high (85). Potential records: 81465. C. Melchers (Singapore) : A ransomware attack in which a threat actor used a compromised domain-administrator account to move laterally and exfiltrate files; 10,417 employees and customers were potentially affected - mostly names, addresses, phone numbers or emails, with NRIC and/or passport numbers for a select few; voluntary undertaking — ransomware / data leak / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-c-melchers-gmbh-co-kg-singapore-branch sgim:3792bbcbdf0b3a5d Tue, 30 Jul 2024 16:00:00 +0000 ransomware / data leak / unauthorized access Confidence: high (85). Potential records: 10417. Bukit Sembawang Estates : A 'Fog'-variant ransomware attack, first reported by Singapore United Estates, encrypted and deleted data across a group of related real-estate companies (Bukit Sembawang Estates, Sembawang Estates, Bukit Sembawang View, Paterson Collection, BSEL Development and Bukit Sembawang Land); the attacker used a compromised user account and an administrative account to port-scan and move laterally, encrypting files holding the data of 1,327 individuals (name, NRIC, contact, passport, DOB and bank-account numbers); voluntary undertaking — ransomware / unauthorized access https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-bukit-sembawang-estates-limited-ors sgim:1e7842837b23b97d Sun, 11 Aug 2024 16:00:00 +0000 ransomware / unauthorized access Confidence: high (85). Potential records: 1327.