Data Protection & Privacy

[Admin]

620 million accounts stolen from 16 hacked websites now for sale on dark web, seller boasts
Dubsmash, Armor Games, 500px, Whitepages, ShareThis, and more said to be up for grabs for $$$s in BTC
Chris Williams | 11 Feb 2019

Exclusive Some 617 million online account details stolen from 16 hacked websites are on sale from today on the dark web, according to the data trove's seller.

For less than $20,000 in Bitcoin, it is claimed, the following pilfered account databases can be purchased from the Dream Market cyber-souk, located in the Tor network:

Dubsmash (162 million), MyFitnessPal (151 million), MyHeritage (92 million), ShareThis (41 million), HauteLook (28 million), Animoto (25 million), EyeEm (22 million), 8fit (20 million), Whitepages (18 million), Fotolog (16 million), 500px (15 million), Armor Games (11 million), BookMate (8 million), CoffeeMeetsBagel (6 million), Artsy (1 million), and DataCamp (700,000).

Sample account records from the multi-gigabyte databases seen by The Register appear to be legit: they consist mainly of account holder names, email addresses, and passwords. These passwords are hashed, or one-way encrypted, and must therefore be cracked before they can be used.

There are a few other bits of information, depending on the site, such as location, personal details, and social media authentication tokens. There appears to be no payment or bank card details in the sales listings.

Who are the buyers?

These silos of purportedly purloined information are aimed at spammers and credential stuffers, which is why copies are relatively cheap to buy. The stuffers will take usernames and passwords leaked from one site to log into accounts on other websites where the users have used the same credentials.

So, for example, someone buying the purported 500px database could decode the weaker passwords in the list, because some were hashed using the obsolete MD5 algorithm, and then try to use the email address and cracked password combinations to log into, say, strangers' Gmail or Facebook accounts, where the email address and passwords have been reused.

All of the databases are right now being touted separately by one hacker, who says he or she typically exploited security vulnerabilities within web apps to gain remote-code execution and then extract user account data. The records were swiped mostly during 2018, we're told, and went on sale this week.

The seller, who is believed to be located outside of the US, told us the Dubsmash data has been purchased by at least one person.

Some of the websites – particularly MyHeritage, MyFitnessPal, and Animoto – were known to have been hacked as they warned their customers last year that they had been compromised, whereas the others are seemingly newly disclosed security breaches. In other words, this is the first time we've heard these other sites have been allegedly hacked. This also marks the first time this data, for all of the listed sites, has been peddled publicly, again if all the sellers' claims are true.

Is this legit?

A spokesperson for MyHeritage confirmed samples from its now-for-sale database are real, and were taken from its servers in October 2017, a cyber-break-in it told the world about in 2018. CoffeeMeetsBagel, 8fit, 500px, DataCamp, and EyeEm also confirmed their account data was stolen from their servers and put up for sale this week in the seller's collection. This lends further credibility to the data trove.

Last week, half a dozen of the aforementioned sites were listed on Dream Market by the seller: when we spotted them, we alerted Dubsmash, Animoto, EyeEm, 8fit, Fotolog, and 500px that their account data was potentially being touted on the dark web.

Over the weekend, the underground bazaar was mostly knocked offline, apparently by a distributed denial-of-service attack. On Monday this week, the underworld marketplace returned to full strength, and the seller added the rest of the sites. We contacted all of them to alert them, and ask for a response. Meanwhile, Dream Market has been smashed offline again.

Here's a summary of what is, or briefly was, purported to be on sale:

    Dubsmash: 161,549,210 accounts for 0.549 BTC ($1,976) total

    11GB of data taken in December 2018. Each account record contains the user ID, SHA256-hashed password, username, email address, language, country, plus for some, but not all the users, the first and the last name. This alleged security breach has not been previously publicly disclosed. Dubsmash is a video-messaging application popular with millennials and younger folk.

    New York City-based Dubsmash has hired law firm Lewis Brisbois to probe the online sale. Partner Simone McCormick told us:

    Our office has been retained to assist Dubsmash in this matter. Thank you for your alert. We immediately launched an investigation. We plan to notify any and all individuals as appropriate. Again, thank you for bringing this to our attention.

    500px: 14,870,304 accounts for 0.217 BTC ($780) total
    1.5GB of data taken July 2018. Each account record contains the username, email address, MD5-, SHA512- or bcrypt-hashed password, hash salt, first and last name, and if provided, birthday, gender, and city and country. 500px is a social-networking site for photographers and folks interested in photography.

    "Our engineering team is currently investigating and if we can confirm there was a breach we will take the necessary steps to inform our users as per GDPR standards," 500px spokesperson Stephanie Newell told us.

    Update: 500px staff are now notifying their users that the site was indeed hacked, and will reset everyone's passwords, starting with the ones weakly hashed using MD5.

    "We are able to confirm a breach occurred," Newell told us. "Our engineers immediately launched a comprehensive review of our systems and have since taken every precaution to secure them. All areas of vulnerability have been identified and fixed during our internal investigation, and we’ve found no evidence to date of any recurrence of the issue.

    "We are currently working on notifying our entire user base, however, given the amount of users affected, this task will span one day at minimum. We’ve taken every precaution to ensure our users' data is safe. A system-wide password reset is currently underway for all users, prioritized in order of accounts with the highest potential risk, and we have already forced a reset of all MD5-encrypted passwords."

    In addition, 500px, which is based in Canada, said it has taken the following steps to shore up its security:

    - Vetted access to our servers, databases, and other sensitive data-storage services.

    - Analyzed and are continuing to monitor our source code, both public-facing and internal, to improve our security protocols and protect against security issues.

    - We have partnered with leading experts in cyber security to further secure our website, mobile apps, internal systems, and security processes.

    - Modifications to our our internal software development process.

    - Reviewing the PII [personally identifying information] data we collect from users and how it is used on our platform.

    - We are continuing to upgrade our network infrastructure. Over the last 12 months, we have undertaken a major upgrade to our network infrastructure—this project is nearing completion, and will also offer a significant increase in security.

    EyeEm: 22,360,765 accounts for 0.289 BTC ($1,040) total
    1.7GB of data taken February 2018. Each account record contains an email address and SHA1-hashed password, although about three million are missing an email address. This security breach has not been previously publicly disclosed. Germany-based EyeEm is an online hangout for photographers. A spokesperson did not respond to a request for comment.

    Update: EyeEm has told its customers it was hacked, and forced a reset of their passwords.

    8fit: 20,180,667 accounts for 0.2025 BTC ($728) total
    1.9GB of data taken July 2018. Each account record contains an email address, bcrypted-hashed password, country, country code, Facebook authentication token, Facebook profile picture, name, gender, and IP address. This security breach has not been previously publicly disclosed. Germany-headquartered 8fit offers customized workout and diet plans for healthy fitness types.

    8fit CEO Aina Abiodun told us her team is investigating, adding: "I need to get back to you on this and can't comment immediately."

    Update: 8fit has confessed to its users that it was hacked, and is resetting their passwords.

    Fotolog: 16 million accounts for 0.52 BTC ($1,872) total
    5.9GB of data taken in December 2018. There are five SQL databases containing information including email addresses, SHA256-hashed passwords, security questions and answers, full names, locations, interests, and other profile information. This alleged security breach has not been previously publicly disclosed. Fotolog, based in Spain, is another social network for photography types. A spokesperson did not respond to a request for comment.

    Animoto 25,402,283 accounts for 0.318 BTC ($1,144) total
    2.1GB of data taken in 2018. Each account record contains a user ID, SHA256-hashed password, password salt, email address, country, first and last name, and date of birth. This security breach was publicly disclosed by the NYC-headquartered business in 2018, though this is the first time the data has gone on sale, we understand.

    "We provided notification about an incident potentially affecting customers back in August 2018 after we identified unusual activity on our system," spokesperson Rebecca Brooks told us. "After identifying the suspicious activity, we immediately took the systems offline and implemented numerous security controls to help prevent an incident like this from happening again."

