Knowledge Repository
Wiki Board (Public) => Information and Communications Technology (ICT) => Topic started by: Admin on April 05, 2014, 09:38:24 PM
-
Websites:
- Personal Data Protection Commission Singapore: http://www.pdpc.gov.sg (http://www.pdpc.gov.sg)
- Do Not Call (DNC) Registry: http://www.dnc.gov.sg (http://www.dnc.gov.sg)
- Data Protection FAQ: https://www.pdpc.gov.sg/FAQ-Listing (https://www.pdpc.gov.sg/FAQ-Listing)
- Data Protection Enforcement Cases (Grounds of Decision): https://www.pdpc.gov.sg/Commissions-Decisions (https://www.pdpc.gov.sg/Commissions-Decisions)
- DPO Connect Newsletter: https://www.pdpc.gov.sg/Help-and-Resources/2015/06/dpo-connect-e-newsletter (https://www.pdpc.gov.sg/Help-and-Resources/2015/06/dpo-connect-e-newsletter)
Introduction to PDPA in Singapore
Layman Introduction to PDPA in Singapore: Your Personal Data, Your Choice
DNC: ERA & Spidergate (Jan 2015)
Do Not Call sign-up begins for public (2 Dec 2013)
CNA Interview on "Personal Data Protection Act - The Do Not Call Registry" with Rajah & Tan LLP
Book: "Data Protection Law in Singapore -- Privacy and Sovereignty in an Interconnected World"
New exemption order under Do Not Call Registry (26 Dec 2013)
Ms. Sheena Jacob's commentary on PDPA
Do Not Call Registry for Organisations (updated 2017)
Do Not Call Registry for Consumers (updated 2017)
Sector Specific Advisory Guidelines- Telecommunication Sector (published on 16 May 2014)
- Real Estate Agency Sector (published on 16 May 2014)
- Education Sector (updated on 25 April 2024 / 31 Aug 2018 / published on 11 Sep 2014)
- Healthcare Sector (updated on 20 September 2023 / published on 11 Sep 2014)
- Social Service Sector (updated on 18 January 2024 / published on 11 Sep 2014)
- Code of Practice for Life Insurers (published on 1 Apr 2015)
- Code of Conduct for Tied Agents of Life Insurers (published on 1 Apr 2015)
- Advisory Guidelines on In-vehicle Recordings by Transport Services for Hire (updated 22 May 2018)
- Advisory Guidelines for Management Corporations (updated on 17 May 2022 / published 11 March 2019)
Source: https://www.pdpc.gov.sg/Guidelines-and-Consultation?type=sector-specific-advisory-guidelines%7Cindustry-led-guidelines&keyword=&topic=all&page=1 (https://www.pdpc.gov.sg/Guidelines-and-Consultation?type=sector-specific-advisory-guidelines%7Cindustry-led-guidelines&keyword=&topic=all&page=1)
-
Google fined over Street View cars
Italy fines Google for not clearly labelling its Street View cars as belonging to the US tech giant
By agencies | 3 Apr 2014
Google has paid a €1m (£830,000) fine imposed by Italy's data protection watchdog over complaints that its Street View cars were not clearly recognisable.
"Cars belonging to the giant of Mountain View roamed Italy's streets without being entirely recognisable as such, therefore not allowing the people present in those places to decide whether to be photographed or not," the regulator said in a statement, referring to Google's base at Mountain View in California.
Google has faced numerous privacy lawsuits in the US and Europe relating to services including Street View, which gives a panoramic perspective on streets around the world.
"The fine from the DPA relates to an old case that dates back to 2010. We complied with everything the [regulator] required of us at the time," a Google spokeswoman said.
The fine relates only to vehicles not being labelled clearly enough. The watchdog has also reported to Italy's judicial authorities that Google accidentally captured fragments of electronic communications as part of its mapping research in the country.
Google did not respond to Reuters' requests for comment.
In September 2013, a US federal appeals court rejected Google's bid to dismiss a lawsuit accusing it of violating federal wiretap law when its accidentally collected personal data while building Street View.
Google was also fined €145,000 last year by a privacy regulator in Germany for inadvertently intercepting emails, user names, passwords and other data from Wi-Fi networks while taking photographs for Street View and decided not to contest the fine.
Imposing its higher fine on Thursday, the Italian watchdog said it took into account the search engine operator's "consolidated revenue of over $50bn".
It also said Google had promptly adopted the measures it requested, including clearly marking the cars used to collect footage, and broadcasting details of the areas the cars would visit on its own website and in local media.
Source: https://www.telegraph.co.uk/finance/newsbysector/mediatechnologyandtelecoms/digital-media/10743643/Google-fined-over-Street-View-cars.html
-
14 February 2014 | For Immediate Release
PDPC takes action against organisations for breaching Do Not Call Registry Requirements under the Act
The PDPC will continue to help organisations comply with the Do Not Call provisions through briefings, workshops and advisory guidelines
The Personal Data Protection Commission (“PDPC”) has censured multiple organisations for breaching the Do Not Call (“DNC”) Registry requirements under the Personal Data Protection Act (“PDPA”).
Investigations have been taken in response to 1500 valid complaints from the public on 580 organisations since the DNC provisions took effect on 2 Jan 2014 and the PDPC had commenced taking enforcement action. The organisations are from sectors such as private education, property, banking & finance, retail, insurance and telecommunications. Complaints relating to suspected unlicensed money-lending activities have also been referred to the Police.
At present, PDPC is investigating a recalcitrant organisation, with a view to prosecution, as it has continued to send multiple unsolicited telemarketing messages to numbers listed in the DNC Registry despite being notified by the PDPC.
PDPC has offered to compound the offences against at least two other organisations for between $500 and $1,000, while more than a hundred other organisations had been issued notices of warning in lieu of prosecution. Additional offers of composition and notices of warning will be issued over the next few weeks.
In considering the appropriate enforcement action to be taken in each case, the PDPC takes into account various factors including the seriousness of the breach, whether the sending of unsolicited telemarketing messages were isolated incidents, the number of complaints against the organisation and whether the organisation had been co-operative after being informed by the PDPC to stop sending such unsolicited telemarketing messages.
The PDPC is closely monitoring compliance with the DNC provisions and will not hesitate to take any necessary enforcement action it deems fit against organisations that do not comply with the PDPA.
“The PDPC will not hesitate to take enforcement action against errant organisations,” said Mr Leong Keng Thai, Chairman, PDPC, “In addition, we will continue to reach out to organisations to ensure that they understand how to comply with the PDPA so that both organisations and consumers will be able to benefit from telemarketing best practices.”
More organisations have been looking to comply with the DNC requirements. Since 2 Jan 2014, another 1,300 organisations have registered with the DNC Registry, bringing the total number of registered organisations to 1,800. These organisations have since performed checks on more than 55 million telephone numbers.
The PDPC will continue to conduct workshops and briefings to help organisations and their data protection officers develop personal data protection capabilities and build on their knowledge of the PDPA, including compliance with the DNC provisions. So far, about 10,000 people have attended these outreach events. Sector-specific advisory guidelines will also be issued, where necessary, to provide clarity to organisations on how the PDPA would apply to sectors with unique sector-specific scenarios.
Individuals who wish to lodge a complaint to the PDPC, or organisations which would like to find out more about compliance with the PDPA should write to info@pdpc.gov.sg. PDPC would also like to seek the public’s cooperation in providing more information to assist into investigations when required. Separately, individuals are advised not to respond to messages on illegal activities such as unlicensed money-lending, and to report such cases to the Police.
ISSUED BY THE PERSONAL DATA PROTECTION COMMISSION
About Personal Data Protection Commission
The PDPC administers the Personal Data Protection Act 2012 in Singapore, which aims to safeguard individuals’ personal data against misuse and promote proper management of personal data in organisations. In addition, the Act will enhance Singapore’s competitiveness and strengthen our position as a trusted business hub, putting Singapore on par with the growing list of countries with data protection laws. For more information, please visit www.pdpc.gov.sg.
For media queries, please contact:
Mr Kenneth Tan Manager, Media Relations, Personal Data Protection Commission c/o IDA Singapore Tel: 6211 1600 E-mail: kenneth_tan@ida.gov.sg
Mr Aaron Tan Manager, Media Relations, Personal Data Protection Commission c/o IDA Singapore Tel: 6211 1805 E-mail: aaron_tan@ida.gov.sg
Source: https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Press-Room/2014/media-release-for-pdpc-enforcement-action-(140214).pdf
-
Credit card applications: Set guidelines to safeguard data
The Straits Times
Tuesday, Apr 15, 2014
On Dec 31 last year, I signed up for an OCBC Bank credit card at a booth in a department store.
The application process was quick, with a sales staff member making copies of my identity card and tax and Central Provident Fund statements on the spot. I was told that the card would be mailed to me once the application was approved.
After a few weeks, I called the bank to check on my application status.
To my dismay, the bank could not find my application in its computer system. I was alarmed that the personal data I submitted had been lost.
An investigation officer conducted further checks, but after months, the bank was still unable to find my documents.
In the end, I was offered a shopping voucher as compensation, which I refused.
It is unacceptable for the bank to misplace my personal data. That information could have been used for criminal activities.
The authorities should introduce guidelines to protect customers' personal data.
Nicolas Leong
http://news.asiaone.com/news/mailbox/credit-card-applications-set-guidelines-safeguard-data (http://news.asiaone.com/news/mailbox/credit-card-applications-set-guidelines-safeguard-data)
________________________________________________________________
Organisations required to protect personal data
Published on Apr 18, 2014 1:20 AM
I REFER to Mr Nicolas Leong's letter ("Credit card applications: Set guidelines to safeguard data"; Sunday).
On July 2, the data protection provisions of the Personal Data Protection Act will come into force.
Under the "protection obligation" of the Act, organisations are required to make reasonable security arrangements to protect personal data in their possession or under their control, in order to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks.
Organisations collecting personal data should review their business processes to ensure compliance with the Act by July 2, which will also help them build the trust of their customers when collecting, using and disclosing personal data.
If the Personal Data Protection Commission finds an organisation in breach of any of the data protection provisions in the Act, it may require the organisation to pay a financial penalty of up to $1 million and undertake rectification measures.
Evelyn Goh (Ms)
Director, Communications, Planning & Policy
Personal Data Protection Commission
http://www.straitstimes.com/premium/forum-letters/story/organisations-required-protect-personal-data-20140418 (http://www.straitstimes.com/premium/forum-letters/story/organisations-required-protect-personal-data-20140418)
-
(http://tralvex.com/download/forum/PDPA_9obligations.gif)
source: http://www.pdpc.gov.sg/docs/default-source/publications-edu-materials/pdpc-corporate-brochure.pdf?sfvrsn=0 (http://www.pdpc.gov.sg/docs/default-source/publications-edu-materials/pdpc-corporate-brochure.pdf?sfvrsn=0)
-
EU court says Google must remove links to personal data if it's asked to
BY Matt Brian @m4tt May 13th 2014, at 7:01:00 am ET 28
http://www.engadget.com/2014/05/13/european-court-google-delete-links-personal-data/ (http://www.engadget.com/2014/05/13/european-court-google-delete-links-personal-data/)
Google's recent run of bad luck in Europe has reached new heights after it was told it must take down links to personal information found in its search results. The Court of Justice of the European Union (ECJ) today ruled that Google should be made responsible for processing links to personal data which appears on third-party websites, so it must allow users to request that outdated or irrelevant information be removed. Google has long argued that such a ruling amounts to censorship, but Europe's top court agrees with the European Commission's belief that people should have the "right to be forgotten."
The ruling came after a Spanish man complained to local regulators that Google had indexed an auction notice on his home from 1998. Google refused to delete the information, so the ECJ was asked to step in. Although today's ruling has not yet been passed into law, the court says users who want to remove their name from search providers' results can "approach the operator directly and, where the operator does not grant his request, bring the matter before the competent authorities in order to obtain, under certain conditions, the removal of that link from the list of results." We've reached out to Google for comment and will report back once we receive a response.
(http://www.mobiadnews.com/wp-content/uploads/2010/12/eu-icon.gif)
-
Tuition agency first to be charged with breaching DNC Registry laws
May 24, 2014
SINGAPORE — A recalcitrant tuition agency — which has had a few hundred complaints lodged against it for spamming — and its director will be the first to be charged under the Personal Data Protection Act with breaching the Do Not Call (DNC) Registry requirements.
Star Zest Home Tuition and its director will be charged separately in the State Courts on June 4, each facing up to 37 counts of contravening Section 43(1) of the Act.
Under the section, organisations or individuals are obliged to check the DNC Registry before sending any telemarketing messages to Singapore telephone numbers. If found guilty, the agency and the director can each be fined up to S$10,000 per message sent.
In a press release yesterday, the Personal Data Protection Commission (PDPC) said two other organisations have accepted offers to compound their offences — the composition amounts were between S$500 and S$1,000 — in lieu of prosecution.
A spokesperson said these organisations were cooperative, had stopped sending unsolicited telemarketing messages after they were contacted and had reviewed their telemarketing practices to comply with the Act. Should either of them breach the DNC provisions again, the commission will consider further enforcement.
About 380 other organisations were warned after the PDPC received a small number of isolated complaints against them.
Since the DNC Registry took effect on Jan 2, the PDPC has investigated 3,700 valid complaints from members of the public against 630 organisations. These organisations were from sectors such as property, tuition and insurance. The commission said complaints relating to suspected unlicensed money-lending activities have been referred to the police.
Star Zest, which was founded in 1999, provides middleman services, matching private tutors to students from Kindergarten One to university levels.
The PDPC said the agency sent out unsolicited messages offering the teaching services of various tutors on its books. The commission added that it conducted extensive inquiries during its investigations. “With the assistance of members of the public, the commission established the identities of the tuition agency and its director,” said the PDPC.
When contacted, the agency’s director, Mr Law, who requested that his full name be withheld, claimed he had overlooked the rules in the DNC Registry and had mistakenly thought the rules would take effect in February.
Mr Law said he was contacted by the commission some time in January. Thereafter, he tried to comply with the rules by checking his database of telephone numbers against the registry. However, he claimed that telemarketing messages were automatically sent to some numbers before he could finish checking the database.
“I regret (what happened) because I didn’t read the rules carefully,” said Mr Law. He said the agency’s database contains the telephone numbers of about 100,000 parents and about 40,000 tutors.
PDPC chairman Leong Keng Thai reiterated that the commission is serious about compliance with the DNC requirements. It will continue to monitor compliance with the requirements in the PDPA, including those relating to data protection, once the Act is fully in force on July 2, Mr Leong added.
While the provisions relating to the DNC Registry have come into effect, the main data protection rules — including the need for firms to seek consent before collecting and using people’s private information — will kick in later to allow time for organisations to review and adopt internal polices and practices.
