Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

VirusTotal Ordered to Reveal Private Info of Stolen HSE Data Downloaders

VirusTotal Ordered to Reveal Private Info of Stolen HSE Data Downloaders

An Irish court has ordered VirusTotal to provide the information of subscribers who downloaded or uploaded confidential data stolen from Ireland’s national health care service during a ransomware attack.

In May, Ireland’s HSE, the country’s publicly funded healthcare system, was the target of a Conti ransomware attack that caused massive disruption of IT systems after devices were encrypted.

As part of this attack, Conti claimed to have stolen 700GB of data that allegedly included patient and employee info, contracts, financial statements, payroll, and more.

To prove the data theft, the Conti gang posted a link to a file in their ransomware negotiation chat that they said contained samples of the stolen data.

Stolen HSE data uploaded to VirusTotal

According to, this sample of stolen data consisted of 27 stolen HSE files containing patient data, which was subsequently uploaded to the VirusTotal malware scanning site.

“The 27 files include personal records of 12 individuals. One file reviewed by the FT includes admission records and laboratory results for a man who was admitted to hospital for palliative care,” reported

“The broad details in that file matched a subsequent death notice seen by the FT.”

Also Read: 4 Best Practices on How to Use SkillsFuture Credit

In addition to scanning files, VirusTotal acts as a repository of uploaded files allowing subscribers to search for and download files to analyze for their own security research or improve their security software.

However, once a file is uploaded to VirusTotal, it would allow any other subscriber to download and view the confidential data.

After the Irish courts issued an injunction requiring anyone who possessed the stolen data to return it to HSE, FT returned the data but refused to share the source who provided them the samples.

On Tuesday, the High Court of Ireland has issued an order requiring Chronicle Security Ireland and Chronicle LLC, the owners of VirusTotal, to hand over the private information of subscribers who downloaded or uploaded the HSE data.

The private information includes email addresses, phone numbers, IP addresses, or physical addresses.

Also Read: 3 Reasons Why You Must Take a PDPA Singapore Course

According to TheJournal, the file containing the stolen data was downloaded 23 times from VirusTotal before the service removed it on May 25th.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us