    MyHeritage 92,284,478 accounts for 0.549 BTC ($1,976) total
    3.6GB of data taken October 2017. Each account record contains an email address, SHA1-hashed password and salt, plus the date of account creation. This security breach was publicly disclosed by the business last year, though this is the first time the data has gone on sale, we're told. No DNA or similar sensitive information was taken. MyHeritage, based in Israel, is a family-tree-tracing service that studies customers' genetic profiles.

    A spokesperson told us:

    The date, the number of users affected, and the type of information [in the 2018 disclosure] correspond almost exactly to [the for-sale database], so this does not look like a new breach. It seems likely that the perpetrator(s) of the October 2017 breach or someone who obtained the data from them is now trying to sell it. We will investigate this immediately and report the attempted sale to the authorities so they can try to trace the perpetrators. Until this moment, we have not seen any evidence of circulation or usage or abuse of the breached email addresses and hashed passwords, and this is the first time a mention of them has surfaced since June 4 2018.

    MyFitnessPal 150,633,038 accounts for 0.289 BTC ($1,040) total
    3.5GB of data taken February 2018. Each account record contains a user ID, username, email address, SHA1-hashed password with a fixed salt for the whole table, and IP address. This security breach was publicly disclosed by the business last year. This may be the first time it has gone on public sale. Under-Armor-owned MyFitnessPal does what it says on the tin: it's an app that tracks diet and exercise. A spokesperson did not respond to a request for comment.

    Update: Spokesperson Erin Wendell has told us the biz made every user reset their password following the discovery of the intrusion last year. If you reused your old MyFitnessPal password with other sites, now would be a good time to change your password on those other services, if you have not done so already.

    "We responded swiftly to alert users and have since required all MyFitnessPal users who had not changed their passwords since that March 29, 2018 announcement, to reset their passwords," Wendell said.

    "As a result, passwords previously used for MyFitnessPal at the time of the data security issue are no longer valid on MyFitnessPal, and we continue to encourage strong password practices including unique and complex passwords for all their accounts to enable users to further protect themselves."

    Artsy 1,070,000 accounts for 0.0289 BTC ($104) total
    184MB of data taken April 2018. Each account record contains an email address, name, IP addresses, location, and SHA512-hashed password with salt. This security breach has not been previously publicly disclosed. Artsy, located in NYC, is an online home for collecting and organizing art. A spokesperson did not respond to a request for comment.

    Update: Artsy has emailed its users to confirm its data was stolen and sold online. It is in the process of investigating how it happened.

    Armor Games 11,013,617 accounts for 0.2749 BTC ($988) total
    1.8GB of data taken late December 2018. Each account record contains a username, email address, SHA1-hashed password and salt, date of birth, gender, location, and other profile details. This alleged security breach has not been previously publicly disclosed. California-based Armor Games is a portal for a ton of browser-based games. A spokesperson did not respond to requests for comment.

    Bookmate 8,026,992 accounts for 0.159 BTC ($572) total
    1.7GB of data taken July 2018. Each account record typically contains a username, an email address, SHA512 or bcrypt-hashed password with salt, gender, date of birth, and other profile details. This alleged security breach has not been previously publicly disclosed. British Bookmate makes book-reading apps. A spokesperson did not respond to a request for comment.

    CoffeeMeetsBagel 6,174,513 accounts for 0.13 BTC ($468) total
    673MB of data taken late 2017 and mid-2018. Each account record contains typically a full name, email address, age, registration date, and gender. This security breach has not been previously publicly disclosed. CoffeeMeetsBagel is a dating website.

    Jenn Takahashi, spokesperson for the CoffeeMeetsBagel, told us: "We are not aware of a breach at this time, but our security team is looking into this now." She also said the San-Francisco-based biz does not store passwords, and uses third-party sites for authentication.

    "We have engaged with our legal team and forensic security experts to identify any issues and ensure we have the best security stance moving forward," Takahashi added.

    Update: CoffeeMeetsBagel has confirmed at least some user account data was stolen by a hacker who broke into the biz's systems as recently as May 2018, as we reported.

    "On February 11, 2019, we learned that an unauthorized party gained access to a partial list of user details, specifically names and email addresses prior to May 2018," the company said in a statement.

    "Once we became aware, we immediately launched a comprehensive investigation with the help of experienced forensic experts. We are currently working on notifying the affected user base. The security of our users’ information is important to us, and we apologize for any inconvenience this may have caused."

    DataCamp 700,000 accounts for 0.013 BTC ($46. total
    82MB of data taken December 2018. Each account record contains an email address, bcrypt-hashed password, location, and other profile details. This security breach has not been previously publicly disclosed. US-based DataCamp teaches people data science and programming. A spokesperson told us they are "looking into" the online sale.

    "We take this matter seriously and want to further verify if this is indeed the case," said the biz's Lode Vanacken. "We will also investigate access and audit logs to see if we can trace back any potential unauthorised access. If indeed further investigation shows this data to be valid we will communicate with you and with the affected end-users."

    Update: Vanacken has told us DataCamp is resetting users' passwords after confirming its data was stolen. "We have notified the users we believe were affected or potentially affected via email," he said.

    "Out of an abundance of caution, we are logging out all DataCamp users who may have been affected, and, if they use a password as their authentication method, we are invalidating their passwords and prompting them to reset their passwords.

    "We continue to monitor for suspicious activity and to make enhancements to our systems to detect and prevent unauthorized access to user information."

    HauteLook 28 million accounts for 0.217 BTC ($780) total
    1.5GB of data taken during 2018. Each account record contains an email address, bcrypt-hashed password, and name. This alleged security breach has not been previously publicly disclosed. HauteLook is an online store for fashion, accessories, and so on. A spokesperson for the Los Angeles-based biz did not respond to a request for comment.

    ShareThis 41,028,098 accounts for 0.217 BTC ($780) total
    2.7GB of data taken early July 2018. Each account record contains a name, username, email address, DES-hashed password, gender, date of birth, and other profile info. This alleged security breach has not been previously publicly disclosed. Palo Alto-based ShareThis makes a widget for sharing links to stuff with friends. A spokesperson did not respond to a request for comment.

    Whitepages 17,775,679 accounts for 0.434 BTC ($1560) total
    2.9GB of data taken 2016. Each account record contains an email address, SHA1- or bcrypt-hashed password, and first and last name. This alleged security breach has not been previously publicly disclosed. Whitepages is a Seattle-based online telephone and address directory. A spokesperson did not respond to a request for comment.

The seller told The Register they have as many as 20 databases to dump online, while keeping some others back for private use, and that they have swiped roughly a billion accounts from servers to date since they started hacking in 2012.

Their aim is to make "life easier" for hackers, by selling fellow miscreants usernames and password hashes to break into other accounts, as well as make some money on the side, and highlight to netizens that they need to take security seriously – such as using two-factor authentication to protect against password theft. The thief also wanted to settle a score with a co-conspirator, by selling a large amount of private data online.

The hacker previously kept stolen databases private, giving them only to those who would swear to keep the data secret.

"I don't think I am deeply evil," the miscreant told us. "I need the money. I need the leaks to be disclosed.

"Security is just an illusion. I started hacking a long time ago. I'm just a tool used by the system. We all know measures are taken to prevent cyber attacks, but with these upcoming dumps, I'll make hacking easier than ever." ®

Updates below

This article was revised at 0430 UTC on Tuesday, February 12 to include confirmation from 500px that it was hacked, as we reported.

Also on Tuesday, EyeEm informed its users it had been hacked. We understand similar disclosures are due to land this week from ShareThis and others.

On Wednesday, February 13, DataCamp informed us it is resetting its users' passwords after "some user data was exposed by a third party who gained criminal unauthorized access to one of our systems."

Also on Wednesday, CoffeeMeetsBagel told us it is alerting its users to its security breach, we added a statement from MyFitnessPal, and 8fit admitted to its customers that it was hacked.

On Thursday, February 14, Artsy emailed its users to confirm its internal data was stolen and put up for sale, as reported. "On February 11, 2019, we became aware that account information for some of our users was made available on the internet," the biz wrote. "We are still investigating the precise causes of the incident, and together with our engineering team, we are working with a leading cyber forensics firm to assist us."

