No clear link between recent data breaches; incidents appear to be result of 'opportunistic attacks': PDPC
The Personal Data Protection Commission advised organisations to regularly check and patch vulnerabilities, protect access and credentials, and encrypt or store sensitive data offline.
This audio is generated by an AI tool.
SINGAPORE: Recent data breaches involving several organisations appear to have been the result of opportunistic attacks, with no clear connection between them, the Personal Data Protection Commission (PDPC) said on Friday (Nov 13).
Preliminary indications were that the “significant data breaches” reported in the past week resulted from opportunistic attacks exploiting common vulnerabilities in IT systems, the commission said.
It added that there was no clear connection between incidents, and some were related to global data breaches.
On Friday, the Cyber Security Agency of Singapore (CSA) also said that the recent cyber incidents did not appear to be part of coordinated campaigns targeting Singapore.
Instead, they reflected "a broader global trend of opportunistic attacks".
In recent weeks, cyberattacks have hit multiple organisations in the healthcare sector, including Minmed, Doctor Anywhere, Fullerton Health and the Agency for Integrated Care.
Data breaches have also been reported by M1, Singapore Airlines and SPH Media, involving the exposure or potential exposure of personal information.
Connected systems support business efficiency and innovation, but their interconnectedness also carries risks, PDPC said.
These include third-party supply chain risks and the exploitation of application programming interfaces (APIs).
“When threat actors find a vulnerability at any part of these connected systems, they find it easier to move laterally through the different systems,” PDPC said.
“They may also find it easier to gain remote access to the systems, as well as impact other third parties in the organisation’s supply chain.”
PDPC advised organisations to regularly check for vulnerabilities, have plans to patch them, protect access and credentials, and use industry-standard encryption for sensitive data or store it offline.
Organisations should also collect and retain only necessary data and put measures in place to prevent data loss or theft.
Under the Personal Data Protection Act (PDPA), organisations must report data breaches to the PDPC and notify affected individuals if a breach is likely to result in significant harm and/or is of significant scale.
“Encouragingly, PDPC has seen more organisations affected by data breaches voluntarily notifying customers. This brings greater visibility to data breaches and allows consumers to take steps to protect themselves,” the commission said.
PDPC advised consumers to share only necessary personal information and use secondary email accounts for non-essential services.
They should also remain vigilant against phishing scams, particularly after being notified that their personal data has been affected by a data breach.
