Data Protection & Privacy

[Admin]

CCTV cameras are streaming footage of Singapore homes to this creepy site
By Nurul Azliah Aripin | Yahoo Newsroom

[Admin]

Local website DNC Register taken down for 'impersonating' privacy commission
Published on Jan 19, 2015 4:18 PM
By Irene Tham

SINGAPORE - Five months after becoming the first person to be fined for breaching "Do Not Call" rules here and just a week after facing fresh probes by the authorities, Law Han Wei is back on the law enforcement radar.

A company called DNC Register, for which Law is the sole director and shareholder, is being sanctioned for potentially passing off as the Personal Data Protection Commission (PDPC), which enforces the Personal Data Protection Act and the Do Not Call rules here.

Its website www.dncpdpc.com.sg has been taken down by the Singapore Network Information Centre, which governs domain names ending with .sg, on the instructions of the PDPC.

"The company and website are not associated with, endorsed or approved by the PDPC," said the PDPC in a strongly-worded statement in response to queries from The Straits Times.

Source: http://www.straitstimes.com/news/singapore/more-singapore-stories/story/local-website-dnc-register-taken-down-impersonating-priv#sthash.BTTf8CQs.dpuf
___________________________________________________________________

http://www.dncpdpc.com.sg (taken down by .Gov SG in 2015 Jan)

From Google Cache:


ACRA Record
Reg. No.: 201333653C   
Company name: DNC REGISTER PTE. LTD.
Address: 546A, SERANGOON ROAD, Singapore(218168)
Status: Live (as at 19 Jan 2015)
Official website (defunct now): www.dncpdpc.com.sg
Contact no: 8571-3622

[Admin]

Local website DNC Register taken down for 'impersonating' privacy commission
Published on Jan 19, 2015 4:18 PM
By Irene Tham

SINGAPORE - Five months after becoming the first person to be fined for breaching "Do Not Call" rules here and just a week after facing fresh probes by the authorities, Law Han Wei is back on the law enforcement radar.

A company called DNC Register, for which Law is the sole director and shareholder, is being sanctioned for potentially passing off as the Personal Data Protection Commission (PDPC), which enforces the Personal Data Protection Act and the Do Not Call rules here.

Its website www.dncpdpc.com.sg has been taken down by the Singapore Network Information Centre, which governs domain names ending with .sg, on the instructions of the PDPC.

"The company and website are not associated with, endorsed or approved by the PDPC," said the PDPC in a strongly-worded statement in response to queries from The Straits Times.

Source: http://www.straitstimes.com/news/singapore/more-singapore-stories/story/local-website-dnc-register-taken-down-impersonating-priv#sthash.BTTf8CQs.dpuf
___________________________________________________________________

http://www.dncpdpc.com.sg (taken down by .Gov SG in 2015 Jan)

From Google Cache:

[Admin]

Details of more than 1,900 pupils from Henry Park Primary School leaked
Irene Tham, My Paper, Tuesday, Mar 24, 2015

The personal data of more than 1,900 pupils from Henry Park Primary School was leaked two weeks ago, in the second such case reported here since patrons of karaoke chain K Box had their details exposed last September.

A Microsoft Excel spreadsheet containing the children's particulars was mistakenly sent out to some 1,200 parents on March 12 as part of an update about a school event.

The file contains the names and birth certificate numbers of all 1,900 pupils in the school, along with the names, phone numbers and e-mail addresses of their parents.

A day after the leak, principal Chia Soo Keng sent an e-mail apology to all parents, asking them to delete the Excel file and not to use the data.

He told The Straits Times: "This should not have happened."

This was the school's first data breach and it is reviewing all personal data-handling procedures to prevent a recurrence, he said.

"For a start, all confidential information files are now password-protected," said Mr Chia.

When contacted, a Ministry of Education (MOE) spokesman said: "All schools have been reminded to use encryption as an additional means to protect personal data stored in files."