Source: https://www.theregister.co.uk/2019/02/11/620_million_hacked_accounts_dark_web

[Admin]

Coffee Meets Bagel announces a data breach on Valentine’s Day
Makena Kelly | Feb 14, 2019

Happy Valentine’s Day! If you were trying to find the love of your life on Coffee Meets Bagel before May 2018, your personal data was possibly stolen. The company sent out an email to users today telling them that some of their personal information may have been breached.

In that email, Coffee Meets Bagel said that, on Monday, an unauthorized party gained access to user data. Luckily, the company said that the hackers didn’t make off with any sensitive information like credit card numbers or passwords.

Coffee Meets Bagel didn’t disclose the number of users who were affected by the breach, but it said that some users who were on the app before May 2018 had their names and email addresses leaked. The company said that the information that was stolen was part of a larger breach reported by The Register yesterday. Over 617 million account details in total from popular apps like Dubsmash, MyFitnessPal and Coffee Meets Bagel have been dumped on the dark web for less that $20,000 in bitcoin. The Register cites 6 million Coffee Meets Bagel account details have been breached.

“As a reminder, we never store any financial information or passwords,” the email read in bold.

“With online dating, people need to feel safe. If they don’t feel safe, they won’t share themselves authentically or make meaningful connections,” Coffee Meets Bagel said in a statement. “We take that responsibility seriously, so we informed our community as soon as possible—regardless of what calendar date it fell on—about what happened and what we are doing about it.

In the email to users, the Coffee Meets Bagel said that it has engaged with forensic security experts who are reviewing its systems to help find out exactly how the breach occurred.

“As always, we recommend you take extra caution against any unsolicited communications that ask you for your personal data or refer you to a web page asking for personal data,” the email says. “We also recommend avoiding clicking on links or downloading attachments from suspicious emails.”

Earlier this week, TechCrunch reported that a number of OkCupid accounts had been hacked, and when some users of the app tried to log in, they saw that their passwords were changed and they were locked out. OkCupid has denied that there has been a security breach.

After a year of data breaches from companies like Facebook and Google, it only makes sense that even our most boring and benign dating data would become the subject of rogue hackers online. Credit card information is one thing, but imagine trying to get into user messages. You would just find one person saying “Hey,” and no one ever responding. Forever.

Updated 2/14/18 12:25 p.m. ET: Updated to include a statement from Coffee Meets Bagel.

Source: https://www.theverge.com/2019/2/14/18224702/coffee-meets-bagel-data-breach-valentines-day

Singaporeans hit by dating app leak, data of 6 million users for sale on dark web
They are among six million stolen accounts of US-based Coffee Meets Bagel that were put on sale on the dark web
David Sun | Feb 15, 2019

Millions of people looking for love received a rude Valentine's Day gift yesterday in the form of an e-mail from Coffee Meets Bagel (CMB).

The users of the popular dating platform were informed that their account data may have been stolen by an "unauthorised party".

The data, which includes names and e-mail addresses of more than six million CMB users, has been put on sale on the dark web for 0.13 Bitcoin, or about $600.

CMB, a mobile dating app company based in San Francisco in the US state of California, was launched in April 2012.

It is popular in Singapore, with CMB previously claiming it had made 1.6 million matches, with 28 million messages sent by users here in 2017.

Users are matched based on their interests and can contact each other only on the app after "liking" each other's profiles.

Source: https://www.tnp.sg/news/singapore/dating-app-hacked-data-6-million-users-sale-dark-web

[Admin]

Plastic surgeon suspended 3 months for illegally using SGH’s computer system to sort out personal affairs
By Louisa Tang | 06 March, 2019

Dr Leo Kah Woon used a software to spy on his wife’s emails and instant messages. He also tapped a government hospital’s computer system to try and reach her alleged lover’s spouse.

SINGAPORE — Suspecting his wife of having an affair, a plastic surgeon accessed the computer system of the Singapore General Hospital (SGH) to get contact details of the wife of her alleged lover, in the hope of saving his own marriage.

Dr Leo Kah Woon also installed a keylogging software on the laptop he shared with his wife to spy on her personal communications. He later used the information he got in their divorce proceedings.

For his actions, a disciplinary tribunal of the Singapore Medical Council (SMC) suspended him from practising for three months from Dec 18 last year.

In its grounds of decision published on Tuesday (March 5), the tribunal noted that a suspension "would well deter like-minded medical and other professionals who have access to large databases of personal information from abusing the privilege”.

In particular, last year’s SingHealth data leak served as a “timely reminder” for everyone to treat cyber security with “the utmost seriousness”, the tribunal added.

Dr Leo, who has since divorced his wife, now practises at his own clinic at Mount Elizabeth Medical Centre. He was employed at SGH when he committed the offences.

In 2017, he was fined S$13,000 in the court for his actions. The SMC then began disciplinary proceedings against him, as his offences implied a character defect making him unfit for the medical profession.

THE SPYING BEGAN

Dr Leo and his wife tied the knot in 2005. However, sometime in 2011, he started suspecting that she was cheating on him.

Her alleged lover was identified in SMC’s grounds of decision merely as Mr C.

Around September 2012, he installed a keylogging software in the MacBook Pro laptop he shared with his wife. The software captured her keystrokes and took periodic screenshots when she used the computer, which were sent to his email account.

This meant that he could gather information about emails and instant messages that she sent.

The spying continued when she left their home to live with her parents and took the laptop with her.

The tribunal noted that in October 2012, she began “very acrimonious” divorce proceedings against Dr Leo after he asked her to leave their home. The pair, who have two children, finalised their divorce in May 2015.

During their divorce proceedings in the Family Justice Courts, Dr Leo used the information he gathered to explain his concerns about issues relating to the custody, care and control of their children.

He also wanted to find out all he could about Mr C’s wife at the time, identified as Ms A, and reach out to her. Dr Leo hoped that Ms A would be able to convince her husband to leave his family alone.

On Nov 7, 2012, when Dr Leo could not find any reliable public information to contact Ms A, he used a computer at SGH to search for her contact details in the hospital computer system. He then gave the details to his sister and told her to call Ms A.

Ms A came to know of her husband’s infidelity from that call.

Mr C then filed a complaint with the SMC against Dr Leo and the police were called in to investigate when the illegally obtained emails and messages were used in the divorce proceedings.

Dr Leo’s wife was fined S$3,500 by the courts, for abetting a private investigator to unlawfully access his Asus laptop on Dec 18, 2012. She had seen documents related to the divorce proceedings on it and wanted to make copies of them.

A LACK OF INTEGRITY

The SMC sought a suspension of at least six to eight months for Dr Leo, while his lawyers asked for a S$10,000 fine.

While the SMC argued that Dr Leo had displayed dishonesty, which could see him being struck off the registry of medical practitioners, the disciplinary tribunal concluded that there was no clear evidence of that in his conduct.

Instead, it said that he clearly displayed a lack of integrity “to a somewhat appalling extent”.

Dr Leo had hired a private investigator to surveil his wife, including installing the keylogging software on the laptop to gather evidence against her in the event of divorce proceedings. To use this evidence “brings (his) integrity to the lowest of levels”, the tribunal added.

As members of the public expect doctors to keep medical records confidential, a fine would not be enough to correct his breach of trust, it said.

“A suspension would also convey to the public that the disciplinary tribunal does not condone such behaviour and acts, even if they are related to matters in the private family domain. It will convey the message clearly that doctors are expected to conduct themselves with integrity and ethically both in their professional and private lives,” the tribunal added.

Dr Leo was also censured, as well as ordered to give a written undertaking to the SMC not to engage in similar conduct and to pay the costs of the disciplinary proceedings.

Source: https://www.todayonline.com/singapore/plastic-surgeon-suspended-3-months-illegally-using-sghs-computer-system-sort-out-personal

[Admin]

S$50,000 fine for psychiatrist who failed to protect patient’s confidential info
By Neo Chai Chin | 06 March, 2019

NUH psychiatrist Soo Shuenn Chiang did not verify the identity of a caller who claimed to be a patient’s husband.

SINGAPORE — A psychiatrist from the National University Hospital (NUH) has been fined S$50,000 for failing to verify a caller’s identity before writing a memo to refer a patient to the Institute of Mental Health.