Source: https://www.todayonline.com/singapore/tuition-agency-first-be-charged-breaching-dnc-registry-laws
Archive: https://archive.fo/LUu1U
-
Singapore: Personal Data Protection Act 2012
https://sso.agc.gov.sg/Act/PDPA2012 (http://statutes.agc.gov.sg/aol/search/display/view.w3p;page=0;query=Id%3A%224f5d4c85-dd26-4368-8736-7ef70b1b7227%22%20Status%3Apublished;rec=0#legis)
Brunei: Personal Data Protection Order
https://www.aiti.gov.bn/regulatory/pdp (https://www.aiti.gov.bn/regulatory/pdp)
Japan: Act on the Protection of Personal Information
https://www.ppc.go.jp/en/legal/
(https://www.ppc.go.jp/en/legal/)
Korea: Personal Data Protection Laws
https://www.privacy.go.kr/front/contents/cntntsView.do?contsNo=36
(https://www.privacy.go.kr/eng/about_us.do)
USA: Privacy Act
https://www.justice.gov/opcl/privacy-act-1974 (https://www.justice.gov/opcl/privacy-act-1974)
Canada: Privacy Act
https://www.priv.gc.ca/leg_c/r_o_a_e.asp (https://www.priv.gc.ca/leg_c/r_o_a_e.asp)
European Union General Data Protection Regulation (2018)
https://gdpr-info.eu/ (https://ec.europa.eu/commission/priorities/justice-and-fundamental-rights/data-protection/2018-reform-eu-data-protection-rules_en)
Australia: Privacy Act of 1988
https://www.oaic.gov.au/privacy/the-privacy-act (https://www.oaic.gov.au/privacy/the-privacy-act)
United Kingdom: Data Protection Act 2018
https://www.gov.uk/government/collections/data-protection-act-2018 (https://www.gov.uk/government/collections/data-protection-act-2018)
Privacy related Acts (other countries)- 80+ countries: https://securiti.ai/privacy-laws (https://securiti.ai/privacy-laws)
- 54 countries (cache): http://web.archive.org/web/20160324102513/http://www.informationshield.com/intprivacylaws.html (http://web.archive.org/web/20160324102513/http://www.informationshield.com/intprivacylaws.html)
- 32 countries: http://en.wikipedia.org/wiki/Privacy_law (http://en.wikipedia.org/wiki/Privacy_law)
China: 中华人民共和国网络安全法 (https://zh.wikisource.org/wiki/%E4%B8%AD%E5%8D%8E%E4%BA%BA%E6%B0%91%E5%85%B1%E5%92%8C%E5%9B%BD%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8%E6%B3%95) | English translation (https://zh-wikisource-org.translate.goog/wiki/%E4%B8%AD%E5%8D%8E%E4%BA%BA%E6%B0%91%E5%85%B1%E5%92%8C%E5%9B%BD%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8%E6%B3%95?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp)
-
Privacy Policy by Industry
- Automotive & Tpt
- Banking
- Education
- Food & Beverage
- Finance & Insurance
- Government & related
- Healthcare & Medical
- Hotel
- Human Resource & Recruitment
- Investment
- Manufacturing
- Telecommunication
- Travel related
- Real Estate
- Religious
- Sports & Wellness
- Voluntary Welfare Organizations
- Other Industries
- Minimalist
- Special Organisations
Legend for the Privacy Policy links below:
* is where the privacy policy is more extensive than the others (within the same industry)
** means even more extensive, among all other industries
#n means the company appeared in the Mediacorp TV series (n refers to the episode) "Your Personal Data, Our Responsibility (https://www.youtube.com/watch?v=-ADreql4aIA)"
Automotive
Volkswagen: https://www.volkswagen.com.sg/need-help/privacy-policy (https://www.volkswagen.com.sg/need-help/privacy-policy)
BMW: https://www.bmw.com.sg/en/footer/metanavigation/privacy-policy-pool/privacy-policy.html (https://www.bmw.com.sg/en/footer/metanavigation/privacy-policy-pool/privacy-policy.html)
Toyota: http://www.toyotasingapore.com.sg/privacy-policy (http://www.toyotasingapore.com.sg/site_tools/privacy.aspx)
iCarsclub: http://www.icarsclub.com/privacy-policy (http://www.icarsclub.com/privacy-policy)
Leco: http://www.lecoprestige.com/index.php?page=privacy (http://www.lecoprestige.com/index.php?page=privacy)
Mercedes-Benz: http://www.mercedes-benz.com.sg/content/singapore/mpc/mpc_singapore_website/enng/home_mpc/orivacy_statement.ngrb.html (http://www.mercedes-benz.com.sg/content/singapore/mpc/mpc_singapore_website/enng/home_mpc/orivacy_statement.ngrb.html)
Audi: https://www.myaudiworld.sg/privacy-policy (https://www.myaudiworld.sg/privacy-policy)
Quotz: http://www.quotz.com.sg/main/privacy.php (http://www.quotz.com.sg/main/privacy.php)
ComfortDelgro Driving Centre: http://www.cdc.com.sg/PDPPolicy.htm (http://www.cdc.com.sg/PDPPolicy.htm)
Grabtaxi: https://www.grab.com/sg/privacy/ (https://www.grab.com/sg/privacy/)
Banking and related
**OCBC: https://www.ocbc.com/personal-banking/policies.html (https://www.ocbc.com/personal-banking/policies.html)
*HSBC: https://www.hsbc.com.sg/privacy-statement/ (http://edusg.us/forumsmf/index.php/topic,338.msg2154.html#msg2154)
#1 DBS: https://www.dbs.com/privacy/default.page (https://www.dbs.com/privacy/default.page)
UOB: http://uob.com.sg/privacy/index.html (http://uob.com.sg/privacy/index.html)
Standard Chartered: https://www.sc.com/sg/priority/en/dataprotection.html (https://www.sc.com/sg/priority/en/dataprotection.html)
Credit Bureau Singapore: http://www.creditbureau.com.sg/privacy-policy-terms-of-use (http://www.creditbureau.com.sg/privacy-policy-terms-of-use)
Hitachi Capital Asia Pacific (Policy; Terms & Conditions): http://www.hitachi-capital.com.sg/apply/inquiry11.html (http://www.hitachi-capital.com.sg/apply/inquiry11.html)
Education
**SUSS: https://www.suss.edu.sg/privacy-statement (https://www.suss.edu.sg/privacy-statement)
**ISCA: https://isca.org.sg/privacy-and-data-protection-policy (https://isca.org.sg/privacy-and-data-protection-policy)
**NTUC Learning Hub: https://www.ntuclearninghub.com/personal-data-privacy-statement (https://www.ntuclearninghub.com/personal-data-privacy-statement)
**IP Academy (covering 3 subsidaries): https://ipacademy.iposinternational.com/data-protection/ (https://ipacademy.iposinternational.com/data-protection/)
#2 Modern Montessori International: http://modern-montessori.com/wp-content/uploads/2018/07/MMI-Data-Protection-ePolicy.pdf (http://modern-montessori.com/wp-content/uploads/2018/07/MMI-Data-Protection-ePolicy.pdf)
NUS: http://www.nus.edu.sg/registrar/adminpolicy/student-privacy-policy.html (http://www.nus.edu.sg/registrar/adminpolicy/student-privacy-policy.html)
NUS Enterprise: http://enterprise.nus.edu.sg/personal-data-protection-notice (http://enterprise.nus.edu.sg/personal-data-protection-notice)
Kaplan: http://www.kaplan.com.sg/about/terms-of-use (http://www.kaplan.com.sg/about/terms-of-use)
SIM: http://www.sim.edu.sg/about-sim/pages/dataprivacy.aspx (http://www.sim.edu.sg/Pages/Terms-of-Use.aspx)
Singapore Media Academy: http://www.mediaacademy.sg/ (http://www.mediaacademy.sg/)
Singapore Flying College: http://www.sfcpl.com/privacy-policy (http://www.sfcpl.com/privacy-policy)
ITE College Central @ AMK: http://imice.sg/ite-college-central-at-amk/privacy-policy (http://imice.sg/ite-college-central-at-amk/privacy-policy)
Eton House: http://www.etonhouse.com.sg/schools/singapore-international-school/55-uncategorised.html (http://www.etonhouse.com.sg/schools/singapore-international-school/55-uncategorised.html)
Kumon: http://sg.kumonglobal.com/page.jsp?id=815&version=sg (http://sg.kumonglobal.com/page.jsp?id=815&version=sg)
PAP Community Foundation: http://www.pcf.org.sg/Contact-Us/HQ-Address/Privacy-Policy/Content (http://www.pcf.org.sg/Contact-Us/HQ-Address/Privacy-Policy/Content)
Kinderland Educare Services Pte. Ltd.: http://kinderland.com.sg/privacy-policy (http://kinderland.com.sg/privacy-policy)
Food & Beverage
**JUMBO: http://www.jumbogroup.sg/privacy-policy (http://www.jumbogroup.sg/privacy-policy)
Fortune Food: http://www.fortunefood.com.sg/privacy.asp (http://www.fortunefood.com.sg/privacy.asp)
Nescafe Dolce Gusto: https://www.dolce-gusto.com.sg/EN/global/Pages/TermsandConditions.aspx (https://www.dolce-gusto.com.sg/EN/global/Pages/TermsandConditions.aspx)
Asia Pacific Breweries: http://www.apbsingapore.com.sg/privacypolicy/?age-verified=5545381ba2 (http://www.apbsingapore.com.sg/privacypolicy/?age-verified=5545381ba2)
Chili's: http://www.chilistogo.sg/privacy.php (http://www.chilistogo.sg/privacy.php)
Si Chuan Dou Hua Restaurant: http://www.sichuandouhua.com/Pages/Privacy.aspx (http://www.sichuandouhua.com/Pages/Privacy.aspx)
Affligem Beer: http://www.affligembeer.com/Age%20Gateway/Age%20Gateway?returnurl=%2f (http://www.affligembeer.com/Age%20Gateway/Age%20Gateway?returnurl=%2f)
redmart: http://about.redmart.com/privacy (http://about.redmart.com/privacy)
Finance & Insurance
*DirectAsia.com: https://www.directasia.com/security-privacy (https://www.directasia.com/security-privacy)
*AIA: http://www.aia.com.sg/en/index/personal-data-policy.htm
(http://www.aia.com.sg/en/index/personal-data-policy.html)*NTUC Income: https://www.income.com.sg/privacy-policy (https://www.income.com.sg/privacy-policy)
NETS: http://www.nets.com.sg/data-protection-policy
(http://www.nets.com.sg/data-protection-policy)IPP: http://www.ippfa.com/privacypolicy.htm (http://www.ippfa.com/privacypolicy.html)l
(http://www.ippfa.com/privacypolicy.html)Pure Commerce: http://www.pure-commerce.com/en/privacy-policy (http://www.pure-commerce.com/en/privacy-policy)
Great Eastern: http://www.greateasternlife.com/sg/en/pncpolicies.htm
(http://www.greateasternlife.com/sg/en/pncpolicies.htm)PIAS: http://www.proinvest.com.sg/about-pias/pdpa (http://www.proinvest.com.sg/about-pias/pdpa)
Aviva: http://www.aviva.com.sg/pdpa/notice-of-purposes (http://www.aviva.com.sg/pdpa/notice-of-purposes)
First Meta Exchange: https://firstmetaexchange.com/info/policy (https://firstmetaexchange.com/info/policy)
Robbiehood Capital: http://www.robbiehood.com/privacy-policy (http://www.robbiehood.com/privacy-policy)
Government & related
**IP Office of Singapore: https://www.ipos.gov.sg/data-protection-policy (https://www.ipos.gov.sg/data-protection-policy)
**SAFRA (pdf (http://www.safra.sg/~/media/PDFs/SAFRA%20%20Privacy%20Policy%2018%20June%202014.ashx), cache (http://goo.gl/5TQaYb)): https://www.safra.sg/privacy-policy
(http://www.safra.sg/privacypolicy)*NLB: http://www.nlb.gov.sg/PrivacyStatement.aspx
(http://www.nlb.gov.sg/PrivacyStatement.aspx)A*STAR: https://www.a-star.edu.sg/privacy-statement.aspx (https://www.a-star.edu.sg/privacy-statement.aspx)
MAS: http://www.mas.gov.sg/privacy-statement.aspx (http://www.mas.gov.sg/privacy-statement.aspx)
Onemotoring (NCS): http://www.onemotoring.com.sg/publish/onemotoring/en/bottomwebwide/privacy_statement.html
(http://www.onemotoring.com.sg/publish/onemotoring/en/bottomwebwide/privacy_statement.html)Onemotoring (MSI): http://www.onemotoring.com.sg/publish/onemotoring/en/bottomwebwide/msi_privacy_statement.html (http://www.onemotoring.com.sg/publish/onemotoring/en/bottomwebwide/msi_privacy_statement.html)
NS.sg (NCS): http://www.ns.sg/nsp/web/content/footer/portal-priv-state?_afrLoop=1020668513090896&_afrWindowMode=0&_afrWindowId=null#%40%3F_afrWindowId%3Dnull%26_afrLoop%3D1020668513090896%26ucontent%3Dhttp%253A%252F%252Fwww.ns.sg%252Fcs%252Fgroups%252Fpublic%252Fdocuments%252Fhtmlcontent%252Fmdaw%252Fmda0%252F%257Eedisp%252Ffooter_portal-priv-state.html%26_afrWindowMode%3D0%26_adf.ctrl-state%3D17dnrabwiy_9 (http://www.ns.sg/nsp/web/content/footer/portal-priv-state?_afrLoop=1020668513090896&_afrWindowMode=0&_afrWindowId=null#%40%3F_afrWindowId%3Dnull%26_afrLoop%3D1020668513090896%26ucontent%3Dhttp%253A%252F%252Fwww.ns.sg%252Fcs%252Fgroups%252Fpublic%252Fdocuments%252Fhtmlcontent%252Fmdaw%252Fmda0%252F%257Eedisp%252Ffooter_portal-priv-state.html%26_afrWindowMode%3D0%26_adf.ctrl-state%3D17dnrabwiy_9)
CHAS Online: https://pcps.gpcare.sg/Contents/Privacy.aspx (https://pcps.gpcare.sg/Contents/Privacy.aspx)
Healthcare & Medical
** SingHealth: https://www.singhealth.com.sg/Documents/20180917-singHealth-grp-data-protection-policy-v10.pdf (https://www.singhealth.com.sg/Documents/20180917-singHealth-grp-data-protection-policy-v10.pdf)
*Omron: http://www.omronhealthcare-ap.com/privacy_policy.html (http://www.omronhealthcare-ap.com/privacy_policy.html)
*Pfizer: http://www.pfizer.com.sg/privacystatement (http://www.pfizer.com.sg/privacystatement)
#1 TTSH (4 languages): https://www.ttsh.com.sg/Pages/NHG-Personal-Data-Protection-Policy.aspx (https://www.ttsh.com.sg/Pages/NHG-Personal-Data-Protection-Policy.aspx) (cache (https://is.gd/dppttsh))
NUH: http://www.nuhs.edu.sg/personal-data-protection.html (http://www.nuhs.edu.sg/personal-data-protection.html)
Specialist Dental Group: http://www.specialistdentalgroup.com/privacy-policy/ (http://www.specialistdentalgroup.com/privacy-policy/)
MammoCare: http://www.mammocare.com.sg/privacy_policy.php (http://www.mammocare.com.sg/privacy_policy.php)
Renewal Aesthetic: http://renewalaesthetics.com/privacy-policy (http://renewalaesthetics.com/privacy-policy)
Durex: http://www.durex.com.sg/privacy-statement (http://www.durex.com.sg/privacy-statement)
SacuraLife: http://www.sacuralife.com/privacy (http://www.sacuralife.com/privacy)
MyDoc: http://www.my-doc.com/privacy (http://www.my-doc.com/privacy)
Raffles Medical Group: https://www.rafflesmedicalgroup.com/raffles-medical-group/our-group/terms-and-conditions-of-use (https://www.rafflesmedicalgroup.com/raffles-medical-group/our-group/terms-and-conditions-of-use)
Hotel
*Marina Bay Sands: https://www.marinabaysands.com/privacy-policy.html (https://www.marinabaysands.com/privacy-policy.html)
Bliss Hotel: http://www.blisshotel.com.sg/privacy (http://www.blisshotel.com.sg/privacy)
Millennium Hotels and Resorts: http://www.millenniumhotels.com/utilities/privacy-policy.html (http://www.millenniumhotels.com/utilities/privacy-policy.html)
Carlton: http://carltonhotel.sg/privacy.html (http://carltonhotel.sg/privacy.html)
Royal Plaza on Scotts: http://www.royalplaza.com.sg/personal-data-protection-policy (http://www.royalplaza.com.sg/personal-data-protection-policy)
Gallery: http://www.galleryhotel.com.sg/privacy.html (http://www.galleryhotel.com.sg/privacy.html)
M Hotel: http://www.millenniumhotels.com/utilities/privacy-policy.html (http://www.millenniumhotels.com/utilities/privacy-policy.html)
Raffles Hotel: http://www.raffles.com/terms-of-use (http://www.raffles.com/terms-of-use)
Hotel 81: http://www.hotel81.com.sg/privacypolicy.html (http://www.hotel81.com.sg/privacypolicy.html)
Human Resource & Recruitment
**Jobstreet: http://www.jobstreet.com.sg/privacy-policy.htm (http://www.jobstreet.com.sg/privacy-policy.htm)
JobsDB: http://sg.jobsdb.com/SG/en/StaticContentContainer/PrivacyPolicy.htm (http://sg.jobsdb.com/SG/en/StaticContentContainer/PrivacyPolicy.htm?utm_campaign=privacy_statement_june2014&utm_source=email&utm_medium=edm&utm_content=edm_link)
JobsCentral: http://jobscentral.com.sg/privacy.php (http://jobscentral.com.sg/privacy.php)
Monster: http://www.monster.com.sg/privacy.html (http://www.monster.com.sg/privacy.html)
STJobs: http://www.stjobs.sg/info/privacy.html (http://www.stjobs.sg/info/privacy.html)
IoTalents: http://www.iotalents.com/legal/policy (http://www.iotalents.com/legal/policy)
Investment
**Walton: https://sg.waltoninternational.com/privacy-policy (https://sg.waltoninternational.com/privacy-policy)
*Fundsupermart: https://secure.fundsupermart.com/fsm/fsm/privacy-policy (https://secure.fundsupermart.com/fsm/fsm/privacy-policy)
Acadian Asset Management: http://www.acadian-asset.com/en/Disclaimer.aspx (http://www.acadian-asset.com/en/Disclaimer.aspx)
Standard Life: https://www.standardlife.sg/main/privacy_stat.aspx?module_id=MO04&func_id=FN040101&login_from=&lang=en (https://www.standardlife.sg/main/privacy_stat.aspx?module_id=MO04&func_id=FN040101&login_from=&lang=en)
Shenton Wealth: http://www.shentonwealth.com/privacy-policy.php (http://www.shentonwealth.com/privacy-policy.php)
Jardin Smith International: http://www.jsi.com.sg/PrivacyPolicy.html (http://www.jsi.com.sg/PrivacyPolicy.html)
GIC: http://www.gic.com.sg/en/privacy-policy (http://www.gic.com.sg/en/privacy-policy)
Legg Mason: http://www.leggmason.com.sg/en/privacy_policy/index.aspx (http://www.leggmason.com.sg/en/privacy_policy/index.aspx)
Manufacturing
Tetrapak: https://www.tetrapak.com/en-sg/about-tetra-pak/legal-information (https://www.tetrapak.com/en-sg/about-tetra-pak/legal-information)
Micron Semiconductor: https://www.micron.com/privacy (https://www.micron.com/privacy)
Yeo Hiap Seng: https://yeos.com.sg/about-us/pdpa/ (https://yeos.com.sg/about-us/pdpa/)
ExxonMobil: https://www.exxonmobil.com.sg/legal-pages/privacy-statement (https://www.exxonmobil.com.sg/legal-pages/privacy-statement)
Flex: https://flex.com/company/policies/privacy-policy (https://flex.com/company/policies/privacy-policy)
Olam Group: https://www.olamgroup.com/privacy.html (https://www.olamgroup.com/privacy.html)
Venture: https://www.venture.com.sg/wp-content/uploads/2018/07/Venture-PDP-Policy_25May2018.pdf (https://www.venture.com.sg/wp-content/uploads/2018/07/Venture-PDP-Policy_25May2018.pdf)
Telecommunication
**Starhub: http://www.starhub.com/about-us/legal-notices-and-terms/personal-data-protection/personal-data-protection-policy.html (http://www.starhub.com/about-us/legal-notices-and-terms/personal-data-protection/personal-data-protection-policy.html)
**Singtel: https://www.singtel.com/data-protection (https://www.singtel.com/data-protection)
*M1: https://www.m1.com.sg/~/media/Files/M1Portal/Personal/M1DataProtectionPolicy.ashx (https://www.m1.com.sg/dataprotection)
NetLinkTrust (https://www.singtel.com/data-protection): http://netlinktrust.com/privacy-policy.html (http://netlinktrust.com/privacy-policy.html)
CityNet: http://www.citynetlink.com.sg/index.php/component/content/article/10 (http://www.citynetlink.com.sg/index.php/component/content/article/10)
Y5Zone: http://y5zone.sg/starbucks/privacy-policy/ (http://y5zone.sg/starbucks/privacy-policy/)
Travel related
**Singapore Airlines: https://www.singaporeair.com/en_UK/privacy-policy (https://www.singaporeair.com/en_UK/privacy-policy)
*Cathay Pacific: http://www.cathaypacific.com/cx/en_SG/legal-and-privacy/data-privacy-and-security-policy.html (http://www.cathaypacific.com/cx/en_SG/legal-and-privacy/data-privacy-and-security-policy.html)
#2 Chan Brothers: https://www.chanbrothers.com/privacy-policy (https://www.chanbrothers.com/privacy-policy)
CWT Carlson Wagonlit Travel: http://www.carlsonwagonlit.sg/en/dataprotection.html (http://www.carlsonwagonlit.sg/en/dataprotection.html)
ZUJI: http://www.zuji.com.sg/about-us/privacy-policy (http://www.zuji.com.sg/about-us/privacy-policy)
Singapore Cruise: http://www.singaporecruise.com.sg/index.php/others/privacy-policy/ (http://www.singaporecruise.com.sg/index.php/others/privacy-policy/)
CruiseLabs: http://singaporecruises.net/PrivacyPolicy.aspx (http://singaporecruises.net/PrivacyPolicy.aspx)