Apologising for the incident, she added that the staff member who made the mistake has been counselled and the school has been asked to tighten its controls.

Still, several parents contacted by The Straits Times said they were concerned about the breach.

"How do you ensure that the data is not used?" asked a 39-year-old IT consultant who wants to be known only as Ms Wong.

Another parent asked why sensitive files were not encrypted. "The school should have tighter processes," said the 30-year-old sales manager, who wants to be known only as Mr Soh.

This incident follows the K Box case last year, when the names, addresses and mobile phone and identity card numbers of its 300,000 members were posted online in the biggest breach of personal data here. The Personal Data Protection Commission has not released the investigation findings.

Three parents told The Straits Times they hoped the commission could step in.

However, the privacy watchdog said MOE schools such as Henry Park are exempt from the Personal Data Protection Act, fully enforced since July 2 last year. The Act requires organisations to take "reasonable measures" to protect personal data in their possession.

Instead, MOE schools are governed by public sector rules.

These rules have not been made public, though the MOE spokesman said its internal rules require sensitive information such as personal data to be encrypted and not be disclosed to unauthorised parties.

Lawyer Bryan Tan, a technology partner at Pinsent Masons MPillay, noted that in situations not covered by the Personal Data Protection Act, the public has no recourse and "only moral suasion".

But lawyer Gilbert Leong, a partner at Rodyk & Davidson, said if parents suspect their data has, for example, been sold to a tuition agency, they can complain to MOE and the commission, which can investigate complaints and charge wrongdoers in court.

Privacy advocate Ngiam Shih Tung, 47, an engineer, said it is timely to re-look the exemption of government agencies from the Personal Data Protection rules.

"There are many areas where the Government may have fallen short of the standards imposed on the private sector," he said. "Is there a requirement for public agencies to state the purpose of data collection?"

Source: http://news.asiaone.com/news/singapore/details-more-1900-pupils-henry-park-primary-school-leaked#sthash.1UE3efxU.dpuf

[Admin]

Japan pension system hacked, 1.25 million cases of personal data leaked
Technology | Mon Jun 1, 2015 6:42am EDT

Japan's pension system has been hacked and more than a million cases of personal data leaked, authorities said on Monday, in an embarrassment that revived memories of a scandal that helped topple Prime Minister Shinzo Abe in his first term in office.

Japan Pension Service staff computers were improperly accessed by an external email virus, leading to the leak of some 1.25 million cases of personal data, the system's president, Toichiro Mizushima, told a hastily called news conference.

He apologized for the leak, which he said involved combinations of names, identification numbers, birth dates and addresses.

The pension service was setting up a team to investigate the cause and prevent a recurrence, Mizushima said.

"These are the people's vital pensions. I have instructed Health and Welfare Minister (Yasuhisa) Shiozaki to consider the pension recipients and do everything possible," Abe told reporters in brief remarks aired on NHK public television, which featured the data leak as the evening's top news story.

Separately, Shiozaki apologized for failing to prevent the hacking and told a news conference he had instructed the Japan Pension Service to set top priority on protecting the public's pensions.

Public outrage over botched record-keeping that left millions of pension premium payments unaccounted for was a major factor in a devastating defeat suffered by Abe

[Admin]

U.S. government hacked; feds think China is the culprit
By Kevin Liptak and Theodore Schleifer, CNN
Updated 1331 GMT (2031 HKT) June 5, 2015

Washington (CNN) Four million current and former federal employees, from nearly every government agency, might have had their personal information stolen by Chinese hackers, U.S. investigators said.

U.S. officials believe this could be the biggest breach ever of the government's computer networks. China called the allegation irresponsible.

The Office of Personnel Management, which is conducting background checks, warned it was urging potential victims to monitor their financial statements and get new credit reports.

The breach was initially thought to have impacted the Office of Personnel Management and the Department of Interior, But government officials said nearly every federal government agency was hit by the hackers.

An assessment continues, and it is possible millions more government employees may be affected.