The caller turned out to be the patient’s brother and not her husband as he had claimed.

And although the memo was addressed to ambulance personnel or the police officer-in-charge, it was handed to the brother, who used it to support his application for a personal protection order against the patient.

The personal protection order was granted by the Family Court.

A three-member disciplinary tribunal found Dr Soo Shuenn Chiang guilty of failing to maintain patient confidentiality.

The tribunal — chaired by cardiothoracic surgeon Joseph Sheares — had wanted to impose the maximum fine of S$100,000, but reduced it by half after considering mitigating factors.

In the grounds of decision released on Tuesday (March 5), the tribunal said that a breach of patient confidentiality is a serious and important matter.

This case justifies a deterrent sentence “so as to create public awareness, more particularly among potential offenders, that punishment will be certain and unrelenting for this type of breaches and offenders”, it said.

The patient's name was not disclosed in the grounds of decision to protect her identity.

FACTS OF THE CASE

On Jan 19, 2015, the patient was admitted to NUH for an overdose of a pain relief drug.

She was reviewed by Dr Soo for adjustment disorder with depressed mood and alcohol misuse. She was noted to have a risk of self-harm as she had a history of depression.

The woman was discharged the next day.

Two months later, Dr Soo received a phone call from the woman’s brother. Dr Soo did not check the caller’s identity by asking for his name, identity card number or contact number, and comparing these against NUH’s records.

The memo he wrote contained her confidential medical information, and he instructed his clinic staff member to pass it to the caller, believing he was the patient’s husband.

While Dr Soo’s response to the phone call was appropriate in trying to rapidly get help for the patient, he failed to take proper care to ensure the memo did not fall into the wrong hands.

Dr Soo’s lawyers said that it was an “honest oversight” during the course of seeing 17 patients that day.

The psychiatrist accepted that he had caused potential harm to the patient.

The tribunal agreed that the lapse occurred on a hectic day, but said that the preventive actions he should have taken by verifying the caller’s identity were simple and “not onerous”.

“We could only conclude that the failure of Dr Soo to take such steps reflected both a lack of concern for or appreciation of the required standards and an indifference to the patient’s medical confidentiality,” the tribunal said.

But it agreed that Dr Soo’s misconduct was not as egregious as a previous case, in which a doctor — who was with the KK Women's and Children's Hospital — was fined S$10,000 in 2011 for accessing the electronic medical records of two patients not under his care, but who were his ex-girlfriends.

At the time, S$10,000 was the maximum fine.

Source: https://www.todayonline.com/singapore/s50000-fine-psychiatrist-who-failed-protect-patients-confidential-info

[Admin]

[PART 1] Personal data of over 800,000 blood donors put online by vendor: HSA
Staff Writer, Singapore | 15 March 2019

The private information of more than 800,000 blood donors in Singapore was put online without authorisation by a Health Sciences Authority (HSA) vendor.

The database contained information such as name, NRIC, gender, blood type and dates of blood donations and did not contain other sensitive, medical or contact information, the HSA said in a statement on Friday (15 March).

The authority said preliminary findings show that a cyber security expert discovered the vulnerability and alerted the Personal Data Protection Commission on Wednesday.

HSA then contacted the vendor, Secur Solutions Group (SSG), to disable access to the database, and made a police report.

It noted that the cybersecurity expert had told the HSA that he does not intend to disclose the data that he had accessed, and is working with the agency to delete the information.

Preliminary findings by HSA’s review of the database show that no unauthorised person other than the cybersecurity expert had accessed the database.

HSA had provided the blood donors’ data to SSG for updating and testing purposes. The vendor placed the data on a server that was accessible via the Internet on 4 January without putting adequate safeguards to prevent unauthorised access.

SSG did so without the HSA’s knowledge and approval, and that the action was against the vendor’s contractual obligations, the HSA said.

The leak comes less than two months after the Ministry of Health (MOH) announced the online leak of confidential data belonging to 14,200 HIV-positive individuals and 2,400 others who were identified through contact tracing.

American citizen Mikhy K Farrera Brochez, 34, was fingered as the culprit behind the leak.

In July last year, the MOH announced that health records of 1.5 million Singaporeans, including Prime Minister Lee Hsien Loong, were stolen in a suspected state-sponsored attack information, the country’s biggest ever data breach.

Source: https://sg.news.yahoo.com/personal-data-800000-blood-donors-put-online-vendor-hsa-131843665.html

Reference (Error as at 16 March 2019, 10pm): https://www.secursolutionsgroup.com

Improper Handling of Personal Information of Blood Donors
15 MARCH 2019

The Health Sciences Authority (HSA) was alerted on 13 March 2019 that one of its vendor’s servers contained a HSA database that was not adequately safeguarded against access over the internet. The vendor is Secur Solutions Group Pte Ltd (SSG). SSG provides services to HSA and was working on a database containing registration-related information of 808,201 blood donors: Name, NRIC, gender, number of blood donations, dates of the last three blood donations, and in some cases, blood type, height and weight. The database contained no other sensitive, medical or contact information.

2.               A cybersecurity expert had discovered this vulnerability and alerted the Personal Data Protection Commission. HSA immediately worked with SSG to disable access to the database. We have also made a Police report. The expert has confirmed to HSA that he does not intend to disclose the contents of the database. HSA is in contact with the expert on deleting the information.

3.               Investigations are ongoing. Preliminary findings from HSA's review of the database logs show that other than the cybersecurity expert who raised the alert, no other unauthorised person had accessed the database.

4.               HSA had provided the data to SSG for updating and testing. SSG placed the information in an internet-facing server on 4 Jan 2019 and failed to institute adequate safeguards to prevent unauthorised access. It had done so without HSA’s knowledge and approval, and against its contractual obligations with HSA.

5.       Chief Executive Officer of HSA, Dr Mimi Choong, said: “We sincerely apologise to our blood donors for this lapse by our vendor. We would like to assure donors that HSA's centralised blood bank system is not affected. HSA will also step up checks and monitoring of our vendors to ensure the safe and proper use of blood donor information.”

6.       More details can be found at this link on HSA’s website https://www.hsa.gov.sg/content/hsa/en/News_Events/HSA_Updates/2019/letter-to-blood-donor.html. Donors can also contact HSA at the following hotline number 62200183.

HEALTH SCIENCES AUTHORITY
SINGAPORE

Source: https://www.hsa.gov.sg/content/hsa/en/News_Events/Press_Releases/2019/cybersecurityincident.html

[PART 2] 800,000 blood donors' personal data accessed illegally and possibly stolen; police investigating
30 March 2019 | Timothy Goh

SINGAPORE - The personal information of more than 800,000 blood donors which was put online improperly for over two months was accessed illegally and possibly stolen, a Health Sciences Authority (HSA) vendor responsible for the mistake said on Saturday (March 30).

It was initially thought that only a foreign cyber-security expert, who spotted the vulnerability in the server that stored the data, had accessed it.

However on Saturday, Secur Solutions Group (SSG), an independent vendor of HSA, said its server was also accessed suspiciously from several other IP addresses between October and March this year. It did not say whether these addresses were local or foreign.

A database containing the personal information of blood donors was uploaded to this server around October last year.

This information included the names, NRIC numbers, gender and number of donations of people who have donated or registered to donate blood in Singapore since 1986.

In some cases, donors' blood type, height, weight and the dates of their last three donations were also included.

On March 13, HSA told SSG that a US cyber-security expert had found that the registration-related information of donors could be accessed because of a vulnerability in the server used by SSG.

The server was immediately cut off from the Internet and secured, said SSG.

The vendor engaged external cyber-security professionals, KPMG in Singapore, to undertake forensic analysis. It also initiated a thorough review of its IT systems.

Preliminary examination had found that the unauthorised access was made by only the US cyber-security expert, who said he did not intend to disclose the database and was working with the authority to delete the information.

But subsequent forensic analysis revealed that the server was also accessed suspiciously from several other IP addresses between Oct 22, 2018, and March 13 this year.

SSG said in its statement: "Based on this new information, SSG cannot exclude the possibility that registration-related information of donors on the server was exfiltrated."

The vendor added that the database contains no other sensitive, medical or contact information.