Real Estate & Property related
**Capitaland: https://www.capitaland.com/en/legal-notices/terms-and-conditions.html (https://www.capitaland.com/en/legal-notices/terms-and-conditions.html)
SAEA: http://www.saea.org.sg/privacy-policy (http://www.saea.org.sg/privacy-policy/)
CBRE: http://www.cbre.com.sg/Pages/Singapore-Privacy-Policy.aspx (http://www.cbre.com.sg/Pages/Singapore-Privacy-Policy.aspx)
OrangeTee: https://www.orangetee.com/ot/pdpp.asp (https://www.orangetee.com/ot/pdpp.asp)
Jones Lang Lasalle: http://www.jll.com.sg/singapore/en-gb/privacy-statement (http://www.jll.com.sg/singapore/en-gb/privacy-statement)
Savills: http://www.savills.com.sg/footer/terms-and-conditions.aspx (http://www.savills.com.sg/footer/terms-and-conditions.aspx)
Life Mastery Academy: http://www.lma.com.sg/privacy-policy.html (http://www.lma.com.sg/privacy-policy.html)
Real Centre Network: http://www.realcentrenetwork.com/index.php/privacy-policy (http://www.realcentrenetwork.com/index.php/privacy-policy)
Knight Frank: http://www.knightfrank.com.sg/legals/singapore-property-privacy-policy.aspx (http://www.knightfrank.com.sg/legals/singapore-property-privacy-policy.aspx)
MCST 2230 [Valley Park Condominium]: http://valleypark.com.sg/privacy_policy.php (http://valleypark.com.sg/privacy_policy.php)
MCST 2916 [Sanctuary Green Condominium]: http://www.sanctuarygreen.com.sg/pdf/140920%20Data%20Protection%20Policy%20MCST2916.pdf (http://www.sanctuarygreen.com.sg/pdf/140920%20Data%20Protection%20Policy%20MCST2916.pdf)
MCST 2665 [The Clearwater Condominium]: http://www.theclearwater.com.sg/clearwater/include/terms_of_use_policy.jsp (http://www.theclearwater.com.sg/clearwater/include/terms_of_use_policy.jsp)
Religious
**City Harvest Church: https://www.chc.org.sg/our-data-protection-policy (https://www.chc.org.sg/our-data-protection-policy)
**Thian Hock Keng Temple: http://thianhockkeng.com.sg/site/privacy-policy (http://thianhockkeng.com.sg/site/privacy-policy)
Church of St. Bernardatte: https://www.stbernadette.org.sg/pdpa-policy
Kong Meng San Phor Kark See Monastery: https://www.kmspks.org/privacy
New Creation Church: http://www.newcreation.org.sg/others/privacy-policy
Church of Singapore: http://www.cos.org.sg/wp-content/uploads/2014/07/COS-Data-Protection-Policy-.pdf
Roman Catholic Archdiocese of Singapore: http://www.catholic.org.sg/pdpa-policy
Masjid Mujahidin Mosque: http://mujahidinmosque.sg/pdpa
Sri Senpaga Vinayagar Temple: http://www.senpaga.org.sg/privacy.asp
Sports & Wellness
**Body Shop: https://www.thebodyshop.com/en-sg/termsconditions/services/privacy-policy (https://www.thebodyshop.com/en-sg/termsconditions/services/privacy-policy)
*True Yoga: http://www.trueyoga.com.sg/privacy (http://www.trueyoga.com.sg/privacy)
Physique 360: http://www.physique360.com/index.php?option=com_content&task=view&id=50&Itemid=73 (http://www.physique360.com/index.php?option=com_content&task=view&id=50&Itemid=73)
California Fitness: http://www.singapore.californiafitness.com/en/privacy-policy (http://www.singapore.californiafitness.com/en/privacy-policy)
YogaBugs: http://yogabugs.com.sg/privacy-policy (http://yogabugs.com.sg/privacy-policy)
VandaYoga: http://www.vandayoga.com/privacy-policy.html (http://www.vandayoga.com/privacy-policy.html)
SPA Club at Beach Road: http://www.spaclub.com.sg/privacy.aspx (http://www.spaclub.com.sg/privacy.aspx)
St. Gregory Spa: http://www.stgregoryspa.com/Pages/Privacy.aspx (http://www.stgregoryspa.com/Pages/Privacy.aspx)
Denailz Spa: http://denailzspa.com.sg/home/spa-etiquette (http://denailzspa.com.sg/home/spa-etiquette)
Voluntary Welfare Organizations (VWO (https://en.wikipedia.org/wiki/List_of_voluntary_welfare_organisations_in_Singapore))
**Singapore Children Society: https://www.childrensociety.org.sg/data-protection (https://www.childrensociety.org.sg/data-protection)
Singapore Red Cross: https://www.redcross.sg/data-protection-and-privacy-policy.html (https://www.redcross.sg/data-protection-and-privacy-policy.html)
I Love Children: https://www.ilovechildren.org.sg/pdpa (https://www.ilovechildren.org.sg/pdpa)
Bright Vision Hospital: http://www.bvh.org.sg/personal-data-protection-act-pdpa.html (http://www.bvh.org.sg/personal-data-protection-act-pdpa.html)
Singapore Cancer Society (PDF): http://www.singaporecancersociety.org.sg/Portals/0/Images/au/Privacy%20Policy.pdf (http://www.singaporecancersociety.org.sg/Portals/0/Images/au/Privacy%20Policy.pdf)
Children's Cancer Foundation: http://www.ccf.org.sg/personal_data_protection_policy.htm (http://www.ccf.org.sg/personal_data_protection_policy.htm)
National Kidney Foundation: http://www.nkfs.org/data-protection (http://www.nkfs.org/data-protection)
Kidney Dialysis Foundation: http://www.kdf.org.sg/privacy-policy (http://www.kdf.org.sg/privacy-policy)
Yayasan Mendaki: http://www.mendaki.org.sg/privacy_policy.aspx (http://www.mendaki.org.sg/privacy_policy.aspx)
YMCA (PDF): http://verzinc.com/ymca/wp-content/uploads/2015/08/YMCA-Privacy-Policy-_-20Mar2014.pdf (http://verzinc.com/ymca/wp-content/uploads/2015/08/YMCA-Privacy-Policy-_-20Mar2014.pdf)
YWCA: http://ywca.org.sg/about/ywca-privacy-policy (http://ywca.org.sg/about/ywca-privacy-policy)
Other Industries**HardwareSG: https://www.hardwaresg.com/privacy (https://www.hardwaresg.com/privacy)
*Streetdeal.sg: https://www.streetdeal.sg/home/info/privacy (https://www.streetdeal.sg/home/info/privacy)
SGTech (formerly SiTF): https://www.sgtech.org.sg/sgtech/web/ContentAreas/Data-Protection-Statement.aspx (https://www.sgtech.org.sg/sgtech/web/ContentAreas/Data-Protection-Statement.aspx)
#3 IP Technology Solution Pte Ltd: http://www.iptech.com.sg/privacy.html
(http://www.iptech.com.sg/privacy.html)#3 RedMart Limited: https://web.archive.org/web/20191216023136/http://about.redmart.com:80/privacy (https://web.archive.org/web/20191216023136/http://about.redmart.com:80/privacy)
Lazada: https://www.lazada.sg/privacy-policy/?spm=a2o42.home.footer_top.15.654346b58bluEp (https://www.lazada.sg/privacy-policy/?spm=a2o42.home.footer_top.15.654346b58bluEp)
#4 Joshua Research Consultants Pte Ltd: https://web.archive.org/web/20170626151413/https://www.joshuaresearch.com/about.html (http://about.redmart.com/privacy)
#4 PrimeStaff: https://www.primestaff.com.sg/privacy-policy (https://www.primestaff.com.sg/privacy-policy)
Asus: http://www.asus.com/Terms_of_Use_Notice_Privacy_Policy/Privacy_Policy (http://www.asus.com/Terms_of_Use_Notice_Privacy_Policy/Privacy_Policy)
Cosmosteel: http://www.cosmosteel.com/assets/pdf/Terms_of_Use_CosmoSteel.pdf (http://www.cosmosteel.com/assets/pdf/Terms_of_Use_CosmoSteel.pdf)
W.I. Gore & Associates: http://www.gore.com/en_xx/footer/privacy.html (http://www.gore.com/en_xx/footer/privacy.html)
American Club: http://www.amclub.org.sg/fitness-leisure/gym/9-uncategorised.html (http://www.amclub.org.sg/fitness-leisure/gym/9-uncategorised.html)
SPH: http://www.sph.com.sg/legal/sph_privacy.html (http://www.sph.com.sg/legal/sph_privacy.html)
Voucherlicious: http://voucherlicious.com/singapore/page/term-and-conditions (http://voucherlicious.com/singapore/page/term-and-conditions)
Groupon: http://www.groupon.sg/data_privacy (http://www.groupon.sg/data_privacy)
Deal.com.sg: http://www.deal.com.sg/privacy_policy (http://www.deal.com.sg/privacy_policy)
Cold Storage: https://www.coldstorage.com.sg/onlineshopping/termsandconditions.aspx (https://www.coldstorage.com.sg/onlineshopping/termsandconditions.aspx)
Singapore Vault: http://www.singaporevault.com/terms-of-use (http://www.singaporevault.com/terms-of-use)
IMC: https://www.im-c.com/sg/data-privacy (https://www.im-c.com/sg/data-privacy)
Singapore Academy of Law: http://www.sal.org.sg/Footer/Privacy-Policy (http://www.sal.org.sg/Footer/Privacy-Policy)
DHL: https://www.logistics.dhl/sg-en/home/footer/local-privacy-notice.html (https://www.logistics.dhl/sg-en/home/footer/local-privacy-notice.html)
Minimalist
Children's Aid Society: https://childrensaidsociety.org.sg/data-protection-policy
(https://childrensaidsociety.org.sg/data-protection-policy)Invention Capital: http://invcapital.com/privacy.htm
(http://invcapital.com/privacy.htm)
Special Organisations(exempted but has similar data protection policy)
Singapore Youth Flying Club: https://www.syfc.sg/Home/PrivacyPolicy (https://www.syfc.sg/Home/PrivacyPolicy)
-
How to Disappear (almost) Completely: the illusion of privacy
Can anyone ever really leave the internet? And if you had the choice, is that something that you'd want to do? After all, abandoning the connected world might help you reclaim some privacy, but even if you smashed your PC, burned your tablet and tossed your smartphone, you might still not be able to escape constant surveillance. In our three-part series How To Disappear, we're going to look at why you'd think about going offline, what you can do to tidy up your digital footprint and what happens to those who have made the leap into the darkness.
Back in 2009, Wired sent contributing editor Evan Ratliff on assignment to go "off the grid," (http://archive.wired.com/vanish/) with the publication offering a bounty of $5,000 to the first person who caught him. It took the community less than a month to track him down using the electronic trail left by his ATM history, travel records and browsing activity. This effort wasn't led by some obscure government organization either, but by a group of ordinary members of the public participating in a competition. That well-funded game of cat and mouse took place five years ago, and with advances in technology since, it's safe to assume the hunt would be much easier to complete today. Which is all the more reason we need to take a long, hard look at how we live our lives online.
Pamela Jones is a paralegal based in New York City who worked part-time editing Groklaw, a website that reported on legal news around the open-source movement. But on August 20th, 2013, Jones left the internet forever (http://www.groklaw.net/article.php?story=20130818120421175). She would never again browse websites, correspond with her former collaborators or idly browse Amazon in her downtime. Why? Because she, like the rest of us, had learned the terrible truth about the National Security Agency's PRISM program (http://www.engadget.com/saga/nsaprism/). Suddenly, online privacy was a commodity that no longer existed.
Two months before Jones fled her digital life, government contractor Edward Snowden (http://www.engadget.com/tag/edwardsnowden/) had leaked the files that would send a shockwave through the media, causing worldwide alarm. The NSA's PRISM program, it was revealed, was harvesting all of our emails, videos, photos and VoIP data from the servers of companies like Microsoft, Google and Yahoo, whether they knew about it or not. That data harvesting was done in the name of counter-terrorism: Scores of analysts at the NSA's Fort Meade headquarters were scouring through our online histories to identify and track known criminals and suspicious persons of interest.
Then, more cracks in our perceived privacy began to show. It wasn't just our online activity that was being scrutinized, as it was soon revealed the US security agency was also bulk-collecting the phone records of every US citizen. Former NSA chief General Keith Alexander defended that policy during an appearance on HBO's Last Week Tonight with John Oliver, saying that his team was merely collecting "two phone numbers, data, time and duration of [the] call." (https://www.youtube.com/watch?v=k8lJ85pfb_E) In other words, the NSA wasn't transcribing your every word; it was just innocently keeping records of our metadata (http://www.engadget.com/2014/06/20/nsa-call-metadata-program-renewed/).
Heartbleed enabled hackers to easily access both secure servers and your password at the same time.
That form of surface snooping may come off as innocuous, but the fact is simple metadata records can be used to easily draw conclusions about your activity; to "connect the dots," so to speak. Consider this example of the power of metadata from the Electronic Frontier Foundation (https://www.youtube.com/watch?v=BMwPe2KqYn4&feature=youtu.be), a nonprofit that advocates for our digital rights: You make a phone call from a bridge to a suicide prevention hotline. The contents of the call aren't recorded, but your location is. And well, the general purpose of that call is, more or less, clear. Or ponder this: A person's file shows that they spoke to an HIV-testing service, a doctor and their HMO all within the space of an hour. Again, none of the conversations have been logged, but is it really even necessary? What conclusions would you naturally come to?
The revelations of our digital insecurity didn't stop at pilfered web and phone call histories, either. Months later, news hit that national retailers had left our private information wide open for criminal use. Over the 2013 holiday season, Target revealed that 40 million credit and debit card numbers were stolen (http://www.engadget.com/2013/12/27/target-pin-data-breach/) from the company's servers. And then shortly after, the company conceded that the data breach also leaked the names, addresses, phone numbers and email addresses of up to 70 million people (http://pressroom.target.com/news/target-provides-update-on-data-breach-and-financial-performance). Neiman Marcus was next, announcing a similar breach that leaked 60,000 data entries and around 350,000 credit card numbers (http://www.neimanmarcus.com/en-gb/NM/Security-Info/cat49570732/c.cat?icid=topPromo_hmpg_ticker_SecurityInfo_0114) between July and October of 2013. Then Michaels, a US arts-and-craft supplies store, revealed in April that around 2.6 million of our credit card numbers may have been compromised (http://demandware.edgesuite.net/aaeo_prd/on/demandware.static/Sites-MichaelsUS-Site/Sites-MichaelsUS-Library/default/v1399094114289/docs/press-releases/Michaels-FINAL-Press-Release-041714.pdf). Are you sufficiently paranoid, yet?
(http://tralvex.com/download/forum/201406-WhyMetadataMatters.gif)
But wait there's more. If it wasn't bad enough that the government had violated our privacy and the nation's retailers had left us open to fraud, a vulnerability (http://www.engadget.com/2014/04/08/heartbleed-internet-flaw/) was then discovered that shook the fundamental infrastructure of the internet. Heartbleed (http://www.engadget.com/2014/04/12/heartbleed-explained/), as it was called, enabled hackers to easily access both secure servers and your password at the same time. Essentially, every time you logged in to a site, you could have been handing your email address and password over to anyone savvy enough to scrape it. Heartbleed was a nightmare for almost every company on the internet that had relied upon open-source security protocols in the hope of avoiding this exact problem. Many scrambled to fix the hole, which was found in around 18 percent of all internet servers, but by that point it was too late. The backdoor had been left open for too long."It behooves us as individuals to behave as if the battle is lost, and privacy is dead."
And it's not like this increasing trend toward insecure data is going to improve in the next few years. David Barroso, who runs Telef
-
1. DoNotTrackMe: Online Privacy Protection
Stop companies and advertisers from tracking your browsing and sending you spam email.
https://addons.mozilla.org/en-US/firefox/addon/donottrackplus (https://addons.mozilla.org/en-US/firefox/addon/donottrackplus)
http://youtu.be/D-cwcWiB8mU (http://youtu.be/D-cwcWiB8mU)
2. Ghostery for Firefox version 5.3.2!
Ghostery looks for third-party page elements (or "trackers") on the web pages you visit. These can be things like social network widgets, advertisements, invisible pixels used for tracking and analytics, and so on. Ghostery notifies you that these things are present, and which companies operate them. You can learn more about these companies, and if you wish, choose to block the trackers they operate.
https://www.ghostery.com (https://www.ghostery.com)
http://youtu.be/EKzyifAvC_U (http://youtu.be/EKzyifAvC_U)
3. Video for Do Not Track Plus & Ghostery Comparison
http://youtu.be/Yvfisq5OTH0 (http://youtu.be/Yvfisq5OTH0)
-
Xiaomi under probe over alleged privacy breach
Irene Tham
The Straits Times
Saturday, Aug 16, 2014
CHINA-BASED smartphone maker Xiaomi has slid into legal hot water in Singapore, amid growing regional concerns about its apparent lack of privacy protection.
A complaint has been filed by a phone user here, alleging that his personal data had been disclosed without consent.
He claimed he had received unsolicited calls from overseas after using his Xiaomi phone.
Singapore's privacy watchdog, the Personal Data Protection Commission, told The Straits Times it is investigating.
The charge followed an online report in Taiwan late last month that Xiaomi was silently collecting and storing user phone numbers and other device identifiers on the company's servers.
Finnish security specialist F-Secure confirmed the rumours after conducting its own independent test on a brand new RedMi 1S handset.
In a blog post last Thursday, F-Secure said it discovered that the telco name, phone identifier and phone number of the user were all sent to a server named api.account.xiaomi.com
The phone numbers of contacts added to the phone book and from SMS messages received were also sent to the server.
Such moves might run afoul of laws here, said lawyers.
"Even if the handset had come with terms of use - which allow for the collection of personal data by the handset manufacturer - users must still be allowed to withdraw their consent to the collection, use and disclosure of their personal data," said lawyer Gilbert Leong, a partner at Rodyk & Davidson.
Lawyer Rajesh Sreenivasan, a partner at Rajah & Tann, said some phone apps do collect personal data. "The difference is that users have the option to say 'yes' or 'no' to such collection."
In Singapore, the Personal Data Protection Act provides safeguards against the wrongful collection, use and disclosure of personal data for marketing.
It requires organisations to inform individuals of the purpose for collecting, using and disclosing personal data. They must also get a consumer's explicit consent before they can disclose personal information to a third party.
Xiaomi has been gaining popularity since it started selling phones here early this year.
According to estimates from market research firm IDC, Xiaomi phones accounted for 10 per cent to 20 per cent of all the smartphones shipped here in the second quarter of the year.