U.S. investigators: We believe this was China's work

U.S. investigators believe they can trace the breach to the Chinese government. Hackers working for the Chinese military are believed to be compiling a massive database of Americans, intelligence officials told CNN on Thursday night.

It is not clear what the purpose of the database is.

The Washington Post and Wall Street Journal first reported Thursday that Chinese hackers were responsible for the breach.

A spokesman from the Chinese Embassy in Washington objected late Thursday to allegations that the Chinese government may be behind the massive hack.

"Cyberattacks conducted across countries are hard to track, and therefore the source of attacks is difficult to identify. Jumping to conclusions and making hypothetical accusation is not responsible and counterproductive," said Zhu Haiquan.

EINSTEIN detection system

Employees of the legislative and judicial branches and uniformed military personnel were not affected.

There are 2.7 million federal executive branch employees. It's unclear whether this affected all of them, along with former employees, or only a portion of them.

The federal personnel office learned of the data breach after it began to toughen its cybersecurity defense system. When it discovered malicious activity, authorities used a detection system called EINSTEIN to eventually unearth the information breach in April 2015, the Department of Homeland Security said.

A month later, the federal agency learned sensitive data had been compromised.

The FBI is investigating what led to the breach.

"We take all potential threats to public and private sector systems seriously and will continue to investigate and hold accountable those who pose a threat in cyberspace," the FBI said in a statement.

The federal personnel office said "personally identifiable information" had been breached, though the office didn't name who might be responsible.

Senator: The breach is 'disturbing'

Senate Homeland Security and Governmental Affairs Chairman Ron Johnson, R-Wisconsin, called the breach "disturbing" and said the Office of Personnel Management needs to do a better job securing its information.

"It is disturbing to learn that hackers could have sensitive personal information on a huge number of current and former federal employees -- and, if media reports are correct, that information could be in the hands of China," Johnson said in a statement. "(The office) says it 'has undertaken an aggressive effort to update its cybersecurity posture.' Plainly, it must do a better job, especially given the sensitive nature of the information it holds."

U.S. Rep. Adam Schiff of California, the top Democrat on the House Intelligence Committee, said hackers are one of the "greatest challenges we face on a daily bases."

"It's clear that a substantial improvement in our cyber databases and defenses is perilously overdue," Schiff said in a statement. "That's why the House moved forward on cybersecurity legislation earlier this year, and it's my hope that this latest incident will spur the Senate to action."

CNN's Evan Perez and Jim Sciutto contributed to this report.

Source: http://edition.cnn.com/2015/06/04/politics/federal-agency-hacked-personnel-management

[Admin]

Online Cheating Site AshleyMadison Hacked
20 July 2015

Large caches of data stolen from online cheating site AshleyMadison.com have been posted online by an individual or group that claims to have completely compromised the company

[Admin]

Pwned websites: Breached websites that have been loaded into this service
https://haveibeenpwned.com/PwnedWebsites

An overview of the various breaches that have been consolidated into this site. Each of these has been dumped publicly and is readily available via various sites on the web.

[Admin]

Singapore online retailer refutes claim that 900k customer accounts breached
Wednesday, Nov 12, 2014

The rebuke comes after online satirical group SMRT Ltd (Feedback) posted a screenshot on Tuesday evening showing a seller who claimed to have the details of 900,000 Zalora customer accounts.


The online vigilante group later clarified that the data breach amounted to 1.49 million Singapore online shopping accounts, of which 400,000 was from Zalora.sg and Reebonz.com.sg each. The remaining 650,000 account details were from Deal.com.sg, SMRT Ltd (Feedback) said.

An hour after SMRT Ltd (Feedback) posted the screenshot, a person claiming to be the Head of Data at Zalora Singapore, Dat Le, commented on the photo, saying that "[Zalora does] not have 900,000 customers in Singapore."

"I have just double checked myself for each of the order_id(s) showed and can confirm that," Dat Le said on his Facebook page.

