The necessity of keeping your server updated: OrangeTee & Tie

The necessity of keeping your server updated: OrangeTee & Tie

In the contemporary digital world, it is of utmost importance to regularly update your servers to ensure the safety and integrity of your systems. Overlooking server updates can render them as defenseless as if they were left completely unprotected.

Updating servers is crucial for mitigating security risks, resolving software issues, and enhancing the overall performance of the server. Frequent updates aid in safeguarding your servers from potential threats like unauthorized access, data breaches, and malware attacks.

Ignoring updates might jeopardize your organization’s confidential information and vital systems. In the case of OrangeTee & Tie, the consequences of neglecting server updates became apparent when their systems were compromised, causing the Organisation to pay a whopping S$37,000 financial penalty. 

April 17: Breach of Protection Obligation of OrangeTee & Tie

On August 4, 2021, the PDPC contacted OrangeTee & Tie after receiving information that a threat actor had managed to exfiltrate databases in the Organisation’s possession. These exfiltrated databases are believed to contain personal data. 

OrangeTee & Ties is a real estate enterprise based in Singapore and has been in operation since 2000. It maintains 4 servers, namely: the Production Web Server, the Production Database Server, the Development Web Server, and the Development Database Server. 

The Production Web Server and the Development Web Server were internet-facing in that they were directly accessible from the internet. The personal data of employees and customers of the OrangeTee & Ties were stored on the Production Database Server and the Development Database Server. But these personal data had not been encrypted, and these databases ran on software that was not updated. 

Investigations reveal that the Organisation received a ransom demand email from an organisation which identified themselves as ‘ALTDOS’. The threat actor claimed that they had been hacking the Organisation’s network since June 2021 and had stolen “hundreds of databases” containing sensitive information. 

In the same email, the threat actor demanded a ransom of 10 Bitcoins for the safety and non-disclosure of the exfiltrated databases. Having not received the demanded ransom, ALTDOS carried out a Distributed Denial-of-Service attack which brought down the Organisation’s network.

OrangeTee & Tie engaged a private forensic expert to ascertain the cause and extent of the Incident. It was found that the threat actor had carried out certain web-based attacks and exploited vulnerabilities on the Web Servers to successfully exfiltrate databases from the outdated Database Servers. With this, OrangeTee & Tie breached the Protection Obligation of the PDPA.

For breaching the Protection Obligation under the PDPA, OrangeTee & Tie was made to pay a whopping financial penalty of S$37,000.

What can we get from this case?

An outdated server is as if they were left completely unprotected. Without updating your server, it will not have the essential security updates which could block the sophisticated and up-to-date methods that bad actors use. 

How a DPO can help prevent this from happening

Your appointed DPO can work with you on your PDPA compliance, ensuring that there will be policies in place to make sure that the handling of personal data is PDPA compliant. This includes promptly responding to the PDPC with their queries to expedite the investigations and prevent a harsher penalty from the Commission. 

A Data Protection Officer (DPO) oversees data protection responsibilities and ensures that organisations comply with the Personal Data Protection Act (PDPA). Furthermore, every Organization’s DPO should be able to curb any instances of PDPA noncompliance as it is the officer responsible for maintaining the positive posture of an organisation’s cybersecurity.

DPOs complement organisations’ efforts to ensure that the organisation’s methods of collecting personal data comply with the PDPA. It also ensures that policies are set in place to make sure that there will be no instances of data breaches in the future.

Don’t wait any longer to ensure your organisation is PDPA compliant. Take our free 

3-minute PDPA Compliance Self-audit checklist now, the same “secret weapon” used by our clients to keep them on track. Upon completion, we will send you the results so you can take the necessary action to protect your customers’ data. Complete the free assessment checklist today and take the first step towards protecting your customers’ personal data.