On a Google+ Web post on Sunday, Xiaomi vice-president of international operations Hugo Barra wrote a lengthy explanation. He acknowledged data was uploaded but "not kept for longer than necessary". It was needed for its cloud messaging service, which routes messages between two users over the Internet.
The firm also said it would no longer automatically activate phone users for cloud messaging.
A handset software update it rolled out on Sunday now makes cloud messaging an opt-in service - much like chat services WhatsApp and WeChat.
(http://tralvex.com/download/forum/xiaomi-logo.jpg) (http://tralvex.com/download/forum/xiaomi-logo.jpg)
http://business.asiaone.com/news/xiaomi-under-probe-over-alleged-privacy-breach (http://business.asiaone.com/news/xiaomi-under-probe-over-alleged-privacy-breach)
(http://tralvex.com/download/forum/xiaomi-callhome.jpg)
http://www.hardwarezone.com.sg/tech-news-security-firm-shows-xiaomi-smartphones-secretly-stealing-your-data-updated (http://www.hardwarezone.com.sg/tech-news-security-firm-shows-xiaomi-smartphones-secretly-stealing-your-data-updated)
-
Credit card swiped a second time? It's against privacy law
Public can now file report against retailers for collecting personal data
By Irene Tham, Technology Correspondent
It is done so quickly that you might not even notice it. But that extra swipe of your credit card by some merchants compromises your personal data and breaches data protection laws.
Known in the industry as "double swiping", the second quick swipe of consumers' credit cards is typically done after credit-card transactions have been approved.
Merchants do this to record the mode of payment for accounting purposes and to collect cardholders' personal data for marketing purposes such as loyalty programmes.
Even though banks have been telling retailers to stop doing this in the past two years as the practice exposes consumers' personal data to security risks, many retailers have not stopped.
But today, new data protection legislation allows consumers to file a report against rogue merchants.
"If the merchant wants to collect personal data beyond what is needed for the payment, the merchant should get the consent of the customer," a spokesman for the Personal Data Protection Commission told The Straits Times.
The Personal Data Protection Act was fully implemented on July 2 to safeguard consumers against the wrongful collection, use and disclosure of personal data for marketing.
Last week, The Straits Times spotted several merchants, including eateries and toy shops, double-swiping cards.
The Association of Banks in Singapore (ABS) said banks have asked merchants to consider alternative ways of collecting consumers' data. The Straits Times understands that some are dragging their feet as this involves changing the way they work and investing in new systems.
"Some merchants and retailers would need extra time to reconfigure their more complex systems," said Mrs Ong-Ang Ai Boon, ABS director.
Double-swiping undermines the latest advancements in card technologies. Credit card data now resides more securely in embedded computer chips instead of on magnetic stripes that can be skimmed by fraudsters.
Depending on how merchants design their cash registers, any information - from the cardholders' names to credit card numbers and card expiration dates - can be collected.
The double-swiping practice has left some consumers concerned about their privacy.
Engineer Ngiam Shih Tung, 47, said: "A credit card number and expiration date are all you need for a fraudulent transaction on some websites."
The Personal Data Protection Commission said it has not received any complaint about double-swiping so far.
Organisations found in breach of the Act could face a fine of up to $1 million.
-
(http://www.huttonsgroup.com/images/logo-huttons.jpg) (http://www.huttonsgroup.com/images/logo-huttons.jpg)
Property salesperson to be charged for breaching 'Do Not Call' rules
AsiaOneMonday, Sep 22, 2014
SINGAPORE - A property salesperson registered with Huttons Asia Pte Ltd is to be charged for offences relating to the Do Not Call ("DNC") Registry under the Personal Data Protection Act.
The Personal Data Protection Commission said it received complaints of unsolicited telemarketing messages allegedly sent by the property salesperson to Singapore telephone numbers that were registered with the DNC Registry.
The unsolicited telemarketing messages advertised various residential property developments in Singapore.
The property salesperson will be charged in court on September 24. He faces 27 counts of contravening section 43(1) of the PDPA, relating to the obligation to check the DNC Registry before sending any telemarketing messages to Singapore telephone numbers.
Any person or organisation found guilty of the offence is liable to a fine of up to $10,000 per message sent.
In considering the appropriate enforcement action to be taken in each case, the Commission said it takes into account various factors including the seriousness of the breach, whether the sending of unsolicited telemarketing messages were isolated incidences, the number of complaints against the organisation and whether the organisation had been co-operative after being informed by the Commission to stop sending such unsolicited telemarketing messages.
Chairman of the Commission Mr Leong Keng Thai said: "It is a frustrating experience for individuals who have registered their numbers with the DNC Registry to continue receiving unsolicited telemarketing messages, and the PDPC will take enforcement action against those who continue to ignore the rules."
Recently on August 27, Star Zest Home Tuition and its director Law Han Wei became the first offenders to be charged and fined since the rules kicked in on Jan 2.
Both Star Zest and its director faced a total of 26 counts of contravening section 43(1) of the PDPA with 48 other similar offences taken into consideration. They were fined $39,000 each, for a total fine of $78,000.
Two other organisations accepted offers to compound their offences relating to the sending of telemarketing messages to Singapore telephone numbers registered with the DNC Registry in lieu of prosecution.
The composition amounts ranged from $500 to $1,000.
The Commission said it has also received a small number of isolated complaints against 900 other organisations and has issued them with notices that warn of the consequences of sending any further unsolicited telemarketing messages.
The Commission added that the real estate sector currently makes up about 47 per cent of complaints pertaining to DNC related offences.
As organisations become more familiar with the DNC Registry, the number of complaints pertaining to DNC related offences received by the Commission on a monthly basis has also fallen by as much as five-fold, the Commission said.
The Commission has investigated more than 3,500 valid complaints against various organisations since the DNC provisions took effect, while investigations into some 1,700 other complaints are currently ongoing. These organisations are from sectors such as property, private education and retail.
To date, about 4,500 organisations have registered to check Singapore telephone numbers against the DNC Registry.
This is a nine-fold increase from the 500 organisations that first registered with the DNC Registry when it came into effect. An average of 38 million telephone numbers are checked every month.
Individuals who wish to lodge a complaint to the Commission or organisations which would like to find out more about compliance with the PDPA can visit www.pdpc.gov.sg (http://www.pdpc.gov.sg) or write to info@pdpc.gov.sg.
Source: http://news.asiaone.com/news/singapore/property-salesperson-be-charged-breaching-do-not-call-rules (http://news.asiaone.com/news/singapore/property-salesperson-be-charged-breaching-do-not-call-rules)
____________________________________________________________________________
Property agent charged with breaching DNC Registry rules
By Chitra Kumar POSTED: 24 Sep 2014 16:18
Kuan Chow Seng, a Huttons Asia agent, says he intends to plead guilty to breaching the DNC rules.
SINGAPORE: A property agent from Huttons Asia was charged on Wednesday (Sep 24) with breaching the Do Not Call (DNC) rules under the Personal Data Protection Act (PDPA).
Kuan Chow Sheng allegedly sent unsolicited telemarketing messages to advertise various residential developments in Singapore to telephone numbers registered with the DNC registry. Between Feb 8 Feb and Mar 2 this year, the 33-year-old sent text messages to a total of 27 locally registered numbers.
He told the court that he has no plans to engage a legal counsel and intends to plead guilty. The case will next be heard on Oct 20, 2014.
Kuan is the second person to be charged with breaching the DNC Registry rules. On Aug 27, Star Zest Home Tuition and its director, Law Han Wei, were the first to be charged for flouting the DNC Registry rules. The director and the agency were fined a total of $78,000.
Any person or organisation found guilty of sending unsolicited telemarketing messages to Singapore telephone numbers without checking the DNC Registry will be liable to a fine of up to $10,000 per message sent.
- CNA/kk
Source: http://www.channelnewsasia.com/news/singapore/property-agent-charged/1378656.html (http://www.channelnewsasia.com/news/singapore/property-agent-charged/1378656.html)
____________________________________________________________________________
Property agent fined $27,000 for violating DNC rules
21 Oct 2014
Kuan Chow Sheng, a 32-year old property agent, is the second person to be penalised under the Do Not Call (DNC) rules of the Personal Data Protection Act, according to media reports.
Kuan pleaded guilty to nine of 27 offences committed, while the other 18 charges were taken into consideration for sentencing.
Using a SMS broadcasting software known as
-
Google must pay Canadian woman $2,250 for showing her cleavage in Street View
By Jeff John Roberts Oct. 29, 2014 - 3:40 PM PST
Google is in trouble over Street View again, after one of its cars took a photo of a woman on her stoop, and showed
-
CCTV cameras are streaming footage of Singapore homes to this creepy site
By Nurul Azliah Aripin | Yahoo Newsroom
-
Local website DNC Register taken down for 'impersonating' privacy commission
Published on Jan 19, 2015 4:18 PM
By Irene Tham
SINGAPORE - Five months after becoming the first person to be fined for breaching "Do Not Call" rules here and just a week after facing fresh probes by the authorities, Law Han Wei is back on the law enforcement radar.
A company called DNC Register, for which Law is the sole director and shareholder, is being sanctioned for potentially passing off as the Personal Data Protection Commission (PDPC), which enforces the Personal Data Protection Act and the Do Not Call rules here.
Its website www.dncpdpc.com.sg (http://www.dncpdpc.com.sg) has been taken down by the Singapore Network Information Centre, which governs domain names ending with .sg, on the instructions of the PDPC.
"The company and website are not associated with, endorsed or approved by the PDPC," said the PDPC in a strongly-worded statement in response to queries from The Straits Times.
Source: http://www.straitstimes.com/news/singapore/more-singapore-stories/story/local-website-dnc-register-taken-down-impersonating-priv#sthash.BTTf8CQs.dpuf (http://www.straitstimes.com/news/singapore/more-singapore-stories/story/local-website-dnc-register-taken-down-impersonating-priv#sthash.BTTf8CQs.dpuf)
___________________________________________________________________
http://www.dncpdpc.com.sg (http://www.dncpdpc.com.sg) (taken down by .Gov SG in 2015 Jan)
From Google Cache:
(http://tralvex.com/download/forum/201501-dncpdpc-com-sg.gif)
ACRA Record
Reg. No.: 201333653C
Company name: DNC REGISTER PTE. LTD.
Address: 546A, SERANGOON ROAD, Singapore(218168)
Status: Live (as at 19 Jan 2015)
Official website (defunct now): www.dncpdpc.com.sg (http://www.dncpdpc.com.sg)
Contact no: 8571-3622
-
Local website DNC Register taken down for 'impersonating' privacy commission
Published on Jan 19, 2015 4:18 PM
By Irene Tham
SINGAPORE - Five months after becoming the first person to be fined for breaching "Do Not Call" rules here and just a week after facing fresh probes by the authorities, Law Han Wei is back on the law enforcement radar.
A company called DNC Register, for which Law is the sole director and shareholder, is being sanctioned for potentially passing off as the Personal Data Protection Commission (PDPC), which enforces the Personal Data Protection Act and the Do Not Call rules here.
Its website www.dncpdpc.com.sg (http://www.dncpdpc.com.sg) has been taken down by the Singapore Network Information Centre, which governs domain names ending with .sg, on the instructions of the PDPC.
"The company and website are not associated with, endorsed or approved by the PDPC," said the PDPC in a strongly-worded statement in response to queries from The Straits Times.
Source: http://www.straitstimes.com/news/singapore/more-singapore-stories/story/local-website-dnc-register-taken-down-impersonating-priv#sthash.BTTf8CQs.dpuf (http://www.straitstimes.com/news/singapore/more-singapore-stories/story/local-website-dnc-register-taken-down-impersonating-priv#sthash.BTTf8CQs.dpuf)
___________________________________________________________________
http://www.dncpdpc.com.sg (http://www.dncpdpc.com.sg) (taken down by .Gov SG in 2015 Jan)
From Google Cache:
(http://dishonest.biz/forum/images/201501-dncpdpc-com-sg.gif)
-
Details of more than 1,900 pupils from Henry Park Primary School leaked
Irene Tham, My Paper, Tuesday, Mar 24, 2015
The personal data of more than 1,900 pupils from Henry Park Primary School was leaked two weeks ago, in the second such case reported here since patrons of karaoke chain K Box had their details exposed last September.
A Microsoft Excel spreadsheet containing the children's particulars was mistakenly sent out to some 1,200 parents on March 12 as part of an update about a school event.
The file contains the names and birth certificate numbers of all 1,900 pupils in the school, along with the names, phone numbers and e-mail addresses of their parents.
A day after the leak, principal Chia Soo Keng sent an e-mail apology to all parents, asking them to delete the Excel file and not to use the data.
He told The Straits Times: "This should not have happened."
This was the school's first data breach and it is reviewing all personal data-handling procedures to prevent a recurrence, he said.
"For a start, all confidential information files are now password-protected," said Mr Chia.
When contacted, a Ministry of Education (MOE) spokesman said: "All schools have been reminded to use encryption as an additional means to protect personal data stored in files."
Apologising for the incident, she added that the staff member who made the mistake has been counselled and the school has been asked to tighten its controls.
Still, several parents contacted by The Straits Times said they were concerned about the breach.
"How do you ensure that the data is not used?" asked a 39-year-old IT consultant who wants to be known only as Ms Wong.
Another parent asked why sensitive files were not encrypted. "The school should have tighter processes," said the 30-year-old sales manager, who wants to be known only as Mr Soh.
This incident follows the K Box case last year, when the names, addresses and mobile phone and identity card numbers of its 300,000 members were posted online in the biggest breach of personal data here. The Personal Data Protection Commission has not released the investigation findings.
Three parents told The Straits Times they hoped the commission could step in.
However, the privacy watchdog said MOE schools such as Henry Park are exempt from the Personal Data Protection Act, fully enforced since July 2 last year. The Act requires organisations to take "reasonable measures" to protect personal data in their possession.
Instead, MOE schools are governed by public sector rules.
These rules have not been made public, though the MOE spokesman said its internal rules require sensitive information such as personal data to be encrypted and not be disclosed to unauthorised parties.
Lawyer Bryan Tan, a technology partner at Pinsent Masons MPillay, noted that in situations not covered by the Personal Data Protection Act, the public has no recourse and "only moral suasion".
But lawyer Gilbert Leong, a partner at Rodyk & Davidson, said if parents suspect their data has, for example, been sold to a tuition agency, they can complain to MOE and the commission, which can investigate complaints and charge wrongdoers in court.
Privacy advocate Ngiam Shih Tung, 47, an engineer, said it is timely to re-look the exemption of government agencies from the Personal Data Protection rules.
"There are many areas where the Government may have fallen short of the standards imposed on the private sector," he said. "Is there a requirement for public agencies to state the purpose of data collection?"
Source: http://news.asiaone.com/news/singapore/details-more-1900-pupils-henry-park-primary-school-leaked#sthash.1UE3efxU.dpuf (http://news.asiaone.com/news/singapore/details-more-1900-pupils-henry-park-primary-school-leaked#sthash.1UE3efxU.dpuf)
(http://tralvex.com/download/forum/ExcelFile.gif)
-
Japan pension system hacked, 1.25 million cases of personal data leaked
Technology | Mon Jun 1, 2015 6:42am EDT
Japan's pension system has been hacked and more than a million cases of personal data leaked, authorities said on Monday, in an embarrassment that revived memories of a scandal that helped topple Prime Minister Shinzo Abe in his first term in office.
Japan Pension Service staff computers were improperly accessed by an external email virus, leading to the leak of some 1.25 million cases of personal data, the system's president, Toichiro Mizushima, told a hastily called news conference.
He apologized for the leak, which he said involved combinations of names, identification numbers, birth dates and addresses.
The pension service was setting up a team to investigate the cause and prevent a recurrence, Mizushima said.
"These are the people's vital pensions. I have instructed Health and Welfare Minister (Yasuhisa) Shiozaki to consider the pension recipients and do everything possible," Abe told reporters in brief remarks aired on NHK public television, which featured the data leak as the evening's top news story.
Separately, Shiozaki apologized for failing to prevent the hacking and told a news conference he had instructed the Japan Pension Service to set top priority on protecting the public's pensions.
Public outrage over botched record-keeping that left millions of pension premium payments unaccounted for was a major factor in a devastating defeat suffered by Abe
-
U.S. government hacked; feds think China is the culprit
By Kevin Liptak and Theodore Schleifer, CNN
Updated 1331 GMT (2031 HKT) June 5, 2015
Washington (CNN) Four million current and former federal employees, from nearly every government agency, might have had their personal information stolen by Chinese hackers, U.S. investigators said.
U.S. officials believe this could be the biggest breach ever of the government's computer networks. China called the allegation irresponsible.
The Office of Personnel Management, which is conducting background checks, warned it was urging potential victims to monitor their financial statements and get new credit reports.
The breach was initially thought to have impacted the Office of Personnel Management and the Department of Interior, But government officials said nearly every federal government agency was hit by the hackers.
An assessment continues, and it is possible millions more government employees may be affected.
U.S. investigators: We believe this was China's work
U.S. investigators believe they can trace the breach to the Chinese government. Hackers working for the Chinese military are believed to be compiling a massive database of Americans, intelligence officials told CNN on Thursday night.
It is not clear what the purpose of the database is.
The Washington Post and Wall Street Journal first reported Thursday that Chinese hackers were responsible for the breach.
A spokesman from the Chinese Embassy in Washington objected late Thursday to allegations that the Chinese government may be behind the massive hack.
"Cyberattacks conducted across countries are hard to track, and therefore the source of attacks is difficult to identify. Jumping to conclusions and making hypothetical accusation is not responsible and counterproductive," said Zhu Haiquan.
EINSTEIN detection system
Employees of the legislative and judicial branches and uniformed military personnel were not affected.
There are 2.7 million federal executive branch employees. It's unclear whether this affected all of them, along with former employees, or only a portion of them.
The federal personnel office learned of the data breach after it began to toughen its cybersecurity defense system. When it discovered malicious activity, authorities used a detection system called EINSTEIN to eventually unearth the information breach in April 2015, the Department of Homeland Security said.
A month later, the federal agency learned sensitive data had been compromised.
The FBI is investigating what led to the breach.
"We take all potential threats to public and private sector systems seriously and will continue to investigate and hold accountable those who pose a threat in cyberspace," the FBI said in a statement.
The federal personnel office said "personally identifiable information" had been breached, though the office didn't name who might be responsible.
Senator: The breach is 'disturbing'
Senate Homeland Security and Governmental Affairs Chairman Ron Johnson, R-Wisconsin, called the breach "disturbing" and said the Office of Personnel Management needs to do a better job securing its information.