Zalora.sg posted an official statement on its Facebook page today afternoon denying the data breach.

"We've checked our database log and information and we confirm that the screen capped database that is posted is not our database," Zalora said.

"We would like to assure our online shoppers that we follow a comprehensive personal data protection policy, and our database is secured behind several layers of protection and access control, with detailed audit logs for monitoring."

According to the SMRT Ltd (Feedback) screenshot, the seller claimed to have been selling account information for the past four years, and was asking for $4,500 for the 900,000 account details.

Zalora said in its statement that its customer database "is extremely secure and has never been sold, monetised or shared with third parties."

Source: http://digital.asiaone.com/digital/news/singapore-online-retailer-refutes-claim-900k-customer-accounts-breached

[Admin]

Nanyang Polytechnic computer system hacked, information on 240 alumni leaked
Feb 10, 2015 | Jalelah Abu Baker

SINGAPORE - The personal and bank information of 240 Nanyang Polytechnic alumni have been stolen and leaked online.

Chinese evening daily Lianhe Wanbao reported on Monday that one of the alumni affected, Mr Ho, was informed of the security breach last week through a letter from the school.

The letter says that there was "unauthorised access" into the polytechnic's computer system. According to the letter, names and bank account numbers linked to GIRO payments were copied. It also says that the school has managed to delete the information from the website that carried the leaked information. It is not known which website it was.

Mr Ho is wary although he thinks that nothing can be done using the information stolen.

"If they have the ability to steal these information, they may have the ability to steal even more. The information they released may not be all the information they have," Mr Ho was quoted as saying.

The hackers retrieved information of those who were enrolled between 1994 and 1999, Wanbao reported. The school advised the affected parties to check with the bank on any aunthorised transaction.

Nanyang Polytechnic has reported the matter to the police. In the letter, the school wrote that it takes the matter "very seriously".

"We are conducting a thorough internal investigation and are also working with a leading third party forensics firm to conduct an independent investigation into this matter so as to strengthen our processes and systems," it added.

Source: https://www.straitstimes.com/singapore/nanyang-polytechnic-computer-system-hacked-information-on-240-alumni-leaked

90% of mobile apps could be in breach of S'pore privacy law
Irene Tham, Monday, Nov 02, 2015

Ninety per cent of mobile apps in Singapore do not adequately declare what consumer data is collected or how it is used, potentially falling foul of Singapore's Personal Data Protection Act (PDPA).

Yet, more than half of the mobile apps that people download seek access to swathes of sensitive information, such as users' online and social media identities and location.

This comes from an inaugural study of the privacy policies of 113 popular apps from the Singapore Google Play store.

The sample comprises taxi apps as well as those from banks, telcos, real estate agents and financial advisers.

The three-month study - done jointly by local data protection software-makers Straits Interactive and Appknox - concluded last week.

"Users freely give permission upon installation, without being informed of how their personal information would be used," said Mr Kevin Shepherdson, chief executive officer of Straits Interactive.

The PDPA, implemented fully in July last year, requires organisations to tell consumers what data is collected and what it is used for.

Noted Mr Shepherdson: "As a best practice, app developers need to state clearly within the privacy policy on the app download page what user information is collected and how it will be used."

The PDPA also prohibits organisations from collecting consumer data beyond what is "reasonable".

A calendar app was found to have asked for access to users' location and photos, in what seems to be excessive data collection, said Mr Shepherdson.

Apps from real estate agents and financial advisers also seek access to location, online identities, and even microphone and camera functions.

Most of them do not explain how the data will be used. Mr Ken Chia, principal at law firm Baker & Mckenzie. Wong & Leow, said that excessive data collection may land organisations in hot water.

"They may not realise the privacy implications of their actions and that they may be contravening the Act," he said.

When contacted, the Personal Data Protection Commission, which enforces the Act, urged mobile app developers to review their policies to comply with the law.