SSG said that there had also been attacks on the same server in 2017. However, these were unrelated to the current incident, and there was no evidence to suggest that any HSA data was compromised.

It is continuing its investigations into the matter, and is cooperating fully with the police and HSA.

It also apologised to all the affected blood donors.

In a statement, HSA said that it was aware of the situation, and added that it takes a serious view of the matter, which the police are investigating.

The agency said that SSG is in breach of its contractual obligations and it will decide on what steps it should take regarding SSG once investigations are concluded.

HSA added that its centralised blood bank system, which is not connected to the SSG server, remains secure.

Public servant Ryan See, 25, who donates blood regularly, said: "I'm not really too concerned about my details getting leaked, but I have been getting quite a few random SMSes asking if I'd like to gamble online. I'm not sure if they're related."

Another regular donor, 19-year-old student Megan Koh, said: "I think it’s worrying that these sort of data leaks keep happening, especially since we’re increasingly reliant on technology these days and all our data is online."

This is the third IT incident to strike the healthcare sector in recent months.

In January, the Ministry of Health (MOH) revealed that the confidential information of 14,200 HIV-positive individuals had been leaked online by Mikhy Farrera-Brochez, an American who had been living in Singapore.

And in February, MOH said that a computer error had resulted in 7,700 people receiving inaccurate healthcare subsidies when they applied for or renewed their Community Health Assist Scheme cards in September and October last year.

Mr Aloysius Cheang, Asia-Pacific executive vice-president of the Centre for Strategic Cyberspace + Security Science, a London-based think-tank, agreed that the frequency of the recent data leaks was indeed worrying.

"This is not the first time, it's the third time. And when there's a third time, there's bound to be a fourth, a fifth, and so on," he said.

He added that there is a need for Singapore to send a strong signal that its sovereign control over its digital assets has not been compromised, especially since the nation prides itself on being a safe and secure place to do business.

"You have to show people you can protect these things. If you can't even protect your own citizens' data, how can you be trusted to protect that of companies like Google, Amazon, and private banks?"

Dr Ngair Teow-Hin, chief executive officer of data security company SecureAge Technology, said that there is nothing blood donors who may have had their information accessed can do.

"You can't change your NRIC number or date of birth, that's the unfortunate reality of the situation," he said.

He noted that some of the information that was stored in the server, such as the NRIC number and date of birth of donors, is sometimes used by services such as banks and telephone companies to verify one's identity.

Such information could be sold on the Dark Web, or used to impersonate donors.

Both experts said there was a need for harsher penalties to ensure such a mistake does not occur again.

"It's not so much an IT security issue as it is an organisational failure," said Mr Cheang.
 
Source: https://www.straitstimes.com/singapore/health/800000-blood-donors-personal-data-accessed-illegally-and-possibly-stolen-police

[Admin]

China data breaches: 33-mil unprotected job applicant profiles leaked
Amid a series of recent cybersecurity attacks in China, President Xi Jinping has initiated some IT safeguards as the country’s top agenda.
Maynard | March 17, 2019

Cybercrimes remain a global threat. Even a superpower like China has not been spared. Increasingly, cybercriminals in China are attacking industrial facilities.

Huge databases containing the personal details of 33 million candidates of online recruitment sites such as 51Job, lagou, and Zhilian have been laid bare.

These personal details include users’ addresses, mobile numbers, and statuses. Based on resource site Bleeping Computer, other details such as educational, work and salary history were part of the leaked info.

The unencrypted database was found by Sanyam Jain, a security researcher and member of GDI Foundation. The database owner was not identified.

According to Mr Jain, a third-party collected the profiles from these job sites and used them in a few ways. When he reported what he discovered to CNCERT, a Chinese cyber emergency response team, the database was secured.

Amid a series of recent cybersecurity attacks in China, President Xi Jinping has initiated some IT safeguards as the country’s top agenda.

The plan aims to curtail possible areas of entry for hackers and foreign intelligence services as well as strengthen China’s local cyber industry.

Such a corrective measure comes on the heels of last June’s reported data leak that led to 1.9 million 51Job.com user accounts and a resulting case against 51Job.com by Pomerantz LLP, a US law company that focuses on class action lawsuits.

The 2018 data breach did not provide details on where the stolen data was sourced. The absence of these details did not help repair public confidence which further eroded after claims that this breach was related to another massive data breach in 2015 when Chinese IT company NetEase email service was hacked into.

Serious cyber attacks have also been in the minds of Singaporeans, up to 1.5mil of whom had their personal details hacked into during the past few years as well as the first quarter of 2019.

To protect the government’s security systems, the city-state’s Cybr Security Agency sought assistance from local and overseas “white hat” or ethical hackers to eliminate vulnerabilities of five government online agencies.

Source: http://theindependent.sg/china-data-breaches-33-mil-unprotected-job-applicant-profiles-leaked/

[Admin]

Stringent LTA Installation Guidelines for Inward-Facing In-Vehicle Recording Devices to Safeguard Commuters’ Personal Data       
News Releases |22 May 2018 


1             The Land Transport Authority (LTA) has published a set of installation guidelines for inward-facing in-vehicle recording devices (IVRDs) in public service vehicles (PSVs) such as taxis, private hire cars (PHCs) and buses^[1].The guidelines will come into effect on 22 June 2018.

2             LTA’s guidelines complement the Personal Data Protection Commission’s (PDPC) Advisory Guidelines on in-vehicle recordings^[2], which clarify the obligations under the Personal Data Protection Act that operators and drivers of transport services for hire must comply with when they use inward-facing IVRDs to capture individuals’ personal data. Together, these guidelines serve to protect commuter safety and their personal data, and prevent unauthorised access to the footage recorded by inward-facing IVRDs.

Key guidelines for installation of inward-facing IVRDs
3             PSV owners must obtain LTA’s approval to install inward-facing IVRDs. Approved installations can only be carried out at LTA-authorised installation centres^[3]. This is to ensure that the inward-facing IVRDs are installed according to the manufacturer’s requirements and LTA’s requirements, and to prevent the inward-facing IVRDs from being tampered with. Some key requirements that the LTA-authorised installation centres have to adhere to include:

a.            IVRDs must be secured in such a manner that prevents any unauthorised access to and downloading of the stored data (e.g. locking the memory card slot, blocking the micro USB port).

b.            IVRDs must be installed in a fixed position and cannot be rotated in order to prevent the capture of compromising visual records of commuters.
c.             IVRDs must not have any audio recording function so that the passengers’ conversations are not recorded
d.            All footage created by the IVRD must clearly indicate a date and time stamp, as well as the PSV’s licence plate number to facilitate investigations in the event of misuse of the footage.
Please refer to the Annex for the full list of requirements.

4             PSV owners that have installed inward-facing IVRDs at LTA-authorised installation centres will be required to affix a notice notifying passengers of the inward-facing IVRD in the PSV. In addition, booking service operators must inform commuters if a PSV installed with an inward-facing IVRD is being dispatched to them. PSV owners will also be required to carry out periodic checks to ensure that the inward-facing IVRDs have not been tampered with, and must report any indication of tampering or non-compliance with LTA’s guidelines to LTA immediately.

Restrictions on access to footage
5             Drivers who wish to use LTA approved installed inward-facing IVRDs must obtain the written permission of the Registrar. Drivers will be subjected to further stringent guidelines on the use of installed IVRDs.

6             There will be restricted access to the footage recorded by inward-facing IVRDs. Government agencies and LTA-authorised data controllers^[4] will be allowed to access the footage to support investigations and enforcement efforts e.g. cases of fare evasion by commuters, or alleged offences by the driver. The data controllers will be required to follow stringent guidelines including requirements such as putting in place proper safeguards on the storage and access to the footage and ensuring that only authorised personnel have access to the footage.

7             Interested parties may approach LTA to apply to be an authorised installation centre, or independent data controller, or both.