"It is disturbing to learn that hackers could have sensitive personal information on a huge number of current and former federal employees -- and, if media reports are correct, that information could be in the hands of China," Johnson said in a statement. "(The office) says it 'has undertaken an aggressive effort to update its cybersecurity posture.' Plainly, it must do a better job, especially given the sensitive nature of the information it holds."
U.S. Rep. Adam Schiff of California, the top Democrat on the House Intelligence Committee, said hackers are one of the "greatest challenges we face on a daily bases."
"It's clear that a substantial improvement in our cyber databases and defenses is perilously overdue," Schiff said in a statement. "That's why the House moved forward on cybersecurity legislation earlier this year, and it's my hope that this latest incident will spur the Senate to action."
CNN's Evan Perez and Jim Sciutto contributed to this report.
Source: http://edition.cnn.com/2015/06/04/politics/federal-agency-hacked-personnel-management (http://edition.cnn.com/2015/06/04/politics/federal-agency-hacked-personnel-management)
-
(http://tralvex.com/download/forum/201507_AshleyMadison%20Hacked.jpg)
Online Cheating Site AshleyMadison Hacked
20 July 2015
Large caches of data stolen from online cheating site AshleyMadison.com have been posted online by an individual or group that claims to have completely compromised the company
-
Pwned websites: Breached websites that have been loaded into this service
https://haveibeenpwned.com/PwnedWebsites (https://haveibeenpwned.com/PwnedWebsites)
An overview of the various breaches that have been consolidated into this site. Each of these has been dumped publicly and is readily available via various sites on the web.
(http://tralvex.com/download/forum/201508_haveibeenpwned_com.gif)
-
Singapore online retailer refutes claim that 900k customer accounts breached
Wednesday, Nov 12, 2014
The rebuke comes after online satirical group SMRT Ltd (Feedback) posted a screenshot on Tuesday evening showing a seller who claimed to have the details of 900,000 Zalora customer accounts.
(http://tralvex.com/download/forum/201411_ZaloraAllegedDataSelling.gif)
The online vigilante group later clarified that the data breach amounted to 1.49 million Singapore online shopping accounts, of which 400,000 was from Zalora.sg and Reebonz.com.sg each. The remaining 650,000 account details were from Deal.com.sg, SMRT Ltd (Feedback) said.
An hour after SMRT Ltd (Feedback) posted the screenshot, a person claiming to be the Head of Data at Zalora Singapore, Dat Le, commented on the photo, saying that "[Zalora does] not have 900,000 customers in Singapore."
"I have just double checked myself for each of the order_id(s) showed and can confirm that," Dat Le said on his Facebook page.
Zalora.sg posted an official statement on its Facebook page today afternoon denying the data breach.
"We've checked our database log and information and we confirm that the screen capped database that is posted is not our database," Zalora said.
"We would like to assure our online shoppers that we follow a comprehensive personal data protection policy, and our database is secured behind several layers of protection and access control, with detailed audit logs for monitoring."
According to the SMRT Ltd (Feedback) screenshot, the seller claimed to have been selling account information for the past four years, and was asking for $4,500 for the 900,000 account details.
Zalora said in its statement that its customer database "is extremely secure and has never been sold, monetised or shared with third parties."
Source: http://digital.asiaone.com/digital/news/singapore-online-retailer-refutes-claim-900k-customer-accounts-breached (http://digital.asiaone.com/digital/news/singapore-online-retailer-refutes-claim-900k-customer-accounts-breached)
-
Nanyang Polytechnic computer system hacked, information on 240 alumni leaked
Feb 10, 2015 | Jalelah Abu Baker
SINGAPORE - The personal and bank information of 240 Nanyang Polytechnic alumni have been stolen and leaked online.
Chinese evening daily Lianhe Wanbao reported on Monday that one of the alumni affected, Mr Ho, was informed of the security breach last week through a letter from the school.
The letter says that there was "unauthorised access" into the polytechnic's computer system. According to the letter, names and bank account numbers linked to GIRO payments were copied. It also says that the school has managed to delete the information from the website that carried the leaked information. It is not known which website it was.
Mr Ho is wary although he thinks that nothing can be done using the information stolen.
"If they have the ability to steal these information, they may have the ability to steal even more. The information they released may not be all the information they have," Mr Ho was quoted as saying.
The hackers retrieved information of those who were enrolled between 1994 and 1999, Wanbao reported. The school advised the affected parties to check with the bank on any aunthorised transaction.
Nanyang Polytechnic has reported the matter to the police. In the letter, the school wrote that it takes the matter "very seriously".
"We are conducting a thorough internal investigation and are also working with a leading third party forensics firm to conduct an independent investigation into this matter so as to strengthen our processes and systems," it added.
Source: https://www.straitstimes.com/singapore/nanyang-polytechnic-computer-system-hacked-information-on-240-alumni-leaked (https://www.straitstimes.com/singapore/nanyang-polytechnic-computer-system-hacked-information-on-240-alumni-leaked)
90% of mobile apps could be in breach of S'pore privacy law
Irene Tham, Monday, Nov 02, 2015
Ninety per cent of mobile apps in Singapore do not adequately declare what consumer data is collected or how it is used, potentially falling foul of Singapore's Personal Data Protection Act (PDPA).
Yet, more than half of the mobile apps that people download seek access to swathes of sensitive information, such as users' online and social media identities and location.
This comes from an inaugural study of the privacy policies of 113 popular apps from the Singapore Google Play store.
The sample comprises taxi apps as well as those from banks, telcos, real estate agents and financial advisers.
The three-month study - done jointly by local data protection software-makers Straits Interactive and Appknox - concluded last week.
"Users freely give permission upon installation, without being informed of how their personal information would be used," said Mr Kevin Shepherdson, chief executive officer of Straits Interactive.
The PDPA, implemented fully in July last year, requires organisations to tell consumers what data is collected and what it is used for.
Noted Mr Shepherdson: "As a best practice, app developers need to state clearly within the privacy policy on the app download page what user information is collected and how it will be used."
The PDPA also prohibits organisations from collecting consumer data beyond what is "reasonable".
A calendar app was found to have asked for access to users' location and photos, in what seems to be excessive data collection, said Mr Shepherdson.
Apps from real estate agents and financial advisers also seek access to location, online identities, and even microphone and camera functions.
Most of them do not explain how the data will be used. Mr Ken Chia, principal at law firm Baker & Mckenzie. Wong & Leow, said that excessive data collection may land organisations in hot water.
"They may not realise the privacy implications of their actions and that they may be contravening the Act," he said.
When contacted, the Personal Data Protection Commission, which enforces the Act, urged mobile app developers to review their policies to comply with the law.
"Organisations should only collect, use or disclose personal data for reasonable purposes," a commission spokesman said.
Organisations should also notify and obtain individuals' consent for data collection, unless it is an emergency where the safety of an individual is threatened, he added.
Only 10 per cent of the local apps examined provided comprehensive disclosure, the study found.
Among them is HSBC's mobile banking app. Although the bank requires users to agree to share their location information, it clearly states that the app uses the data to locate nearby branches and ATMs.
Users must also grant the app access to their call logs and device identification. But its privacy policy states this is to let users make calls to HSBC from within the app and for verification purposes.
Lawyer Gilbert Leong, a partner at Rodyk & Davidson, said that most app developers may not be collecting data for nefarious purposes.
He said: "If I am using an app for map directions, it is logical that the app has access to my location information. But ideally, app-makers should give consumers the choice to turn on or off any privacy feature within the app."
Hidden app flaws
The study also found that more than half of mobile apps have either poor encryption or contain vulnerabilities, potentially exposing users' sensitive data to hackers.
For instance, a malicious code can be inserted via the compromised app to control, say, the camera function of the mobile device using the app.
This allows pictures, videos or screenshots to be taken and collected remotely and surreptitiously.
Similarly, mobile numbers can be harvested by app developers for sale to marketers, and by cyber criminals for targeted hacking.
Early last year, a security vulnerability was discovered in Starbucks' mobile app for the iPhone.
The app stores customers' credentials-including the balance in their stored-value account, and transaction history and locations -in a text file that is not encrypted.
An attacker just needs to connect the device to a computer to extract the information from the file system. Starbucks has since patched the security hole.
Source: http://digital.asiaone.com/digital/news/90-mobile-apps-could-be-breach-spore-privacy-law (http://digital.asiaone.com/digital/news/90-mobile-apps-could-be-breach-spore-privacy-law)
-
Singtel app down after software glitch shows details of other customers
1 March 2016 Lester Hio
SINGAPORE - Several Singtel customers were unable to log in to the telco's mobile application on Tuesday morning (March 1), hours after a software glitch on Monday night allowed customers to see the personal information of other customers through the app.
It raised concerns of privacy and account security amongst telco customers, who saidon Singtel's Facebook page on Monday night that, instead of their own account, they were logged into a different account and could view personal details, such as the name and address, of a different customer when they opened their My Singtel app.
The app can be used to check and pay bills, view data usage and re-contract or buy a new phone.
"I think there is a serious breach of account confidentiality and I suspect my account is also being compromised," said Facebook user Wilson Siak.
Some users also reported seeing unusual messages on the app's account information and billing pages, including one insulting Prime Minister Lee Hsien Loong.
(http://tralvex.com/download/forum/20160301_SingtelAppGlitch.gif)
The issue continued into Tuesday morning. Customers also reported that they were were unable to log in to the app even after resetting their passwords.
Singtel said in a statement that it had suspended the app after information of one of their customers was "erroneously published due to a software glitch".
"We are still trying to get in touch with the affected customer to apologise and explain," said a Singtel spokesman.
"We would like to assure customers that this is an isolated incident and their account security has not been compromised".
In a statement at 11.45am on Tuesday, Singtel said customers could access the app, with most functions restored.
However, the company is still working to re-activate the app's bills, rewards and e-appointment features.
Source 1: http://www.straitstimes.com/singapore/singtel-app-down-for-users-after-software-glitch-shows-details-of-other-customers (http://www.straitstimes.com/singapore/singtel-app-down-for-users-after-software-glitch-shows-details-of-other-customers)
Source 2: http://forums.hardwarezone.com.sg/eat-drink-man-woman-16/singtel-must-come-clean-5313510-4.html (http://forums.hardwarezone.com.sg/eat-drink-man-woman-16/singtel-must-come-clean-5313510-4.html)
-
Vast Trove of Travelers
-
The Panama Papers: what you need to know
What is Mossack Fonseca, how big is it, and who uses offshore firms? Key questions about one of the biggest ever data leaks
Luke Harding Sunday 3 April 2016 16.49 EDT
What is Mossack Fonseca?
It is a Panama-based law firm whose services include incorporating companies in offshore jurisdictions such as the British Virgin Islands. It administers offshore firms for a yearly fee. Other services include wealth management.
Where is it based?
The firm is Panamanian but runs a worldwide operation. Its website boasts of a global network with 600 people working in 42 countries. It has franchises around the world, where separately owned affiliates sign up new customers and have exclusive rights to use its brand. Mossack Fonseca operates in tax havens including Switzerland, Cyprus and the British Virgin Islands, and in the British crown dependencies Guernsey, Jersey and the Isle of Man.
How big is it?
Mossack Fonseca is the world
-
Megabreach: 55 MILLION voters' details leaked in Philippines
Election officials shrug: Yeah, we were hacked - but not of sensitive info...
7 Apr 2016 at 11:19, John Leyden
A massive data breach appears to have left 55 million Philippine voters at much greater risk of identity fraud and more.
Security researchers warn that the entire database of the Philippines
-
Singapore penalises [11] firms for data breaches
Government fines organisations and issues warning to several others for breaching the country's Personal Data Protection Act, including local IT retailer Challenger and Chinese handset maker Xiaomi.
By Eileen Yu for By The Way | April 21, 2016 -- 10:03 GMT (18:03 GMT+08:00) | Topic: Security
Several organisations in Singapore have been fined and issued warnings for breaching the country's Personal Data Protection Act (PDPA), including local IT retail chain Challenger Technologies and Chinese handset maker Xiaomi.
The Personal Data Protection Commission (PDPC) said Thursday that it had imposed financial penalties of various amounts to four organisations, which had failed to implement adequate security measures to safeguard the personal data of its customers.
Singapore's PDPA was tabled in 2012 following years of deliberation and came into full effect in July 2014. The act does not apply to the public sector, including government ministries and agencies.
K Box Entertainment Group was fined S$50,000 for its failure to put in place adequate data protection policies and security safeguards as well as not having a data protection officer. The local karaoke chain has a membership of 317,000. Its IT vendor, Finantech Holdings, which was responsible for managing its content management system, also was fined S$10,000.
K Box in September 2014 suffered a data leak when its database was breached by a hacker group, The Knowns, which affected various customer information including e-mail addresses, contact numbers, birth dates, and membership details.
The Institution of Engineers in Singapore as well as Fei Fah Medical Manufacturing were fined S$10,000 and S$5,000, respectively, for their failure to implement sufficient security measures to safeguard the data of their members and customers.
The PDPC issued directives and warnings to seven other organisations, which would need to improve their data protection policies and measures. Challenger was warned about lapses in its handling of personal data, as was retail chain Metro and tuition agency Yestuition Agency. IT vendor Xirlynx Innovations and IT industry group Singapore Computer Society also were found to have less than adequate data management practices.
Tour agency Universal Travel Corporation was issued a directive for unauthorised disclosure of personal data belonging to 37 customers.
Xiaomi's Singapore outfit was instructed to improve its compliance after the PDPC determined the Chinese handset maker had signed up customers for its cloud messaging services by default and without notifying users. Another complaint lodged against Xiaomi for disclosing personal data to third-party marketers without consent was dismissed after the PDPC found the claim to be unsubstantiated.
In deciding on the necessary enforcement actions, the commission said it assessed the severity of non-compliance such as whether the organisations had taken reasonable measures to prevent the data breach and whether they had data protection policies and processes in place. The number of individuals affected as well as time taken to rectify the data breach after it had been identified also were taken into consideration.
PDPC Chairman Leong Keng Thai said: "The enforcement actions taken are not to deter the use of personal data for business competitiveness [as] we recognise that data is essential for innovation in today's economy. The key is to use it responsibly and take appropriate actions to protect it.
"Both the organisation and its data intermediary, such as IT vendors that provide systems and data management solutions to businesses, are expected to exercise due care and implement adequate security measures," Leong explained.
Since the act came into effect, the commission had received 667 compliances, of which 92 percent were resolved through investigation and facilitation between the organisations and individuals.
Source: http://www.zdnet.com/article/singapore-penalises-firms-for-data-breaches/ (http://www.zdnet.com/article/singapore-penalises-firms-for-data-breaches/)
-
PDPC's Data Protection Enforcement Cases: Grounds of Decision
(http://tralvex.com/download/forum/2016_PDPC%20Data%20Protection%20Enforcement%20Cases.jpg)
Source: https://www.pdpc.gov.sg/commissions-decisions/data-protection-enforcement-cases (https://www.pdpc.gov.sg/commissions-decisions/data-protection-enforcement-cases)
Cache of all cases (all in pdf format): http://goo.gl/uLNGSW (http://goo.gl/uLNGSW)
-
(http://tralvex.com/download/forum/Breachalarm1.gif)
(http://tralvex.com/download/forum/Breachalarm2.gif)
Source 1: https://breachalarm.com (https://breachalarm.com)
Source 2: https://breachalarm.com/all-sources (https://breachalarm.com/all-sources)
-
67% of used storage drives sold online hold personally identifiable data
By Kenny Yeo on 9 Jul 2016, 10:45am
(http://tralvex.com/download/forum/2016pd_BlanccoeBayCraigslist.gif)
(Image source: Storage Newsletter)
According to study by the Blancco Technology Group, it found that over two-thirds of storage drives sold on eBay and Craiglists hold some sort of personally identifiable data or even corporate data.
After acquiring 200 second-hand drives off eBay and Craiglists and analyzing them, the study found that 67% of them contained personally identifiable information and 11% held sensitive corporate data, including company emails, customer relationship management records, and even spreadsheets containing sales projections and product inventories.
The graph above shows the breakdown of type of data recovered. Photos made up a large percentage of it, but worryingly, so does social security numbers and financial data.
Further analysis found that on 36% of the drives containing residual data, users attempted to wipe the drive simply by dragging items into the Recycle Bin.
Another 40% were found to only have been cleaned using Quick Format.
And only 10% of the drives were found to have some sort of secure data erasure method performed on them.
What's important to know from this study is that simply deleting data by putting them in the Recycle Bin and emptying it is not enough. Very often, these types of deleted data can still be recovered by data recovery professionals.
We recommend using programs that securely delete data by erasing them and then writing passes of random data over the entire disk, like CCleaner or Eraser. This can prevent data recovery professionals from retrieving your deleted data.
Source: http://www.hardwarezone.com.sg/tech-news-67-used-storage-drives-sold-online-hold-personally-identifiable-data (http://www.hardwarezone.com.sg/tech-news-67-used-storage-drives-sold-online-hold-personally-identifiable-data)
-
MAS probes case of UOB's unshredded client data
Jamie Lee, 19 July 2016
SINGAPORE (THE BUSINESS TIMES) - The Monetary Authority of Singapore (MAS) is investigating a case involving UOB, which had its clients' unshredded documents found in a trashbag under a tree at Boat Quay, and said that it will take action against banks that do not safeguard the confidentiality of customer information.
(http://tralvex.com/download/forum/201607_UOB_Trash.jpg)
"MAS is currently looking into this matter. MAS expects banks to have in place measures to safeguard the confidentiality of customer information, and will not hesitate to take action against banks which fail to do so," a spokeswoman told The Business Times in response to queries.
It said that in cases involving disclosure of banking customers' personal data, MAS will work with the Personal Data Protection Commission (PDPC) to review the matter.
A PDPC spokeswoman told The Business Times the commission is aware of The Middle Ground articles that highlight the issue of documents containing personal data being disposed of by organisations, and has sought information from The Middle Ground on the matter.
A report from The Middle Ground, an online news website, revealed last week that an entire trash bag filled with UOB documents was found in June behind the bank's headquarters at Raffles Place. The reporters' "dumpster dive" unearthed several corporate statements, loan applications, and internal reports from the bank.
UOB did not deny the report and its findings. It had told The Business Times that it has concluded its investigation in the matter. But it declined to provide more details on the findings of its probe.
The bank said that it "takes very seriously" any breach of customer confidentiality. "We have a strict policy and procedures in place which govern the secure handling and disposal of confidential and sensitive information. Any staff or vendor found in breach of the policy and procedures will be dealt with accordingly."
The news portal put up pictures of the documents - with the sensitive information redacted - that had details of at least one guarantor behind a loan, with his personal details such as his NRIC number and date of birth, in full view, it said.