"Organisations should only collect, use or disclose personal data for reasonable purposes," a commission spokesman said.

Organisations should also notify and obtain individuals' consent for data collection, unless it is an emergency where the safety of an individual is threatened, he added.

Only 10 per cent of the local apps examined provided comprehensive disclosure, the study found.

Among them is HSBC's mobile banking app. Although the bank requires users to agree to share their location information, it clearly states that the app uses the data to locate nearby branches and ATMs.

Users must also grant the app access to their call logs and device identification. But its privacy policy states this is to let users make calls to HSBC from within the app and for verification purposes.

Lawyer Gilbert Leong, a partner at Rodyk & Davidson, said that most app developers may not be collecting data for nefarious purposes.

He said: "If I am using an app for map directions, it is logical that the app has access to my location information. But ideally, app-makers should give consumers the choice to turn on or off any privacy feature within the app."

Hidden app flaws

The study also found that more than half of mobile apps have either poor encryption or contain vulnerabilities, potentially exposing users' sensitive data to hackers.

For instance, a malicious code can be inserted via the compromised app to control, say, the camera function of the mobile device using the app.

This allows pictures, videos or screenshots to be taken and collected remotely and surreptitiously.

Similarly, mobile numbers can be harvested by app developers for sale to marketers, and by cyber criminals for targeted hacking.

Early last year, a security vulnerability was discovered in Starbucks' mobile app for the iPhone.

The app stores customers' credentials-including the balance in their stored-value account, and transaction history and locations -in a text file that is not encrypted.

An attacker just needs to connect the device to a computer to extract the information from the file system. Starbucks has since patched the security hole.

Source: http://digital.asiaone.com/digital/news/90-mobile-apps-could-be-breach-spore-privacy-law

[Admin]

Singtel app down after software glitch shows details of other customers
1 March 2016 Lester Hio

SINGAPORE - Several Singtel customers were unable to log in to the telco's mobile application on Tuesday morning (March 1), hours after a software glitch on Monday night allowed customers to see the personal information of other customers through the app.

It raised concerns of privacy and account security amongst telco customers, who saidon Singtel's Facebook page on Monday night that, instead of their own account, they were logged into a different account and could view personal details, such as the name and address, of a different customer when they opened their My Singtel app.

The app can be used to check and pay bills, view data usage and re-contract or buy a new phone.

"I think there is a serious breach of account confidentiality and I suspect my account is also being compromised," said Facebook user Wilson Siak.

Some users also reported seeing unusual messages on the app's account information and billing pages, including one insulting Prime Minister Lee Hsien Loong.


The issue continued into Tuesday morning. Customers also reported that they were were unable to log in to the app even after resetting their passwords.

Singtel said in a statement that it had suspended the app after information of one of their customers was "erroneously published due to a software glitch".

"We are still trying to get in touch with the affected customer to apologise and explain," said a Singtel spokesman.

"We would like to assure customers that this is an isolated incident and their account security has not been compromised".

In a statement at 11.45am on Tuesday, Singtel said customers could access the app, with most functions restored.

However, the company is still working to re-activate the app's bills, rewards and e-appointment features.

Source 1: http://www.straitstimes.com/singapore/singtel-app-down-for-users-after-software-glitch-shows-details-of-other-customers
Source 2: http://forums.hardwarezone.com.sg/eat-drink-man-woman-16/singtel-must-come-clean-5313510-4.html

[Admin]

Vast Trove of Travelers

[Admin]

The Panama Papers: what you need to know
What is Mossack Fonseca, how big is it, and who uses offshore firms? Key questions about one of the biggest ever data leaks
Luke Harding Sunday 3 April 2016 16.49 EDT

What is Mossack Fonseca?
It is a Panama-based law firm whose services include incorporating companies in offshore jurisdictions such as the British Virgin Islands. It administers offshore firms for a yearly fee. Other services include wealth management.