Penalties
8             Under the Road Traffic Act, LTA will impose the following penalties to persons found liable for offences relating to the unauthorised installation of inward-facing IVRDs and the unauthorised access of visual records:-

a.            A fine up to $1,000, or imprisonment for a term not exceeding 3 months or both upon conviction. In the case of a second or subsequent offence, a fine up to $2,000, or imprisonment for a term not exceeding 6 months or both upon conviction.
b.            For taxi and PHC drivers – 21 demerit points, which may lead to the revocation of the driver’s vocational licence under the Chauffeured Private Hire Car and Taxi Driver’s Vocational Licence Demerit Points System.
c.             For drivers of private hire buses, excursion buses and school buses – LTA may revoke their vocational licences.

     ^[1] The guidelines do not apply to omnibuses that are licensed to operate regular route services (e.g. SBST and SMRT buses) and private buses (e.g. company buses used to ferry its own employees).    ^[2] The Personal Data Protection Commission’s (PDPC) Advisory Guidelines on In-Vehicle Recordings by Transport Services for Hire, are available at www.pdpc.gov.sg/Legislation-and-Guidelines/Guidelines.
    ^[3] These could include for example, taxi companies or LTA-authorised inspection centres.
    ^[4] This could include for example, taxi companies.

Source: https://www.lta.gov.sg/apps/news/page.aspx?c=2&id=926783be-b319-46d7-b61c-96b5f163313a&fbclid=IwAR0j9vTtrxBrDj-7mTTwo1uU_pubFGXt5S2pUjkZUtfRHVaW0m9Ow5zUa4Q

Annex (cache): https://www.lta.gov.sg/data/apps/news/press/2018/20180522_IVRDInstallationGuidelines_Final.pdf 

[Admin]

Andy Hui cheating scandal: Macau issues privacy warning to cabbies
Danny Mok and Emily Tsang | 18 April 2019

Macau has warned taxi and hire car drivers not to illegally install recording equipment inside their vehicles, after a video of Hong Kong superstar Sammi Cheng Sau-man’s husband cheating on her was made public.

The leaked footage showed singer Andy Hui Chi-on kissing and cuddling TVB actress Jacqueline Wong in the back of a car, in a 16-minute video that quickly went viral.

The casino hub’s data protection watchdog issued the warning on Wednesday in response to “a matter that took place in a neighbouring district in which a video recording was made inside a taxi carriage, which has attracted media and public attention”.

Under the new law, the Office for Personal Data Protection said only video and audio devices installed by Macau’s Transport Bureau were legal. Offenders could face prosecution, resulting in heavy fines or imprisonment, it said.
In Hong Kong, the video has reopened the debate surrounding privacy concerns between lawmakers and the taxi industry, and many have urged the government to tighten regulations on the use of digital cameras. Although, it is not known whether the couple were in a taxi, hire car, or private vehicle when the video was taken.

A tearful Hui apologised at a press conference on Tuesday night, which hundreds of thousands of people watched online, while Wong issued a statement on her social media page on Wednesday admitting she was wrong and was ashamed of her actions.

“Sorry, I am wrong. I have done something very wrong, unforgivable, and I feel very ashamed about it,” the 30-year-old wrote.

“I would not dare to ask for everyone’s forgiveness. So, I just beg everyone to give all those involved some room. I seriously repent on my wrongdoings, and will accept any consequences or punishment.”

Wong’s boss at TVB, Virginia Lok, said the company felt the emotional actress needed to take some time off.

Actor Kenneth Ma Kwok-ming, who Wong has been dating for two years, has carried on working on a local drama series throughout the scandal, and asked the public to give the couple some room.

“She is still young and there are a lot of paths ahead of her, I wish everyone can give her some room,” Ma said. “Since Andy Hui has spoken, I would not say anything more. I feel no one else is qualified to have a say about this except his wife [Sammi Cheng].”

The Transport Department, while addressing public concern cameras in hire cars and taxis, said it was drafting guidelines on the matter, and these are expected to be completed this year.

But, lawmaker Michael Tien Puk-sun called the leaking of the video shocking, and said it showed the need for legislation, rather than guidelines that could be followed on a voluntary basis.

“If a guideline does not say when and who could use the camera data, there is no reason to make it,” Tien said.

In a non-binding motion passed by the Legislative Council last year, Tien sought to make the installation of on-board cameras on taxis compulsory, and under which the data could be used by law enforcement agencies investigating disputes between drivers and passengers.

The motion also wanted a restriction that meant the camera could only be pointed at the driver, and for cars to carry notices telling passengers there were recording devices installed.

Chan Man-keung, chairman of the Association of Taxi Industry Development, which has been promoting the compulsory installation of on-board cameras since 2016, said the guidelines would be better than nothing, but also agreed legislation was the best solution.
Taxi drivers have been reluctant to install CCTV in their cars after Hong Kong’s privacy commissioner expressed concerns. Photo: Felix Wong© Felix Wong Taxi drivers have been reluctant to install CCTV in their cars after Hong Kong’s privacy commissioner expressed concerns. Photo: Felix Wong

He added that the devices and the footage would serve to protect both drivers and passengers should disputes arise.

But Dr Hung Wing-Tat, a member of the Committee on Taxi Service Quality, said cabbies were not keen to install the devices after the privacy commissioner voiced concerns over the scheme.

While Craig Choy Ki, a lawyer and convenor of the Progressive Lawyers Group, believed if passengers could be identified in any footage, what was captured would be defined as personal data under existing privacy laws.

Source: https://www.msn.com/en-sg/news/world/andy-hui-cheating-scandal-macau-issues-privacy-warning-to-cabbies/ar-BBW374w?li=BBr8Cnr&ocid=wispr

[Admin]

Social worker agrees three-year caution after data protection breach
Alex Turner | April 11, 2019

A social worker has agreed to a three-year caution after being found to have forwarded multiple confidential documents to a personal email account.

The practitioner’s misconduct was only discovered after she had completed an agency stint with a council, which accessed her staff email account to retrieve material relating to work left incomplete.

The local authority found the social worker had forwarded more than 20 documents, including care plans, assessments and court statements, mostly unredacted to her Yahoo account during late 2017.

It referred the case to the Health and Care Professions Council (HCPC), which agreed a caution order by consent at a tribunal hearing in late March, after the social worker admitted the allegation in full. The social worker was not practising at the time of the hearing but hoped to return to social work, the tribunal noted.

No sanction for social worker who referred self to HCPC after confidentiality breach blamed on IT failings

Caution for social worker who breached confidentiality during ‘difficult personal circumstances’

Social worker sanctioned for ‘clearly inappropriate’ sharing of sensitive data

Data breaches by social workers have been something of a regulatory grey area in recent times. A social worker escaped sanction in 2016 after self-referring to the HCPC and arguing he had forwarded emails to a personal account due to a “highly pressurised” work environment and disruption caused by a change in IT system.
Remedial training

In the wake of her being referred to the HCPC, the social worker in the recent case prepared a reflective statement acknowledging her misconduct. She also issued a written apology and completed remedial data protection training.

The social worker confirmed via her legal representative that she was prepared to admit that her fitness to practise had been impaired by her behaviour.

“The panel accepts that by her statement and by agreeing to the draft consent order, the registrant has shown both reflection and insight,” the tribunal said.

“She has further recognised the serious nature of the allegation made against her,” it added. “She has acknowledged the potential ramifications that her actions could have had on service users and the further impact that this conduct could have on the reputation of and public confidence in social workers.”

The data breach was an isolated incident in which no service users had been harmed and the risk of any similar future incident was low, the tribunal concluded in agreeing the sanction.

It added that even had a contested hearing taken place, it was unlikely that a stiffer punishment would have been imposed.

Source: https://www.communitycare.co.uk/2019/04/11/social-worker-agrees-three-year-caution-data-protection-breach

[Admin]

Personal info of 4,200-odd individuals compromised after Singapore Red Cross website breach
Staff Writer, Singapore | 16 May 2019

SINGAPORE — Details of more than 4,200 individuals who registered their interest in making blood donations on the Singapore Red Cross (SRC) website were accessed without authorisation on 8 May, the SRC said in a media statement on Thursday (16 May).

SRC said that the compromised information of the 4,297 affected individuals includes their names, contact numbers, emails, declared blood types, preferred appointment dates/times and preferred locations for blood donation.

“No other information was affected. SRC’s other databases have not been compromised. The Health Sciences Authority’s (HSA) systems are similarly unaffected by this incident,” the statement said.