The Middle Ground found a document seeking a credit increase in millions from a "well-known sports apparel company". It said that it found handwritten scribbles in a notebook with client details and log-in passwords. The bank had also thrown out unshredded documents - marked confidential - of a performance report that highlighted a mix of assets and liabilities, as well as customer loans for its wholesale and retail banking units.
Checks with DBS and OCBC by The Business Times showed that banks typically shred sensitive client documents. The documents should not be discarded in trash bins, recycle bins or other publicly accessible locations.
Source: http://www.straitstimes.com/business/companies-markets/mas-probes-case-of-uobs-unshredded-client-data (http://www.straitstimes.com/business/companies-markets/mas-probes-case-of-uobs-unshredded-client-data)
Source 2: http://themiddleground.sg/2016/06/17/trashure/ (http://themiddleground.sg/2016/06/17/trashure/)
Source 3: http://themiddleground.sg/tag/uob (http://themiddleground.sg/tag/uob)
-
Guard personal data, be wary of cold calls: Experts
25 October 2015 | Seow Bei Yi
While banks have improved their security, consumers should be careful not to give out their personal data and to beware of cold calls in particular, experts have warned.
Mr David Freer, vice-president of Intel Security's Asia-Pacific consumer division, said consumers should read the terms and conditions carefully when giving personal information in return for something such as a gift or free trial.
He added: "If possible, opt out of allowing companies to use the data for other purposes, such as cross promotions."
Mr Alan Lee, a spokesman for security firm Norton, said that in the last year or so, there have been phone scams involving conmen who pass themselves off as staff of courier company DHL and claim that victims' details were used to send parcels containing fake passports or weapons.
"Traditionally, banking has been an area where there is a lot to be compromised or taken advantage of," he added.
An emerging trend is the attacking of the two-factor authentication that banks have adopted, Mr Lee said, noting that this could be done on Android phones using a trojan - malicious software that can steal information, including SMS messages.
Fraud detection systems may detect certain unusual activity, he said, but there could also be " lower accuracy patterns" that they fail to spot.
A DBS Bank spokesman said customers should be careful when they get unsolicited calls from unknown parties. They could take down the caller's name and department before calling the supposed company back on its official number.
Customers should not give out information such as log-in details or one-time passwords over the telephone or e-mail, the spokesman added.
He also gave the following tips:
-
IES users
-
Budget US Android smartphones found secretly sending personal data to China
Natasha Lomas | Nov 16, 2016
Commercial firmware pre-installed on some Android smartphone models sold in the US has been found to be secretly sending highly sensitive data to a third party company based in China, according to an analysis by security firm Kryptowire.
Personal data being transmitted without users
-
In Singapore, small companies risk falling afoul of data protection laws
December 30th, 2016 | by Alfred Siew
A backlit laptop computer keyboard. PHOTO: Colin via Creative Commons
When Singapore
-
Personal data of national servicemen and Mindef staff stolen in breach: 3 things you should know
SINGAPORE - The Ministry of Defence (Mindef) said on Tuesday (Feb 28) that the personal information of some National Servicemen (NSFs) and ministry employees were stolen after a "targeted and carefully planned" attack on one of its computer systems.
Here are three things to know about what happened:
1. Who and what is affected?
Mindef said that it detected a breach in its I-net system, which provides Internet access to NSFs and Mindef staff, earlier in February.
Following investigations, it was discovered that the basic personal data of about 850 NSFs and staff were stolen. This includes their NRIC numbers, telephone numbers and dates of birth. This information is required for I-net account management, according to Mindef.
2. Was classified information stolen?
No. Mindef said that the real purpose of the breach may have been to gain access to official secrets.
The Mindef statement said: "But this was prevented by the physical separation of I-net from our internal systems."
Classified military information is not stored on the I-net systems, and instead use a different computer system with more stringent security features.
3. What action was/will be taken?
According to Mindef, the affected server was disconnected from the I-net system once the breach was deteced, and detailed forensic investigations on the entire system was immediately conducted to determine the extent of the breach.
Other computer systems within Mindef and the Singapore Armed Forces (SAF) are also being investigated as a precaution.
Investigations are still ongoing, but all affected personnel will be contacted within the week.
Mindef said: "They will be informed that personal data had been stolen and to change their passwords for other systems if these use any of the stolen information. They have also been advised to report any unusual activity related to the use of their personal information."
Mindef also clarified that Internet access will continue to be provided to servicemen in spite of this incident.
"We will continually strengthen our cyber defences as the level of targeted attacks is expected to continue and rise," it said.
Mindef added that the Cyber Security Agency and the Government Technology Agency of Singapore have also been informed of the breach to investigate other Government systems. No breaches have been detected so far.
Source: http://news.asiaone.com/news/singapore/personal-data-national-servicemen-and-mindef-staff-stolen-breach-3-things-know (http://news.asiaone.com/news/singapore/personal-data-national-servicemen-and-mindef-staff-stolen-breach-3-things-know)
-
Singapore certification for data protection officers
Mar 13, 2017 | Irene Tham, Senior Tech Correspondent
Singapore's privacy watchdog is developing a local certification programme for data protection officers (DPOs), whose job is to better equip companies for a digital future in which more and more data must be protected.
Besides equipping DPOs to do a better job, it is hoped that the certification programme will also give more recognition to the role and attract more people to take it up.
Experts estimate that there will be more than 10,000 DPO jobs here over the next three years.
Mr Tan Kiat How, commissioner of the Personal Data Protection Commission (PDPC), which was set up by the Ministry of Communications and Information in 2013, told The Straits Times: "Certification will accord DPOs with professional recognition and equip them with the skills and knowledge to better carry out their responsibilities."
Mr Tan said details would be revealed in a later announcement.
The Straits Times understands that the local certification programme will be cheaper than an international one available today.
So far, only 100 DPOs here are certified by the International Association of Privacy Professionals, a not-for-profit organisation based in the United States, said local data protection software firm Straits Interactive, which conducts the training here. Certification costs more than $1,000, even after a 70 per cent government subsidy.
Also, based on the PDPC's survey of 1,513 organisations between March and June last year, only about 40 per cent of organisations here have a DPO on their payroll.
This is despite the appointment being mandated for all organisations by the Personal Data Protection Act, fully enforced in July 2014.
A DPO ensures that organisations safeguard against the wrongful collection, use and disclosure of personal data for marketing, which is required by the law.
Mr Chan Yew Kee, head of development at the Association of Small and Medium Enterprises, told The Straits Times that the 40 per cent DPO rate has not improved much today, as many companies have little understanding of the law.
Ms Lyn Boxall, director of boutique fintech advisory law firm Lyn Boxall, said a DPO looks at the process, whereas an IT manager looks at systems. "It is the DPO's job to vet the process of data flow internally and with third parties, and ensure that there are reasonable security measures in place," she said.
Over the past 2
-
NUS ordered to give student leaders compulsory training on data protection
By Valerie Koh | April 28, 2017
SINGAPORE
-
Privacy Tools
1. http://privacytools.io/ (http://privacytools.io/)
(http://tralvex.com/download/forum/screen_privacytoolsio.gif)
2. https://www.ghacks.net/2015/12/28/the-ultimate-online-privacy-test-resource-list (https://www.ghacks.net/2015/12/28/the-ultimate-online-privacy-test-resource-list)
(http://tralvex.com/download/forum/screen_ghacksnet.gif)
-
NLB manager fined and jailed for giving members' data to loan shark
Shaffiq Alkhatib | The Straits Times | Jul 04, 2017
He worked for the National Library Board (NLB) for six years and had access to its database, which contained the personal information - such as NRIC numbers and contact details - of its 2.4 million members.
Project manager Ang Boon Sin, now 39, repeatedly abused his position, gaining access to the Spydus database to retrieve data on at least 180 NLB members for an unlicensed moneylender known only as Johnson.
He was jailed for three years and eight months, and fined $270,000 on Monday (July 3) after pleading guilty to 10 counts of gaining unauthorised access to computer material, nine counts of assisting an unlicensed moneylender and one count of removing benefits of Johnson's criminal conduct from Singapore.
He committed these offences in 2015; 463 other charges for similar offences were taken into consideration during sentencing.
Deputy Public Prosecutor Marcus Foo said Ang had had financial difficulties since 2001 and later borrowed $5,000 from Johnson that he was unable to repay.
DPP Foo added: "Some time in March 2015, Johnson made the accused an offer to work as his runner. In return, a portion of the accused's debts would be waived in that he would no longer need to pay the weekly interest of $2,500, but the remaining $1,000 monthly for a period of 10 months."
Michelle Maloom Abucay was sentenced to eight months' jail for stealing more than $25,000 worth of property from her employers.
Singapore
Ang accepted the offer and helped the loan shark.
His tasks included creating a website advertising Johnson's illegal business, producing unlicensed moneylending advertisements with graphics, collecting cash from Johnson's runners and making cash deposits.
Johnson also told Ang that he wanted his debtors' contact numbers and updated addresses, so that he could send his runners to them or call them up should they become uncontactable.
He also wanted the particulars of neighbours and employers of his debtors that he could use to track their whereabouts.
DPP Foo said that to date, the authorities have not established Johnson's true identity.
Before handing out the sentence, District Judge Wong Li Tein said Ang's offences could send "a chill down the spine" of NLB members, who make up almost half of Singapore's population.
Stressing that he could have exposed their personal information to loan sharks, she added that he had done the NLB a "great disservice".
Source: http://www.tnp.sg/news/singapore/nlb-manager-fined-and-jailed-giving-members-data-loan-shark (http://www.tnp.sg/news/singapore/nlb-manager-fined-and-jailed-giving-members-data-loan-shark)
-
(http://tralvex.com/download/forum/ndp2017.jpg)
Giant NDP panoramic photo captured more than it probably intended to from the hotels at the back
By Thet Nyi Nyi |Henedick Chng | August 12, 2017
You might have seen the high resolution panoramic picture of the National Day Parade
-
AXA policyholders' data breached after cyber attack
Thursday, September 7, 2017 | Claire Huang
THE personal data of 5,400 past and present policyholders on a health portal of AXA Insurance has been breached following a cyber attack.
In an email sent out on Sept 7 to policyholders, the insurer apologised for the breach, saying that the data exposed were the email address the customer used to correspond, mobile number, policy number of the health plan transacted and date of birth of the individual.
AXA said it has "confirmed that no other personal data was exposed", adding that personal particulars including name, identification number, address, credit card or bank details, health status and claims history have not been compromised.
It said no further action is required of the affected individual "as the information that was compromised is not likely to, on its own, expose you to identity theft".
Together with the notification, AXA also cautioned that the hacker or hackers could attempt to phish additional information from the customers and urged them to be vigilant.
SEE ALSO: Policyholders' data in AXA's health portal breached
AXA has filed a police report on this and is working with the authorities on the matter.
Source: http://www.businesstimes.com.sg/companies-markets/axa-policyholders-data-breached-after-cyber-attack (http://www.businesstimes.com.sg/companies-markets/axa-policyholders-data-breached-after-cyber-attack)
_____________________________________________________________
Policyholders' data in AXA's health portal breached
Friday, September 8, 2017 | Claire Huang
Insurer apologises, says it has secured its portal and is reviewing its IT systems; police report made, MAS also investigating
THE wave of cyber attacks on businesses has claimed another victim: Insurer AXA Singapore has had its health portal hacked into, and the personal data of 5,400 past and present policyholders compromised.
Following this cyber attack some months ago, AXA sent out an e-mail alert on Thursday, signed by its data-protection officer Eric Lelyon. In it, he apologised for the breach, and said the data exposed comprised the customers' e-mail address, mobile number, policy number of the health plan transacted and date of birth.
He said AXA has "confirmed that no other personal data was exposed"; particulars such as name, identification number, address, credit card or bank information, health status and claims history, among other details, were not compromised.
No further action is required of the affected individuals because " the information that was compromised is not likely to, on its own, expose you to identity theft", Mr Lelyon wrote.
Together with the alert, AXA sent out an advisory to warn affected individuals to be vigilant, because the hacker or hackers could try phishing additional information from them.
AXA has filed a report; the police told The Business Times that "investigations are ongoing".
Jean Drouffe, chief executive of AXA Singapore said in a statement on Thursday: "AXA takes customer privacy very seriously, and we apologise to all our customers impacted by this incident. We wish to assure our customers that our health portal is now secure. A thorough review of our IT systems is under way. No financial or health data was compromised.
"On its own, the compromised data will not result in identity theft, but we nonetheless see the importance of alerting our impacted customers to be vigilant against potential phishing and risk of identity theft."
He said that the insurer has notified most of its affected customers and will reach the remaining ones by Friday. He added that customers who wish to contact AXA for information may do so through its hotline, +65 6880 5588, or by e-mailing customer.care@axa.com.sg.
The Monetary Authority of Singapore (MAS), told of the breach, said: "MAS has asked AXA to initiate a thorough review of its IT security and to remediate control gaps. We understand that AXA has taken steps to address the vulnerability in its health portal. MAS takes a serious view of this incident and is investigating the matter."
When contacted, Anthony Lim, principal consultant at cyber security company Fortinet, noted that of the four pieces of information compromised, two were communication methods and the other two, pertinent data. This leaked information would make any phishing attempt more convincing, he said.
"Ninety per cent of people don't know what their insurance policy numbers are and that's scary, because the hackers can send a phishing e-mail with the correct policy number and sound authentic.
"The problem right now is that even if the insurer has a real electronic-notification exercise, customers won't take it seriously."
His advice to those affected is to ignore all electronic communication from the insurer relating to the affected policy or the portal. This could pose a problem to the insurer, but Mr Lim quipped: "It's okay to ignore, because when has anything important been done through e-mail?"
The Singapore edition of PwC's Global State of Information Security Survey (GSISS) 2017 reported that more than 80 per cent of businesses here have detected at least one security incident in the last 12 months. In more than a third of these breaches (35 per cent), customer records were compromised.
The study, done between April 4 and June 3 last year, stated that about 40 per cent of the 79 executives polled said their organisations had fallen victim to phishing in the past 12 months, making it the most pervasive cyber security and privacy threat faced by organisations in Singapore, the Asia-Pacific and globally.
In a 2016 report, PwC said a third (33 per cent) of businesses in Singapore had estimated that between S$100,000 and S$499,999 in financial losses came from security incidents.
The Cyber Security Agency of Singapore (CSA) said: "CSA is aware of the data breach of AXA's systems. We understand that the matter is still under investigation. Nevertheless, this incident is a reminder that companies that collect and hold customer data are an attractive target for cyber criminals. Hence, they need to make the appropriate risk assessment, prioritise cyber security and adopt pro-active measures to better protect themselves against cyber attacks."
AXA's cyber security incident comes to light two weeks after Singapore's financial sector underwent simulated terrorist and cyber attacks to check on the soundness of the plans in place for a crisis. The exercise involved 139 financial institutions such as banks, insurers, finance companies, industry associations, the Singapore Exchange and MAS.
This is not the first data breach involving an insurer. Last October, printer Toh-Shi Printing Singapore, hired by Aviva, was fined S$25,000 by the Personal Data Protection Commission Singapore (PDPC) for data breaches involving the insurer's policyholders. Nearly 7,800 policyholders received erroneous statements that disclosed the personal data of 8,022 individuals, including the policyholders' dependants.
Source: http://www.businesstimes.com.sg/banking-finance/policyholders-data-in-axas-health-portal-breached (http://www.businesstimes.com.sg/banking-finance/policyholders-data-in-axas-health-portal-breached)
-
(http://tralvex.com/download/forum/2017%20PDP%20Digest.gif)
Source (413 pages): From PDPA Website (https://www.pdpc.gov.sg/docs/default-source/publications-edu-materials/pdp-digest-2017---270717.pdf?sfvrsn=2) | Cache (http://tralvex.com/download/forum/20170727_pdp-digest-2017.7z)
-
(http://tralvex.com/download/forum/20171012_Airbnb_SpyCam.jpg)
This couple was horrified to find a camera in the bedroom of their Airbnb
Lilian Min | Oct 12, 2017
Derek Starnes and his wife just wanted to enjoy a nice holiday in Florida at their Airbnb, when Starnes, who works in the tech world, noticed something weird about the bedroom smoke detector. When he went to check it out, what looked like a curious black spot on the side ended up being a hidden camera recording onto an SD card.
The couple, from Indiana in the States, naturally reported their finding to the police, who then arrested the host, 56-year-old Wayne Natt. He's been charged with one count of video voyeurism, but in his defence: Natt claims he'd rigged the camera up for the explicit intent of filming sex parties between consenting adults. According to local Lieutenant Bob Bourque :
"[Natt] says that everyone videoed had knowledge he was videoing them. What we said to that was… if people are consenting to recording sexual activity why is it hidden in a smoke alarm? He said it was for recording sexual activity."
As for the right-above-the-bed angling? It "gave him a better angle," according to Bourque, who also shared:
"We seized a lot of computer storage data devices, hard drives, computers, laptops SD cards anything that would store data. We don’t know if there are local victims someone who may have been dating him or a companion that doesn't realise they are being videotaped, and then we have the other side of who he rented to through Airbnb."
Natt had been active on Airbnb for two years. Starnes shared to ABC, "My wife and I are distressed by this situation. I hope more victims will come forward."
A spokesperson for Airbnb shared:
"We are outraged at the reports of what happened; as soon as we were made aware, we permanently banned this individual from our community and fully supported the affected guests. Our team has reached out to local law enforcement to aid them with their investigation of this egregious offence and we hope justice is served. We take privacy issues extremely seriously and have a zero-tolerance policy against this behaviour."
Source: https://www.cosmopolitan.com/uk/reports/a12835256/airbnb-bedroom-cameras-sex-parties/
-
46.2 Million Malaysian Mobile Phone Numbers Leaked From 2014 Data Breach
31 Oct 2017 | Vijandren
Following up on our report on 19th October, we can now confirm that roughly 46.2 million mobile phone numbers from Malaysian telcos and mobile virtual network operators (MVNO) have been leaked online.
The leak includes postpaid and prepaid numbers, customer details, addresses as well as sim card information
-
Xinmin Secondary School students' NRIC numbers leaked on file sharing site Pastebin
Nov 18, 2017 | Irene Tham
SINGAPORE - The NRIC numbers of hundreds of students at Xinmin Secondary School were leaked in the second known data breach by a Ministry of Education (MOE) school since March 2015.
The information was posted a few months ago on file-sharing website pastebin.com, but The Straits Times understands that it has since been taken off the site and a police report has been made.
Xinmin Secondary School's vice-principal Tan Kuo Cheang confirmed with ST on Saturday (Nov 18) that the school was alerted "to a data breach involving a leak of our students' personal information on pastebin.com" on Sept 28.
The school immediately contacted the website, asking for the information to be removed, and also filed a police report.
