SPH Media confirms data breach affecting 9% of its database

SPH Media has identified cyberattacks targeting five of its systems, with the incidents believed to be part of a coordinated effort carried out by the same threat actor.

According to the media company, the attacks affected two groups of systems, including those containing personal data and others that did not store such information.

In the first group, the exposed information primarily comprised email addresses, alongside some names, mailing addresses and phone numbers. The affected records accounted for 9% of SPH Media's database. However, the company clarified that no payment card details, financial or banking information, or customer account access had been compromised.

Don't miss: Fore Coffee reports data breach affecting 5.7 million customer accounts

The second group of attacks involved unauthorised access to systems that did not contain any personal data. Upon discovering the incidents, SPH Media said it immediately took steps to secure the affected systems and engaged external cybersecurity experts to investigate and contain the breaches.

The company also reported the incidents to the Personal Data Protection Commission (PDPC), Cyber Security Agency of Singapore (CSA) and Infocomm Media Development Authority (IMDA), while filing a police report.

In a joint statement, IMDA and PDPC confirmed that they were aware of the incident and had launched investigations. The authorities have also instructed SPH Media to contain the impact of the breaches and identify their root cause. Meanwhile, CSA said it was monitoring developments closely.

The authorities also urged organisations to strengthen measures to protect their systems against data breaches, while advising members of the public to remain vigilant against potential phishing attempts and scams.

All affected parties have since been notified and advised on precautionary measures, with an advisory also published on SPH Media's website.

"SPH Media takes the security and confidentiality of customers' information very seriously, and has been working very closely with the relevant authorities and third party specialists," the company said in a statement.

It also urged customers to remain vigilant against suspicious emails, messages and calls, particularly those requesting personal information, passwords or payments, and to avoid clicking on suspicious links or attachments.

"We remain committed to safeguarding the information entrusted to us," SPH Media added.

The incident follows a series of data breaches affecting companies in Singapore in recent months. Earlier this month, Singapore-based personal finance comparison platform MoneySmart confirmed a data security incident affecting customers in Singapore and Hong Kong, after an unauthorised third party accessed its internal IT systems.

Discovered on 29 October, the incident saw personal data belonging to some customers copied, although MoneySmart did not disclose the number of individuals affected or the types of information compromised. The company said it was contacting affected customers directly.

Meanwhile, telco SIMBA confirmed a data breach affecting 23,549 customers in September, exposing personal information including names, identity card numbers, dates of birth, mobile numbers and email addresses. The breach was discovered on 24 September and subsequently resolved, according to the company. SIMBA said no credit card or banking information was compromised, with investigations finding no indication that the exposed data had been maliciously misused.

Related articles: 
Marina Bay Sands fined for data breach affecting over 665,000 patrons  
Shun Hing Group data breach impacts over 920,000 customers     
Nike investigates alleged data breach following leak claims