Upon being alerted to the unauthorised access by its web developer, the SRC reported this incident to the police, as well as the Personal Data Protection Commission and HSA. Police investigations are ongoing.

Preliminary findings showed that a weak administrator password could have left the website vulnerable to a breach. As a precaution, the SRC has disconnected the website from internet access, and replaced it with a temporary webpage with links to relevant websites.

The SRC said it has engaged external consultants to conduct forensic investigations to determine the exact factors that led to the incident. It will then take the necessary actions to strength its IT security measures upon receiving the consultants’ findings and recommendations.

SRC secretary general Benjamin William said in the statement, “Our immediate priority is to ensure affected individuals and partners are notified... We apologise to the users of our website whose information may have been affected by this incident.”

Source: https://sg.news.yahoo.com/unauthorised-access-on-singapore-red-cross-website-info-of-4200-odd-individuals-compromised-082033726.html

[Admin]

PDPC investigating security vulnerability on Chan Brothers website
24 May, 2019

SINGAPORE — The Personal Data Protection Commission (PDPC) said Friday (May 24) it is investigating a security lapse on Chan Brothers Travel's website which left some personal data of its customers vulnerable to potential exposure.

The vulnerability was discovered by Mr Andrew Goh, who works in the financial technology industry. He told CNA on Thursday that because of a security flaw, he was able to see the booking records and enquiries made by some customers on the Chan Brothers Travel Club webpage

The co-founder of local fintech start-up Factors Platform said he stumbled on the security flaw while doing some research work trying to “scrape” user reviews to predict sales and bookings, and their possible effects on share prices. In doing so, he realised the webpage was “not properly configured” and the permission access was not set correctly.

The customer information which was accessible also included email addresses, phone numbers and NRIC numbers. CNA was also able to view such data when it repeated the techniques used by Mr Goh.

After he discovered the vulnerability, Mr Goh reported it to Chan Brothers.

In response to CNA's queries, Chan Brothers' head of marketing communications Jane Chang said the company had taken action as soon as it became aware of the vulnerability.

"We immediately took action to address the matter including containing the extent of vulnerabilities, assessing the extent of impact and reporting the incident to PDPC. Some of the measures undertaken require continual monitoring, review and action as it involves information that has been publicly cached," she said.

She added that the site has been shut down.

"We are reviewing protection and prevention measures and putting in place operational and policy-related measures, including tightening IT-related security measures and implementing more system monitoring controls," she said, adding that the company deeply regrets that this occurred and takes full responsibility.

"We would like to assure our customers that no sensitive booking and financial information was revealed. That said, we recognise that no personal data should be exposed at all, in any manner and that it is our responsibility and priority to protect our customers’ personal data, said Ms Chang.

Chan Brothers is working with its vendor Aodigy Asia Pacific to investigate the incident. CNA

Source: https://www.todayonline.com/singapore/pdpc-investigating-security-vulnerability-chan-brothers-website

[Admin]

Ex-presidential hopeful Tan Kin Lian exposed his own data and refuses to blame himself after getting harassed
Ilyas Sholihyn | May 28, 2019

Believing that the dangers of getting one’s personal information leaked are non-existent, Tan Kin Lian sought out to prove it.

“I find that the paranoia about the privacy of NRIC (National Registration Identity Card) and contact details to be overblown,” he wrote on Facebook yesterday, expressing how he doesn’t see any troubling issue with data leaks.

The former presidential candidate laid bare all his confidential details on Facebook: his NRIC number; email address; mobile number, and date of birth. This made a lot of his detractors chuckle at what was widely regarded as a bad move.

On top of that, he dared anyone to hack into his SingPass account — his personal centralised account used to access various important government e-services. Truly, Tan refused to believe that anyone could do anything criminal with his personal data.

Cut to nearly seven hours later, and Tan learned why he shouldn’t have done so. He was locked out of his own SingPass account because someone entered (probably intentionally) the wrong password way too many times.

Even if he does eventually regain control of his account by changing his password, the cat’s out of the bag — some troll could always disrupt his access again by making repeated failed attempts to log in using his NRIC number.

Though the 71-year-old had no one else to blame but himself, Tan asserted that it was “stupid” to have a maximum of six failed log-in attempts.

“I do not see how they can make SingPass secure by locking out people unnecessarily,” he wrote, totally oblivious to the fact that he brought it on himself.

In the end, Tan had no choice but to change his SingPass login ID to something else other than his NRIC number. He wrung his hands over having to change his log-in details, again oblivious to the fact that (1) he opened himself up to attacks and (2) there are password managers that can keep all his passwords under one roof.

A series of Facebook posts this morning by Tan continued to pin the blame on GovTech for their account lockout policy as he remained adamant that it should not be the case. What he doesn’t seem to understand is that account lockout thresholds are required for security because of something called a Brute Force Attack, in which hackers use bots to aggressively repeat attempts in trying various password combinations to break into accounts.

Fortunately for him, someone used a bot for less nefarious (but still annoying) purposes. According to Tan, his email was registered to about 200 mailing lists. He also had to deal with multiple requests to change the passwords to his various social media accounts.

If that’s how people are messing with his SingPass account, one can only imagine what they’re doing (or planning to do) with his contact number.

With his mobile phone number, anyone could call up his phone’s network carrier; impersonate him; answer some questions regarding his NRIC number or date of birth (both of which Tan has readily provided); ask customer service to reroute the phone number to a different SIM card; profit by receiving two-factor authentication messages and resetting passwords on all accounts associated with the phone number.

And that’s just one simple scenario about the dangers of data leaks. If anything, Tan just conducted a free masterclass in what not to do with one’s personal data.

Source: https://www.asiaone.com/digital/ex-presidential-hopeful-tan-kin-lian-exposed-his-own-data-and-refuses-blame-himself-after-1

[Admin]

Enabling Data-Driven Innovation Through Trusted Data Sharing In A Digital Economy
IMDA | 28 JUNE 2019

SINGAPORE – 28 JUNE 2019: The Infocomm Media Development Authority (IMDA) and Personal Data Protection Commission (PDPC) today announced the first comprehensive Trusted Data Sharing Framework (“Framework”) to facilitate trusted data sharing between organisations.

The trusted use of data is the foundation of a vibrant Digital Economy, and trusted data flows have the potential to deliver tremendous benefits to both organisations and consumers. For organisations, it facilitates more effective information exchanges, and enables shared data assets[1] (e.g. between business partners) to support the development of innovative solutions, to customise services and processes for different market segments. For consumers, their willingness to share their data with organisations reflects the amount of confidence they have in an organisation’s ability to use and safeguard data. The intent of the Framework is that with stronger safeguards and clarity on regulatory compliance, consumers will be more ready to share their data and consequently benefit from more personalised goods and services.

While organisations have begun to recognise the value of data, they face the following challenges in sharing their data assets:

• A lack of guidance, methodologies and systemic approaches for data sharing;
• Establishing trust with partners when sharing data;
• Ensuring compliance with regulations such as the Personal Data Protection Act (PDPA);
• Valuing the data assets they currently have; and
• Addressing concerns that data sharing could result in a loss of business competitiveness or exposure of trade secrets.

This can impact their ability to maximise the use of data to develop and bring innovative products and services to market.

To address these challenges, the Framework helps organisations to establish a set of baseline practices by providing a common ‘data-sharing language’, and suggesting a systematic approach to the broad considerations for establishing trusted data sharing partnerships. It incorporates content from existing PDPC guides on personal data anonymisation and sharing; new materials such as a guide to data valuation for data sharing; and sample legal templates to enable contractual data sharing. When using the Framework, organisations will also be guided through the regulatory considerations, and the contractual, technical and operational safeguards needed in a data sharing arrangement.
The Framework can help uplift practice norms – enabling better, trusted data flows for the Digital Economy both within the local ecosystem and globally. They can also empower emerging technologies such as Artificial Intelligence (AI) by incorporating accountability, transparency and human-centricity by-design right from the beginning.

The Framework can be downloaded at www2.imda.gov.sg/AI-and-Data from today.

[1] Data assets encompass all forms of data ranging from raw data to compiled datasets.