It then contacted its students to alert them of the leak and to share cyber security measures that they could take, such as avoiding using NRIC numbers as passwords.
Mr Tan declined to comment further as investigations are ongoing.
When contacted, a spokesman for MOE said: "In line with government IT security policies, MOE has stepped up efforts to work with schools and ensure that their security measures continue to be effective."
She added: "As investigations are ongoing, we are unable to share more."
In March 2015, the personal data of more than 1,900 pupils from Henry Park Primary School were exposed.
An Excel spreadsheet containing the children's particulars was mistakenly sent out to about 1,200 parents as part of an update about a school event. The file contained the names and birth certificate numbers of all 1,900 pupils in the school, and the names, phone numbers and e-mail addresses of their parents.
MOE schools such as Xinmin Secondary and Henry Park are exempted from the Personal Data Protection Act, fully enforced from July 2014. The Act requires organisations to take "reasonable measures" to protect personal data in their possession.
Instead, MOE schools are governed by public-sector rules, which have not been made public.
Technology lawyer Bryan Tan of Pinsent Masons MPillay said: "The Government said that its standards are more stringent than those that govern the private sector. But when a public incident like this happens, we can assess whether the first statement is true."
Lawyer Mr Koh Chia Ling from law firm OC Queen Street said that the students have no recourse. "Even if they do, it might be difficult for them to show any loss suffered from negligence or breach of contract," he said.
Source 1: http://www.straitstimes.com/tech/xinmin-secondary-school-students-nric-numbers-leaked-on-file-sharing-site-pastebin7 (http://www.straitstimes.com/tech/xinmin-secondary-school-students-nric-numbers-leaked-on-file-sharing-site-pastebin7)
Source 2: http://www.tnp.sg/news/singapore/schools-data-breach-spooks-students (http://www.tnp.sg/news/singapore/schools-data-breach-spooks-students)
-
Uber Paid Hackers to Delete Stolen Data on 57 Million People
Eric Newcomer | November 22, 2017
Uber Paid Hackers to Keep Massive Cyberattack Quiet.
Hackers stole the personal data of 57 million customers and driversfrom Uber Technologies Inc., a massive breach that the company concealed for more than a year. This week, the ride-hailing firm ousted its chief security officer and one of his deputies for their roles in keeping the hack under wraps, which included a $100,000 payment to the attackers.
Compromised data from the October 2016 attack included names, email addresses and phone numbers of 50 million Uber riders around the world, the company told Bloomberg on Tuesday. The personal information of about 7 million drivers was accessed as well, including some 600,000 U.S. driver
-
Obike exposed user data
Von: Robert Schöffel, Maximilian Zierer and Steffen Kühne | 30.11.2017 | Archiv | Bildnachweis
Munich, Berlin, Frankfurt, Hanover - in a growing number of German cities Obike offers bikes for rent. BR Data and BR Recherche have discovered a leak in the data maintained by the provider of the yellow bikes. Until recently, personal and location data of users around the world were accessible online without any protection.
Names from Germany, mobile phone numbers from Switzerland, e-mail addresses from Great Britain, profile pictures from Malaysia. Journalists from BR Data and BR Recherche were able to access user data of the bike rental company Obike on the internet. The data was neither encrypted nor otherwise protected, even exact location data of rides was exposed for at least two weeks. Obike users all over the world were affected by this leak.
BR investigations show that the social media functions of the smartphone app were particularly problematic. The Obike app gives users the opportunity to share invitation codes and finished rides on social networks. By doing this, users gave direct access to their personal data, without noticing it. Criminals could have used this safety gap to copy customer data - even of users who have not shared anything. After the BR had confronted the company with the data leak, the security gaps were closed. Obike informs in a written statement:
"Obike does everything to quickly fix any safety gaps and protect user data."
The BR sent a test person on a ride with an Obike. Afterwards, the location data was online accessible without any protection.
On the black market, user data like Obike's is worth a lot of money. Last week, a data breach at the US transport service provider Uber hit the headlines. The company paid hackers $100,000 to destroy the stolen email addresses and phone numbers of customers.
Though the data leak at Obike has been fixed in the meantime, the careless handling of user data could still have consequences. The Bavarian State Office for Data Protection Supervision (Landesamt für Datenschutzaufsicht) confirmed the BR that the data leak is a violation of the Data Protection Act: "In our opinion, the company Obike commits a data protection violation because the data security requirements are not met," said President Thomas Kranig. As Obike has its German headquarter in Berlin, the BR investigations have alerted the Berlin data protection commissioners:
"In preparation for a control procedure, the Berlin commissioner for data protection and freedom of information is currently examining her responsibility for this issue."
Berlin data protection commissioner (Berliner Datenschutzbeauftragte)
There is also another problem with Obike: In the opinion of data protection officer Thomas Kranig, the provider of rental bicycles violates transparency rules. When downloading the app, Obike does not make clear what kind of user data it collects and what happens with this data: "There is information that they create movement profiles and that they provide the data to affiliated companies. But the user does not know for what purpose and which companies exactly receive these movement profiles," says Kranig.
Trademark rights in the tax haven
It's hard to find out which companies are associated with Obike. Obike is backed by an international network of companies: OBG Germany GmbH, oBike Asia Pte Limited in Singapore or Obike Inc. in the tax haven British Virgin Islands. Obike also shares business addresses or employees with Avazu and DotC United - companies that earn money with online and app advertising. Obike denies sharing its user data with these companies and, upon request, states in written form: "Today, Obike's business model in Germany does not provide third-party advertising in the app." The European Union trade mark rights of the brand Obike are held by DotC United Inc., which is also registered in the British Virgin Islands.
Tax expert Gerhard Wipijewski from the Bavarian Finance Union (Bayerische Finanzgewerkschaft) has experience with similar company constructs:
"Without knowing the specific case, it can be assumed that the price for the trademark usage is very high. Just a small part of the here generated profit remains in Germany. Most of the potential earnings flow to foreign countries, land on the British Virgin Islands and will be almost tax-free."
Gerhard Wipijewski, Bavarian Finance Union (Bayerische Finanzgewerkschaft)
Obike informed the BR that Dotc United had owned the trademark rights because Obike had been still in the start-up phase when the company had launched in Europe in June this year. All revenue of Obike in Germany had been taxed in Germany.
Meanwhile, Obike is expanding further. This year, the yellow bikes will also be installed in cities such as Prague, Athens, Budapest and Lisbon. In Germany, Obike now also wants to offer its service in smaller municipalities. Landshut's mayor Alexander Putz for example already posed with a bike of the company on Facebook and called the concept of Obike exciting. However, he did not know the BR investigations at that point. Now he is reconsidering that.
Annotation
User data was exposed for at least two weeks. We also received information from IT security experts in Taiwan that the data leak had already existed in June 2017 and that they had informed Obike several times. This case is documented here.
The second security vulnerability was closed on Wednesday, November 29, 2017, after we had informed Obike again.
Not only users in Germany were affected. We were able to see names, phone numbers, profile pictures and movement profiles of users from numerous countries, such as Great Britain, Singapore, Malaysia or Switzerland.
Source: https://www.br.de/nachricht/datenleck-obike-104.html (https://www.br.de/nachricht/datenleck-obike-104.html)
-
AGC sets out arguments for bringing case against Li Shengwu
Seow Bei Yi | 9 December 2017
Mr Li Shengwu, 32, may have put his Facebook privacy settings on "friends only" when he published a post that allegedly attacked the independence of Singapore's judiciary, but this does not entitle him to claim privacy, the Attorney-General's Chambers (AGC) has argued.
It made the point in written submissions filed in the High Court, for bringing contempt of court proceedings against Mr Li, the nephew of Prime Minister Lee Hsien Loong.
The AGC said that as he chose the medium of publication, it should be taken that he was fully aware the post could be disseminated to a broader audience.
This could therefore "pose a real risk of undermining public confidence in the administration of justice", it added in documents obtained by The Straits Times yesterday.
The papers, filed in August, set out the arguments for the AGC moving forward with its case against Mr Li, the eldest son of Mr Lee Hsien Yang and a junior fellow at Harvard University in Massachusetts in the United States.
Documents also revealed he had been served court papers on Oct 17 at his work space at the university by a US-based legal services firm.
This was after "multiple unsuccessful attempts" made at Harvard University, and at his home in Cambridge. The US firm tried 11 times on seven different occasions between Oct 2 and Oct 14, but to no avail, according to the court documents.
On Monday, Mr Li's lawyers in Singapore said they needed time to address the "novel grounds" the AGC used to justify serving the papers out of its jurisdiction. They said they would be applying to set aside the court order that allowed the AGC to serve papers on their client in the US.
The case centres on a July 15 Facebook post in which Mr Li said "the Singapore Government is very litigious and has a pliant court system", and that foreign media had been cowed into self-censorship because of previous legal action.
The AGC had earlier served papers against Mr Li Shengwu for contempt of court, in relation to a Facebook post he made.
Although the post was put to a "friends only" privacy setting, it was published by several websites and circulated on social media.
Mr Li previously said it was not his intent to attack the judiciary.
He also said he would not have given approval for his private post to be shared publicly and was, thus, not responsible for its "widespread and unauthorised publication".
The post was related to a family dispute over the fate of founding Prime Minister Lee Kuan Yew's home at 38, Oxley Road. It spilled into the public sphere in June.
The AGC argued that for the case to proceed, it is not necessary to prove Mr Li intended to undermine public confidence, only that he intentionally published the post.
Mr Li subsequently changed parts of it, but the AGC said his amendment of the post to clarify its meaning showed he was aware the phrase "pliant court system" was open to being understood at face value.
The AGC added that "it is irrelevant whether the material was posted outside Singapore".
It said, "since it can be accessed in Singapore, its publication occurs in Singapore".
The next pre-trial conference is expected to take place on Jan 4.
Source: http://www.straitstimes.com/singapore/agc-sets-out-arguments-for-bringing-case-against-li-shengwu (http://www.straitstimes.com/singapore/agc-sets-out-arguments-for-bringing-case-against-li-shengwu)
-
Trump campaign consultant took data about millions of users without their knowledge
Facebook targeted in federal investigation of Cambridge Analytica
By Craig Timberg , Elizabeth Dwoskin and Tom Hamburger | March 18, 2018
Facebook’s recent suspension of Cambridge Analytica, a data analytics firm that played a key role in President Trump’s 2016 campaign, highlights the rapid rise of a company that claimed it had reached new heights in marrying the art of political persuasion with the science of big data.
Four years after the company began offering Republican political candidates the promise of groundbreaking tools for delivering political messages tailored to the psychological traits of voters, serious questions remain about its tactics and effectiveness.
What is clear is that the services Cambridge Analytica offered are increasingly coveted by modern political campaigns. Yet Facebook users had few indications of how their personal data was collected, refashioned and deployed on behalf of candidates.
A Cambridge University professor working for Cambridge Analytica in 2014 created an app, called Thisisyourdigitallife, that offered personality predictions and billed itself on Facebook as “a research app used by psychologists.”
The professor, a Russian American named Aleksandr Kogan, used the app to gain access to demographic information — including the names of users, their “likes,” friend lists, and other data. Once obtained by Cambridge Analytica, political campaigns could use those profiles to target users with highly tailored messages, ads or fundraising requests.
Facebook said 270,000 people downloaded the app. But people familiar with how such systems work — including a former Cambridge Analytica employee — said the app would have given Cambridge access to information on the friends of each of those people, a number that almost certainly reached into the tens of millions.
The Observer of London and the New York Times reported Saturday that Cambridge Analytica had gained access to information on 50 million Facebook users, citing internal documents and interviews with former employees and associates.
Facebook declined to confirm or deny this number. It issued a statement noting its past actions to limit access to this kind of personal information, which, until changes were made in 2014 and 2015, was routinely available about any users who did not explicitly act to prevent the release of what “like” buttons they had hit.
“In 2014, after hearing feedback from the Facebook community, we made an update to ensure that each person decides what information they want to share about themselves, including their friend list,” the statement said.
Facebook on Friday banned Kogan, the parent company of Cambridge Analytica and a former Cambridge employee for improperly sharing the data and failing to destroy it after concerns arose about it in 2015. Facebook had asked the parties back then to certify they would not abuse data, but it did not take further action beyond that warning.
Despite Facebook’s concerns in 2015, the social network continued to work with Cambridge Analytica. During the presidential election, Facebook employees assisting Donald Trump’s digital operation worked in the same office as Cambridge Analytica workers, according to a video by the BBC. One former Cambridge employee, Joseph Chancellor, continues to work at Facebook as a user- experience researcher, according to Facebook’s public website.
Some critics said Facebook’s actions on Friday were an insufficient response to a far-reaching data grab that had informed the decision-making of multiple political operations. Trump’s campaign paid Cambridge Analytica at least $6 million for data analysis in the final five months of a close election.
“This is more evidence that the online political advertising market is essentially the Wild West,” said Sen. Mark R. Warner (Va.), the top Democrat on the Senate Intelligence Committee, in a statement. “Whether it’s allowing Russians to purchase political ads, or extensive microtargeting based on ill-gotten user data, it’s clear that, left unregulated, this market will continue to be prone to deception and lacking in transparency.”
Cambridge Analytica — which was funded by Trump supporter and hedge fund executive Robert Mercer, and once had on its board the president’s former senior adviser Stephen K. Bannon — has denied wrongdoing. The company has said its “psychometric profiles” could predict the personality and political leanings of most U.S. voters.
“We worked with Facebook over this period to ensure that they were satisfied that we had not knowingly breached any of Facebook’s terms of service and also provided a signed statement to confirm that all Facebook data and their derivatives had been deleted,” Cambridge Analytica said in a statement Saturday.
The company’s actions in the United States and abroad have generated scrutiny from government investigators in Britain and the United States, who have been looking at Russian interference in elections.
In December, the Wall Street Journal reported that special counsel Robert S. Mueller III had requested documents from Cambridge Analytica, including copies of emails of any company employees who worked on the Trump campaign. On Saturday, a day after Facebook banned Cambridge Analytica, Massachusetts Attorney General Maura Healey (D) said she was opening up a probe into Facebook in response to news reports about Cambridge Analytica.
Elizabeth Denham, Britain’s information commissioner, also said Saturday that she was investigating whether Facebook data “may have been illegally acquired and used.”
The investigation is part of a broader probe, launched last year, into how political parties are using data analytics to target voters. “It is important that the public are fully aware of how information is used and shared in modern political campaigns and the potential impact on their privacy,” Denham said in a statement.
Cambridge Analytica has faced ongoing allegations in Britain that it was involved in the 2016 E.U. referendum, or Brexit vote. The head of Cambridge Analytica, Alexander Nix, recently appeared before a British parliamentary committee that is investigating fake news and denied claims that his company worked for Leave.E.U., a pro-Brexit group.
While Nix was giving evidence, the co-founder of Leave.E.U., Arron Banks, tweeted “Nix & Cambridge Analytica are compulsive liars.”
Despite years of reports of developers abusing data, Facebook’s processes for dealing with developers who broke the company’s rules were lax, said two former Facebook employees whose job it was to review data use by third parties. The company does not audit developers who siphon data, the people said. If a developer was found to have broken the rules — usually because of a story in the news — the company would give them a warning or kick them off the platform, but it did not take steps to ensure that data taken inappropriately had been deleted, they said.
Sandy Parakilas, a former privacy manager at Facebook, said that during his tenure at Facebook, the company did not conduct a single audit of developers.
Facebook “relied on the word of Kogan and Cambridge Analytica to delete the data, rather than conducting an audit, which they had a right to do in the case of Kogan. They did not investigate further even after it became clear that CA had bragged about having 5,000 data points on every American, data which likely came from Facebook. They only banned Kogan and CA yesterday to get in front of the press cycle,” Parakilas said. “During my 16 months at the company, I don’t recall Facebook ever using its audit rights on a developer.”
Technology researchers also criticized Facebook and Cambridge over the weekend.
“Cambridge Analytica overstates their capabilities because they play in the shadows. They willingly cheat and ignore privacy rules and data ethics in order to win,” said social media analyst Jonathan Albright, research director of the Tow Center for Digital Journalism at Columbia University.
Analysts raised legal questions about Facebook’s actions on Saturday, including if it ran afoul of its 2011 consent decree with the Federal Trade Commission. That decree specified that Facebook must give consumers clear and prominent notice and obtain their express consent before their information is shared beyond the privacy settings they have established.
The question of whether Cambridge used the data from the 270,000 people to mine information about their friends could constitute a breach of its agreement, said Siva Vaidhyanathan, a professor of media studies at the University of Virginia.
In a statement, Facebook said, “We reject any suggestion of violation of the consent decree. We respected the privacy settings that people had in place. Privacy and data protections are fundamental to every decision we make.”
After launching its services for congressional candidates in the 2014 cycle, Cambridge Analytica made a dramatic public entry into U.S. presidential politics in 2015, working on what was touted at the time as a groundbreaking voter outreach effort on behalf of Sen. Ted Cruz (R-Tex.). At first, Cruz campaign officials credited Cambridge’s “psychographic targeting” techniques — including its use of Facebook data — with elevating Cruz to the top tier of presidential hopefuls. But later, some officials expressed disappointment in some of Cambridge’s work.
The company initially surveyed more than 150,000 households across the country and scored respondents using five basic traits: openness, conscientiousness, extroversion, agreeableness and neuroticism. Cruz campaign officials said the company developed its correlations in part by using data from Facebook that included subscribers’ likes. That data helped make the Cambridge data particularly powerful, campaign officials said at the time.
Cambridge’s work for the Cruz campaign ultimately proved uneven, according to campaign officials, who said that while the firm’s data scientists were impressive, the psychographic analysis did not bear fruit as hoped.
Cambridge Analytica then moved on to serve as the Trump campaign’s data-science provider. While company officials said they did not have sufficient time to employ psychographics in that campaign, they did data modeling and polling that showed Trump’s strength in the industrial Midwest, shaping a homestretch strategy that led to his upset wins in Michigan, Wisconsin and Pennsylvania.
SCL, Cambridge’s parent company, has said it has worked in 100 countries, including serving military clients with techniques in “soft power,” or persuasion. Nix described it as a modern-day upgrade of early efforts to win over a foreign population by dropping propaganda leaflets from the air.
Among its clients: NATO’s Strategic Communications Center of Excellence, which hired SCL to conduct a two-month training session in 2015 at its Riga, Latvia, facility for NATO personnel, followed by additional sessions in Ukraine, Moldova and Georgia, officials said. The nearly $1 million contract was financed by Canada, as part of its support to help NATO allies counter Russia’s influence in the region.
