SPH Media targeted by cyberattacks in SG, compromising 9% customer personal data
SPH Media targeted by cyberattacks exposing some customer data
SINGAPORE: SPH Media has suffered cyberattacks on five systems, exposing some customers’ personal information, although financial details and account access were left untouched.
The attacks affected two groups of systems. One contained personal information, while the other held no personal data. The compromised information included names, email addresses, mailing addresses and phone numbers. These details accounted for 9% of SPH Media’s database.
The company believes the attacks were carried out by the same threat actor as part of a coordinated effort. However, SPH Media hasn't confirmed whether artificial intelligence (AI) was used. Investigations are still underway, Channel NewsAsia (CNA) reported (Nov 10).
Government agencies investigate the breaches
SPH Media detected the first incident on Nov 4 and the latest on Nov 8.
After discovering the attacks, the company secured the affected systems and brought in external cybersecurity experts to investigate and contain the breaches.
The media company also reported the incidents to the Personal Data Protection Commission (PDPC), Cyber Security Agency of Singapore (CSA), Infocomm Media Development Authority (IMDA), and police.
SPH Media said it had informed affected customers and advised them on precautions to take. In a joint response to CNA, IMDA, PDPC, and CSA confirmed they were aware of the incidents.
IMDA and PDPC are investigating, while CSA is monitoring developments. The agencies have asked SPH Media to contain the impact and identify the cause.
Recent data breaches raise concerns for customers
The attacks come amid several other reported data breaches involving organisations serving Singapore customers. M1 and telehealth provider Doctor Anywhere also reported breaches on Nov 6.
M1's incident exposed customer details, including NRIC or FIN numbers, birth dates, contact numbers and residential addresses.
Doctor Anywhere reported a leak of users’ personal information. However, cybersecurity firm Ensign InfoSecurity said clinical records weren't affected.
Separately, around 46,000 Singapore Airlines booking records were accessed through a breach involving software provider Amadeus, which affected at least eight airlines.
While financial details and account access were spared in SPH Media's case, exposed contact information can still put customers at risk of phishing attempts and scams.
Newsletter
Get updates straight to your inbox
The next step is to stay alert, question unexpected messages and avoid clicking suspicious links. Organisations, meanwhile, must treat customer data protection as a basic responsibility, not an afterthought.
The incident also brings attention to other data breaches involving Singapore organisations. Earlier this year, personal data belonging to about 70,000 people was exposed after attackers gained unauthorised access to a cloud environment managed by IBM for the Singapore Land Authority (SLA).
Read related: Singapore Land Authority: 70,000 people's personal data exposed in IBM-managed cloud environment security breach