-----------------
 
ISSUED BY THE INFOCOMM MEDIA DEVELOPMENT AUTHORITY

About Infocomm Media Development Authority (IMDA)

The Infocomm Media Development Authority (IMDA) leads Singapore’s digital transformation with infocomm media. To do this, IMDA will develop a dynamic digital economy and a cohesive digital society, driven by an exceptional infocomm media (ICM) ecosystem – by developing talent, strengthening business capabilities, and enhancing Singapore's ICM infrastructure. IMDA also regulates the telecommunications and media sectors to safeguard consumer interests while fostering a pro-business environment, and enhances Singapore’s data protection regime through the Personal Data Protection Commission.
For more news and information, visit www.imda.gov.sg or follow IMDA on Facebook IMDAsg and Twitter @IMDAsg.

About Personal Data Protection Commission (PDPC)

The Personal Data Protection Commission administers the Personal Data Protection Act 2012 (PDPA) in Singapore, which aims to safeguard individuals’ personal data against misuse and promote proper management of personal data in organisations. The PDPA enhances Singapore’s competitiveness and strengthens our position as a trusted business hub, among the leading jurisdictions in data protection.
For more information, please visit www.pdpc.gov.sg.

Source: https://www2.imda.gov.sg/news-and-events/Media-Room/Media-Releases/2019/Enabling-Data-Driven-Innovation-Through-Trusted-Data-Sharing-In-A-Digital-EconomyPDF Compilation: https://is.gd/84tA92


New framework aims to better enable data sharing, increase trust in Singapore's digital economy
28 June 2019

The Trusted Data Sharing Framework helps by providing a common language when businesses discuss sharing of data, as well as sample legal templates.

SINGAPORE: A new framework to facilitate the ease of sharing data between organisations was introduced on Friday (Jun 28), as a means to increase trust in Singapore’s digital economy.

Senior Minister of State for Communications and Information and Transport Janil Puthucheary introduced the Trusted Data Sharing Framework during his speech at the ongoing Innovfest Unbound tech event here on Friday.

The Info-communications Media Development (IMDA) said in its press release that it worked with the Personal Data Protection Commission (PDPC) to speak with industry players before developing the new framework to create a common “data-sharing language”.

Some of the challenges businesses face in this area today include a lack of guidance and systemic approaches to sharing data, establishing trust with partners when sharing data assets and concerns that data sharing could lead to exposing trade secrets or loss of competitiveness, it said.

“While it is widely accepted that intangible assets such as data are valuable, organisations face specific challenges such as ensuring compliance with the Personal Data Protection Act (PDPA) or in accurately measuring the value of data assets,” IMDA said.

This, in turn, can impact their ability to maximise the use of data to develop and bring innovative products and services to market, the agency said.

An example could be a retailer and an e-payments service provider that wants to work together to create more customised shopping experiences and deals, but are unsure how much of their customer data to share with each other to achieve the outcome.

The new framework is thus intended to solve these, by incorporating content from existing PDPC guides on personal data anonymisation and sharing.

It also includes new materials like a guide to evaluating data assets for sharing and sample legal templates to enable the sharing process, it said.

Furthermore, the Trusted Data Sharing Framework can also help improve industry norms by enabling better, trusted data flows for the digital economy - both in Singapore and globally.

For artificial intelligence (AI), in particular, the trusted data would mean more accountability and transparency from the beginning, it said.

This is the latest in a series of initiatives by Singapore to boost the development of AI here.

Minister for Communications and Information S Iswaran had earlier this year introduced the Model AI Governance Framework to guide private sector players on how to use AI solutions ethically.

This initiative won a top award at the World Summit* on the Information Society (WSIS) Forum this April.

The government had also said it will double down on its efforts [2] to build the AI sector here. Minister-in-charge of Smart Nation Initiative said in Parliament an inter-agency taskforce will be formed this year to study how Singapore will develop AI as a strategic capability and become a trusted global hub for test-bedding, deploying and scaling AI solutions.

Source: https://www.channelnewsasia.com/news/singapore/new-framework-aims-to-better-enable-data-sharing-increase-trust-11669498

[1] https://www.channelnewsasia.com/news/singapore/singapore-wins-top-prize-for-ai-initiatives-at-un-level-awards-11426920

[2] https://www.channelnewsasia.com/news/singapore/singapore-double-artificial-intelligence-efforts-balakrishnan-11298028

[Admin]

The 15 Biggest Data Breaches

Here are the most notable breaches that have occurred over the last 15 years, in ascending chronological order:
Year    Company    Impact
2004    AOL    92 million screen names and email addresses stolen
2013    Yahoo    All 3 billion accounts compromised
2013    Target    110 million compromised accounts, incl. 40 million payment credentials
2014    eBay    145 million compromised accounts
2015    Anthem Inc    80 million company records were hacked, including Social Security numbers
2016    LinkedIn    117 million emails and passwords leaked
2016    MySpace    360 million compromised accounts
2016    Three    133,827 compromised accounts, including payment methods
2017    Equifax    143 million accounts exposed, including 209k credit card numbers
2016    Uber    57 million compromised accounts
2018    Marriott    500 million compromised accounts
2018    Cathay Pacific    9.4 million compromised accounts, including 860k passport numbers
2018    Facebook    50 million compromised accounts
2018    Quora    100 million compromised accounts
2018    Blank Media    7.6 million compromised accounts

Source 1: https://www.visualcapitalist.com/the-15-biggest-data-breaches-in-the-last-15-years

Source 2 (Original): https://hostingtribunal.com/blog/biggest-data-breach-statistics

Full image: https://is.gd/0Bi7bq

[Admin]

'Data monger' fined $6k by privacy watchdog for selling personal data without notification or consent
Jan 28, 2018, 6:00 pm SGT
Irene Tham | Tech Editor

SINGAPORE - Singapore's privacy watchdog has taken the first "data monger" here to task for breaching the Personal Data Protection Act (PDPA) since the law fully kicked in on July 2, 2014.

A data monger is someone who makes money from dealing in other people's personal data such as phone and NRIC numbers.

The Personal Data Protection Commission (PDPC) fined former telemarketer Sharon Assya Qadriyah Tang $6,000 on Jan 11 for selling personal data without notifying the individuals involved or obtaining their consent.

Tang started buying leads containing people's names, NRIC numbers, mobile numbers and annual income ranges sometime in 2012. It was meant to help her meet her sales targets as a telemarketer.

She paid between 20 and 30 cents to unknown sellers for each lead which contains the details of one person. It is not known if those who sold Tang the leads had obtained the personal data legitimately.

Even if the leads were obtained legitimately, consent from the involved individuals is required by law for a new purpose or for disclosure to another party. Tang had not obtained such consent or notified them before she resold the leads.

Her last purchase was in June 2014, by which time she had accumulated about 30,990 leads stored in Microsoft Excel spreadsheets.

From 2012 through February last year (2017), she resold the database for up to 10 times more - for between 5 cents to 20 cents per lead. Moonlighting earned her a profit of $5,000.

The PDPC said that Tang "had used means to obscure her identity when she was selling the leads, which is indicative of a guilty conscience and of a premeditated and deliberate contravention of the PDPA".

The PDPC added: "The profiteering from the sales of personal data by organisations at the expense of consumer or individuals is the very kind of activity which the PDPA seeks to curb, and hence, must be severely dealt with."

The exact penalty was determined to adequately reflect the seriousness of the breach without imposing "a crushing burden" on Tang as she and her husband were earning modest salaries and had a child to support, PDPC said.

Tang also admitted to the wrongdoing and fully cooperated with the PDPC's investigations.

Some of the industry methods for mining personal data include contests, lucky draws, seminars and surveys. But when stricter privacy rules kick in this year (2018), consumers will be able to refuse to hand over their NRIC details. Instead, the onus will be on providers to use other methods to identify consumers.

The PDPC has fined 22 organisations - one of them twice - a total of $216,500 over the past two years for security breaches that exposed the personal details of Singaporeans. Another 23 organisations have been censured for their shortcomings to date.

Source: https://www.straitstimes.com/singapore/singapore-privacy-watchdog-takes-first-data-monger-to-task