MBS reported data leak in line with PDPC requirements: Josephine Teo

SINGAPORE: Minister of Communications and Information and Second Minister of Home Affairs Josephine Teo said Marina Bay Sands (MBS) complied with Personal Data Protection Commission (PDPC) procedures when it notified the authority five days after a major data breach compromised the personal details of members, last month.

In an email to members this week, the luxury integrated resort said the breach occurred on Oct 19th and 20th when unauthorized access was made to the non-casino rewards program “Sands Rewards Lifestyle.”

The breach is believed to have compromised the sensitive member information of 660,000 members, including their names, email addresses, mobile phone numbers, country of residence, and membership number and level.

MBS told members that its internal investigation has so far yielded no evidence of data misuse by the unauthorized third parties responsible for the breach.

MBS added that it has taken immediate action in response to the breach and has been collaborating with cybersecurity companies to enhance its system and data security measures to prevent future breaches of this nature.

MBS apologised to the affected members and advised all its members to remain vigilant and monitor their accounts for any unusual or suspicious activities. They have also urged members to regularly change their login passwords as an additional precaution.

Members of Parliament noted the number of days between the discovery of the data breach and MBS’ disclosure and asked why the resort did not report the incident to authorities as soon as possible.

Ms Teo clarified in Parliament that once an enterprise or institution discovers a data leak, it must first take four major steps to confirm the situation, including immediately controlling the data leak, assessing the scale of the leak, assessing whether the incident needs to be reported to the authorities, and assessing whether controls are in place.

As the top priority is to control and assess the situation, Ms Teo said the PDPC will give the organization some time to take these four steps before reporting to it.

The minister also said that the commissioner is investigating the incident and will announce the results of the investigation in due course.