Frame-14

Privacy Ninja

        • DATA PROTECTION

        • Email Spoofing Prevention
        • Check if your organization email is vulnerable to hackers and put a stop to it. Receive your free test today!
        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • AntiHACK Phone
        • Boost your smartphone’s security with enterprise-level encryption, designed by digital forensics and counterintelligence experts, guaranteeing absolute privacy for you and up to 31 others, plus a guest user, through exclusive access.

        • CYBERSECURITY

        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$3,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Secure your digital frontiers with our API penetration testing service, meticulously designed to identify and fortify vulnerabilities, ensuring robust protection against cyber threats.

        • Network Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Mobile Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Web Penetration Testing
        • Fortify your web presence with our specialized web penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats.

        • RAPID DIGITALISATION

        • OTHERS

Nearly 130,000 Singtel Customers’ Personal Information, Including NRIC Details, Stolen In Data Breach

Nearly 130,000 Singtel Customers’ Personal Information, Including NRIC Details, Stolen In Data Breach

SINGAPORE: Personal information of nearly 130,000 Singtel customers was stolen after a recent data breach of a third-party file-sharing system, the local telco said on Wednesday (Feb 17).

Singtel has completed initial investigations into the breach and established which files on the Accellion file transfer appliance were accessed illegally, the company said in a news release.

The personal information taken includes about 129,000 customers’ NRIC numbers and a combination of names, dates of birth, mobile numbers and addresses, said Singtel.

In addition, bank account details of 28 former Singtel employees and credit card details of 45 staff members of a corporate customer with Singtel mobile lines were taken.

“Some information” from 23 enterprises, including suppliers, partners and corporate customers, was also stolen.

Also Read: How To Check Data Breach And How Can We Prevent It

singtel data breach information nric number
(Table: Singtel)

The telco has started notifying all affected individuals and enterprises to help them and their staff manage the possible risks involved and take appropriate follow-up action, it said.

Singtel’s Group CEO Yuen Kuan Moon said: “While this data theft was committed by unknown parties, I’m very sorry this has happened to our customers and apologise unreservedly to everyone impacted. 

“Data privacy is paramount, we have disappointed our stakeholders and not met the standards we have set for ourselves.

“Given the complexity and sensitivity of our investigations, we are being as transparent as possible and providing information that is accurate to the best of our knowledge. We are doing our level best to keep our customers supported in mitigating the potential risks.”

Singtel said a “large part” of the leaked data includes its “internal information that is non-sensitive”, such as data logs, test data, reports and emails.

In response to queries from CNA, the Personal Data Protection Commission said it is aware of the data breach and is investigating.

“Sophisticated” cyberattack on Accellion

Accellion, which Singtel used as a third-party file-sharing system, was the target of a “sophisticated” cyberattack exploiting a “previously unknown vulnerability”, said the telco.

When it was first alerted to exploits against the system in December last year, Singtel “promptly applied” a series of patches provided by Accellion to “plug the vulnerability”, it said. The last patch was on Dec 27 last year.

On Jan 23, Accellion advised that a new vulnerability had emerged that rendered the earlier patches previously applied in December ineffective.

Singtel immediately took the system offline, and the FTA system has been kept offline since Jan 23, said the company.

“On Jan 30, Singtel’s attempt to patch the new vulnerability in the FTA system triggered an anomaly alert. Accellion informed thereafter that the system could have been breached,” said Singtel.

The telco’s investigations later confirmed the breach and identified Jan 20 as the date it had occurred.

“On Feb 9, Singtel established that files were taken as a result of the breach and informed the public two days later on Feb 11,” said the company.

Identity monitoring services for affected customers

On Wednesday, Singtel said it is appointing a global data and information service provider to provide identity monitoring services at no cost to affected customers to help them “manage potential risks”.

This service monitors public websites and “non-public places” on the Internet, and notifies users of any unusual activity related to their personal information, the telco explained.

Affected individual customers will be notified via email or post about what personal details were accessed and how they can best manage the risks involved, Singtel said in an FAQ on its website.

“We are working with the utmost urgency to ascertain the nature and extent of data that has been potentially accessed. We will reach out to individuals and organisations whose information may have been illegally downloaded,” it added in the FAQ.

Singtel’s core operations and functions remain “unaffected and sound” as the incident involves a standalone system provided by a third-party vendor, said Mr Yuen. 

He thanked customers and partners for their “patience and understanding” as it continued its cyber and criminal investigations to “understand the full extent of this breach”.

Also Read: Top 8 Main PDPA Obligations To Boost And Secure Your Business

“Information security remains our highest priority and you have my commitment that we are conducting a thorough review of our systems and processes to strengthen them,” he added.

0 Comments

KEEP IN TOUCH

Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection

REPORTING DATA BREACH TO PDPC?

We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.
×

Hello!

Click one of our contacts below to chat on WhatsApp

× Chat with us