Where is it based?
The firm is Panamanian but runs a worldwide operation. Its website boasts of a global network with 600 people working in 42 countries. It has franchises around the world, where separately owned affiliates sign up new customers and have exclusive rights to use its brand. Mossack Fonseca operates in tax havens including Switzerland, Cyprus and the British Virgin Islands, and in the British crown dependencies Guernsey, Jersey and the Isle of Man.

How big is it?
Mossack Fonseca is the world

[Admin]

Megabreach: 55 MILLION voters' details leaked in Philippines
Election officials shrug: Yeah, we were hacked - but not of sensitive info...
7 Apr 2016 at 11:19, John Leyden

A massive data breach appears to have left 55 million Philippine voters at much greater risk of identity fraud and more.

Security researchers warn that the entire database of the Philippines

[Admin]

Singapore penalises [11] firms for data breaches
Government fines organisations and issues warning to several others for breaching the country's Personal Data Protection Act, including local IT retailer Challenger and Chinese handset maker Xiaomi.
By Eileen Yu for By The Way | April 21, 2016 -- 10:03 GMT (18:03 GMT+08:00) | Topic: Security

Several organisations in Singapore have been fined and issued warnings for breaching the country's Personal Data Protection Act (PDPA), including local IT retail chain Challenger Technologies and Chinese handset maker Xiaomi.

The Personal Data Protection Commission (PDPC) said Thursday that it had imposed financial penalties of various amounts to four organisations, which had failed to implement adequate security measures to safeguard the personal data of its customers.

Singapore's PDPA was tabled in 2012 following years of deliberation and came into full effect in July 2014. The act does not apply to the public sector, including government ministries and agencies.

K Box Entertainment Group was fined S$50,000 for its failure to put in place adequate data protection policies and security safeguards as well as not having a data protection officer. The local karaoke chain has a membership of 317,000. Its IT vendor, Finantech Holdings, which was responsible for managing its content management system, also was fined S$10,000.

K Box in September 2014 suffered a data leak when its database was breached by a hacker group, The Knowns, which affected various customer information including e-mail addresses, contact numbers, birth dates, and membership details.

The Institution of Engineers in Singapore as well as Fei Fah Medical Manufacturing were fined S$10,000 and S$5,000, respectively, for their failure to implement sufficient security measures to safeguard the data of their members and customers.

The PDPC issued directives and warnings to seven other organisations, which would need to improve their data protection policies and measures. Challenger was warned about lapses in its handling of personal data, as was retail chain Metro and tuition agency Yestuition Agency. IT vendor Xirlynx Innovations and IT industry group Singapore Computer Society also were found to have less than adequate data management practices.

Tour agency Universal Travel Corporation was issued a directive for unauthorised disclosure of personal data belonging to 37 customers.

Xiaomi's Singapore outfit was instructed to improve its compliance after the PDPC determined the Chinese handset maker had signed up customers for its cloud messaging services by default and without notifying users. Another complaint lodged against Xiaomi for disclosing personal data to third-party marketers without consent was dismissed after the PDPC found the claim to be unsubstantiated.

In deciding on the necessary enforcement actions, the commission said it assessed the severity of non-compliance such as whether the organisations had taken reasonable measures to prevent the data breach and whether they had data protection policies and processes in place. The number of individuals affected as well as time taken to rectify the data breach after it had been identified also were taken into consideration.

PDPC Chairman Leong Keng Thai said: "The enforcement actions taken are not to deter the use of personal data for business competitiveness [as] we recognise that data is essential for innovation in today's economy. The key is to use it responsibly and take appropriate actions to protect it.

"Both the organisation and its data intermediary, such as IT vendors that provide systems and data management solutions to businesses, are expected to exercise due care and implement adequate security measures," Leong explained.

Since the act came into effect, the commission had received 667 compliances, of which 92 percent were resolved through investigation and facilitation between the organisations and individuals.

Source: http://www.zdnet.com/article/singapore-penalises-firms-for-data-breaches/