SCL’s main offering, first developed by its affiliated London think tank in 1989, involves gathering vast quantities of data about an audience’s values, attitudes and beliefs, identifying groups of “persuadables,” and then targeting them with tailored messages. SCL began testing the technique on health and development campaigns in Britain in the early 1990s, then branched out into international political consulting and later defense contracting.
In a 2015 article for a NATO publication, Steve Tatham, a British military psychological operations expert who leads SCL’s defense business outside of the United States, explained that one of the benefits of using the company’s techniques is that it “can be undertaken covertly.”
“Audience groups are not necessarily aware that they are the research subjects and government’s role and/or third parties can be invisible,” he wrote.
Source: https://www.washingtonpost.com/business/economy/trump-campaign-consultant-took-data-about-millions-of-users-without-their-knowledge/2018/03/17/bab541f4-2a18-11e8-ab19-06a445a08c94_story.html
-
Under Armour says 150 million MyFitnessPal accounts compromised in data breach
Hackers obtained user names, email addresses, and hashed passwords
By Nick Statt@nickstatt Mar 29, 2018, 5:34pm
Sportswear brand Under Armour announced today that its subsidiary MyFitnessPal was affected in a significant data beach, compromising as many as 150 million accounts. Account information involved in the breach includes user names, email addresses, and hashed passwords, but no financial information like credit card numbers or government or identifiers like social security numbers.
Under Armour acquired MyFitnessPal, a website and mobile app for tracking diet and exercise activity, in 2015 for $475 million, when MyFitnessPal had 80 million users. The service has since more than doubled in size thanks in part to the company
While the breach has not exposed particularly sensitive user data, it is a significant number of users and the situation will necessarily affect Under Armour’s stock, with shares dropping almost 4 percent in after-hours trading. Under Armour says it was made aware this past weekend of the breach, which occurred some time in February. The company has been working to notify affected users and is expected to work with the police and data security firms to try and trace the source of the breach.
“Four days after learning of the issue, the company began notifying the MyFitnessPal community via email and through in-app messaging. The notice contains recommendations for MyFitnessPal users regarding account security steps they can take to help protect their information,” Under Armour said in a statement. “The company will be requiring MyFitnessPal users to change their passwords and is urging users to do so immediately.”
Source: https://www.theverge.com/2018/3/29/17177848/under-armour-myfitnesspal-data-breach-150-million-accounts-security
-
Online Privacy Guide: 9 Steps to Security in the Digital Age
Chase Williams | 07 May 2018
Introduction
It is no great secret that online security is becoming more important. In the digital age, more assets, funds and confidential data are stored online. And this trend will continue as the internet of things starts to develop. This means that it is important to keep up to date with the best security practices. It is not overly complex or difficult to keep your online profile safe and secure.
Aside from keeping sites secure, there is a general need to keep your general privacy safe from prying eyes. It is no longer a secret that many large companies keep track of data and sell it to government and corporate entities. It has become important to put protocols in place that kept your online activity safe. Even if you have nothing to hide, there is never a reason for somebody to monitor your data without consent. The recent Cambridge Analtyica affair is the latest in a long string of digital based privacy scandals. This online privacy guide will outline the steps you need to take to ensure online security.
By 2020, the average cost of a data breach will reach $150,000 and since 2013 there have been nearly 4 million records stolen from data breaches every single day. That is 44 per second. Cybercrime is projected to cost the world $6 trillion by 2021 according to firm CyberSecurity Ventures. This would be the greatest transfer of wealth in history.
It is no longer possible to ignore online security and privacy. The risks are too great, both from hackers as well as online companies with a history of a failure to protect customers as well as directly violating digital privacy laws. It is your job to keep up to date in an insecure digital era. Thankfully, it is quite easy to keep your web identity safe with a few simple practices, outlined below. The main considerations in terms of online security are privacy of internet activity, Two Factor Authentication and password maintenance.
1. VPN
VPN stands for Virtual Private Network. What is important to understand is that the internet is just a network of webpages. In order to connect to a webpage, you connect to a particular server. And when your machine makes this connection, it is vulnerable to a hack. When your computer is not connected to a network, it is offline, and thus invulnerable, for all intents and purposes. When data is stored online in a device not connected to the internet, it is known as “hot storage” and is far more vulnerable to an attack. This is because online information is all kept on a network, called the internet. Hackers have access to this network, as does everybody.
But when you use a VPN, your computer goes to the VPN first, and through the VPN it connects to the server of the webpage. The VPN encrypts the connection, so even if the connection was intercepted by a hacker, they will not be able to read it. Your online privacy is improved. Additionally, your IP will be given a different address, so nobody can pinpoint your location. While the concepts can be a little tricky, VPN’s are very easy to use. You simply install the VPN and start it. It will then automatically encrypt all your internet activity, in the background. This is why it is one of the best ways to secure your online data. While there are free VPN’s it might be a better bet to simply purchase a good VPN with a yearly subscription. They can range from $30 to $50 and will do an excellent job.
There are now a number of VPN’s that have proven their worth over the years. These include HMA VPN, which has been in operation for 11 years and is part of the Avast family, a large security corporation. The VPN is fast and can be used on multiple platforms and devices. Express VPN and IP Vanish are other good alternatives. None of these companies keeps client logs. And they have multiple servers across the world for faster speeds. A VPN is by far the most secure way to ensure digital privacy on the web, where all activity is now monitored.
2. Two Factor Authentication
This is quite possibly the most effective and important feature you can enable. It is definitely worth taking the time to set this up and use it on all sites. It reduces your chances of getting hacked on any site down to nearly zero. 2 Factor Authentication (2FA) is so effective that the FBI even endorsed it in their National Cyber Security Awareness Month campaign. Though this campaign is over 3 years old, 2FA is still the best defense against cyber criminals and is the most effective way to protect all your online accounts.
What happens with Two Factor Authentication (2FA) is that when you log on to a site using a different computer or IP address, you will get either an email alert or a phone alert. You can only log in with the code given via email or phone alert. Using this “second” factor of authentication, hackers will need more data to hack into your sites. You can use email 2FA, and while this is very effective, it is not as efficient as Google Authenticator. The difference is that with email 2FA, you will access your email on the same computer and verify it from there. While it is more difficult, if hackers have access to your website credentials they could also have access to your email address. A compromised computer is a compromised computer, with all your info on it. A second device can add an extra layer of security.
With Google Authenticator, a number is generated on your phone via the app every 30 seconds or so. Hackers need your physical phone as well as your online username and password. This is very nearly impossible, and it is just not realistic for them to get this data with the added physical element. For all they know, you could have $.20 in your account. Once you tie your online information with a physical device, the chances of getting hacked are exponentially reduced. Google Authenticator can be downloaded from the Google Play Store and is available for both Android and IOS. Alternatively, you can get an SMS message. But this is not suitable for those who are not comfortable giving away their mobile number, and will not work for frequent travelers. If you are using email as a form of 2FA, then make sure to use 2FA on your email account also. If you get the option to enable 2FA on any online site, make sure to select it. It really is the difference between a secure account and an insecure account.
3. Password Managers
The number of online sites and platforms that people are using is increasing. And so are the number of usernames and passwords. A system of password management is more or less a necessity. You can use a dedicated password management service (sometimes called password vaults) to help with this issue. Many people can have over a hundred usernames and passwords for different sites, which could include financial accounts, exchanges, email services, social media and shopping sites, to name a few. And the fact is that most people use the same username and password on all sites. This is actually quite normal and natural. There is no way that people could remember 100 different usernames and 100 associated passwords.
There are advantages and disadvantages to password vaults. The obvious advantage is that all your passwords and usernames are stored securely, and you can easily access all your different sites. You can have a number of different and complicated passwords for each site, and because the sites are logged into automatically with encryption, a hacker will not pick up on your username and password. Different password managers come with different features. Some can log into the sites for you, others can let you know if you are using the same password on too many sites, and the best of them will give customers the ability to be used only on a single device or multiple devices. This means that the data will be stored on your local device(s) and not on their servers, where it could be hacked.
There is no doubt that passwords managers are easier to use and will make it very easy to log in to your favorite sites. They automatically generate a login and secure password for each site, which you can use to login quickly. Filling in multiple passwords and usernames can also be time consuming. On the other hand, password manager breaches have occurred, as they are a target for hackers. And if there is key logging software installed on your computer, then it is entirely possible that your password to your password manager is compromised. Yet again, 2FA is the only thing that can come to the rescue here, and not all password vaults have 2FA enabled.
Password managers are safer in many ways and more dangerous than others. Overall, the benefits do outweigh the risks, especially opposed to keeping a spreadsheet of passwords and usernames. The most common password is still “123456” followed by “password”, so a password manager is still very effective in comparison to regular security practices. It goes without saying that some password managers are far better than others. Good password managers include LastPass and 1Password, despite some security flaws. Most security experts do recommend password managers, in conjunction with 2FA and other practices.
4. Self Encryption
An alternative to a password manager is to self encrypt your password. This is a lot easier than most people think. You can keep a written or online sheet with passwords, as long as you encrypt them. So the password Alan Shearer 101 would be encrypted to AS_@101. You could use this password with some variants on different sites, such as AS_*102 for Alan Shearer 102. A simple, clever and extremely effective way to encrypt passwords. Even if the spreadsheet gets compromised, it is next to impossible to work out, as you have given the hacker some extra characters to contend with. Most sites only give 3 attempts before 2FA or a wait period is triggered, so brute force efforts will not work. There are an infinite number of ways to self encrypt passwords, which is why it is the best way to secure your password. You, and only you, can decipher it.
5. Email, Browsers and Search Engine Services
Changing the way you browse the internet and send messages can have an impact on the levels of internet privacy. You could use an alternative search engine such as DuckDuckGo instead of Google. These search engines do not collect data and encrypt connections where possible, and also work to prevent advertisers tracking which sites you look at. DDG is not as good as a VPN, as it does not hide IP addresses when you log into a site. But it definitely beats using Google. DDG also acts as an adblocker for irritating popups.
Instead of Gmail, you could use secure email services such as Protonmail, who are based in Switzerland. This email service is based on security and privacy, and all messages are encrypted. Switzerland is also a little friendlier to civil liberties so the chances of a court ordering them to hand over sensitive data is not as high. If you are using standard email services, then you can get add ons that will encrypt your emails.
As far as search engines go, the most secure one is Tor, which acts as a VPN. However, it can be slow. Good alternatives to Tor include Mozilla and Brave. While most web browsers have an incognito mode which you can use, it is quite ineffective. The connection is not secured, unlike the services provided by VPNs. It just means that your activity is not recorded on the device you are using. In fact, it is a useful feature for people using your device without permission.
6. Ad and Web Activity Blockers
Web activity trackers consist of various types of trackers that monitor you wherever you go on the web. These include social media trackers, traffic analytics from websites, widgets and general media trackers. All of these are designed to track your activity, usually for commercial purposes, and they make your computer slower. One thing you can do to get around this is to use a third part application like Ghostery. It is free and simple to use, blocking all web trackers.
Ads are different from trackers. They can come in a variety of forms. Many ads can get users to click on affiliate links to earn money. These include online streaming sites with “x” marks in random places which do not exit from the ad but take users to an affiliate site. These ads are often targeted and are linked with web activity trackers. Based on your previous activity, a personalized ad will show up on your screen. The best way around this is to install an ad blocker. These are free add ons for all browsers such as Adblock Plus and Unblock Origin.
7. Update Your Applications
Though it can be a pain, it is also a good idea to regularly update your applications. These updates are often in response to identified vulnerabilities in the system. Which means that if you fail to update your application, then it is likely more vulnerable to viruses. On top of this, older versions have been around longer, so most viruses are aimed towards these older editions. An example of this is that Windows computers have far more viruses in them than Mac or Linux. This is simply because most of the existing malware was built towards Windows machines, which have been around longer, and which are used by the majority of people. Another thing to remember is that some applications and devices are no longer supported. This means that they are not being updated with security patches so they are more vulnerable to hacks. Smartphones are a prime example where older versions do not get security updates.
8. Avoid Phishing Scams
When accessing sites you regularly use, be sure to bookmark then. What can happen is that sites are set up that mimic the official site very closely. When you key in your username and password, the fake site will have your information. This is known as a phishing scam. It is very common. Again, 2FA will eliminate this issue in many instances. You can also look at the green padlock on to the left of the URL bar and verify that the URL is correct. You could click on a link to www.gmaiil.com and so easily give away your username and password to gmail.com. Hackers may now have your 2FA email and a list of all the sites you are signed up to. If you use the same username and password across multiple platforms, this is very serious.
Phishing scams are the most common type of attack and they work very well on unsuspecting individuals. They are very easy to execute, and many people fall prey. There is no real software protection aside from common sense. Remember not to click on any links or open attachments from suspicious emails that you have not seen before. If they ask for passwords or sensitive data never give it to them.
9. Virus Protection
In order to protect your computer against viruses, the best thing to do is to take it to a specialist once a year. Viruses can be hard to detect. There is a lot of anti-virus software, however most of them are not up to speed. For example, the majority of computer viruses are designed with Norton Antivirus and Windows Defender in mind. Owning a Mac or using a Linux machine are safer than Windows due to less viruses targeted at these systems. IOS is a little better than Android when it comes to security. In the third quarter of 2016, 18 million new types of malware were detected by one security company. That’s 200,000 per day.
An emergency feature you can use with Windows machines is the system restore. You literally restore your whole machine to a previous date in time, exactly as it was on that date, with the virus removed. Of course, you need to make sure that all of your files are backed up. All applications that were installed and all files saved after the restore date will be removed.
Online Privacy Guide: Conclusion
This online privacy guide has outlined the most important security steps to ensure digital privacy. The most important thing to do is to get a VPN, to enable 2FA on all sites and to use either a password manager or self encrypt your passwords. These are the most important things you can do to secure your digital footprint online. Because even if your computer is hacked, your accounts and data will not be compromised if you have 2FA, which requires an additional device. And your passwords will be encrypted. In other words, even if somebody is listening, hacks your data or installs a virus on your computer, you are most likely safe with 2FA and encryption. And even if you fall prey to a phishing scam and enter your username and password on a fake site, scammers can do nothing with the information without 2FA verification.
Of course, all the other steps do offer an additional layer of protection. In the digital world it is always better to have extra layers of security. The more protection and privacy you have, the better. It is always good to keep your data private and to eliminate ads and malware where possible. The less information these organizations have on civilians, the better.
Source: https://www.wizcase.com/blog/online-privacy-guide-steps-to-security-in-the-digital-age/
-
Malware hits vendor of public-service jobs portal Careers@Gov
Users of the Careers@Gov online portal were informed of a malware breach of the portal's vendor by e-mail on June 10, 2018.
Jun 11, 2018 | Lester Hio
SINGAPORE - Applicants for public-service jobs in Singapore could have had their information compromised, as a malware infection was found to have hit an outsourced Australian-based vendor here.
Users of the Careers@Gov online portal, which lists job positions and takes in applications for public-sector vacancies, were informed of a malware breach of the portal's vendor by e-mail on Sunday (June 10).
"At this stage, the vendor has not seen further sign of suspicious activity. The malware has been contained and the threat eradicated," said the e-mail from Careers@Gov.
The portal is run by Australian human resources software provider PageUp, which counts universities, banks and the Tasmanian government among its clients.
It provides recruitment and career software for companies to create a website portal that lets them publish job openings, receive applicants’ resumes and shortlist applicants.
A spokesman for the Public Service Division, which oversees the portal, said: “We are currently investigating and obtaining more information from PageUp.”
Careers@Gov has about 297,000 account holders held by public officers and members of the public who have accessed the portal to apply for a job with the public service.
PageUp had detected the malware infection much earlier, with its chief executive and co-founder Karen Cariss posting a statement on the company's website saying that the company had "detected unusual activity on its IT infrastructure" on May 23.
"We have some indicators that client data may have been compromised," said Miss Cariss, adding that the company was conducting a forensic investigation and working with law enforcement and government authorities on the matter.
Such data could include names and contact details of users, along with user names and encrypted passwords.
The breach has affected PageUp clients such as the University of Melbourne, the Australian National University and the Australia Post.
A check by The Straits Times on Monday morning showed that the Careers@Gov website is still running on the PageUp system, even as other clients, such as Australian bank Commonwealth Bank and telco Telstra pulled their recruitment websites offline last week.
Users of the portal are urged to change their Careers@Gov account password as an added security measure, as well as the passwords on other websites or accounts they have if those accounts share the same user name and password credentials.
Source: https://www.straitstimes.com/tech/malware-hits-vendor-of-public-service-jobs-portal-careersgov
-
Contact info of 427 NSmen leaked in e-mail error
The 427 men from the Singapore Armed Forces and Home Team had redeemed credits for service-linked rewards - the NS Excellence Award and Celebratory Gifts for Operationally Ready National Servicemen.
Jun 15, 2018 | Linette Lai
The personal contact details of more than 400 operationally ready national servicemen (NSmen) were sent to one another by mistake after a government-appointed vendor made a technical error.
The 427 men from the Singapore Armed Forces (SAF) and Home Team had redeemed credits for service-linked rewards - the National Service Excellence Award and Celebratory Gifts for Operationally Ready National Servicemen.
The company in charge of these gift redemptions, Option Gift, said the men received the personal details on Tuesday due to an "erroneous programme script". It apologised for the error.
The incident occurred when the erroneous script was used to send out confirmation e-mail to inform servicemen about their redemption details.
"The company has notified the Ministry of Defence (Mindef) and the Ministry of Home Affairs," Option Gift said in a statement yesterday evening.
"We have also informed all affected NSmen of the error."
The company added that this was an isolated incident and that redemption services for all servicemen - including the group of 427 - are not affected.
In a joint statement, both ministries said they were aware of the incident and are investigating. They have put in place measures to prevent a recurrence, they added.
In February last year, Mindef revealed that the personal details of 850 national servicemen and Mindef staff were stolen in a "targeted and carefully planned" cyber attack on the ministry's I-net system.
When this happened, Mindef disconnected the affected server from I-net, but allowed I-net to continue to provide Internet access.
It investigated the I-net system, as well as other systems used within Mindef and the SAF.
A month later, a batch of SAF recruits had their identity-card numbers and photos published online by mistake before the authorities realised the error and removed the information a day later.
The Basic Military Training Centre, which was responsible for the error, apologised for the mistake and reviewed its procedures to prevent it from recurring.
NSmen who have questions about the latest incident involving Option Gift can call the NS Call Centre on 1800-367-6767.
A version of this article appeared in the print edition of The Straits Times on June 15, 2018, with the headline 'Contact info of 427 NSmen leaked in e-mail error'.
Source: https://www.straitstimes.com/singapore/contact-info-of-427-nsmen-leaked-in-e-mail-error (https://www.straitstimes.com/singapore/contact-info-of-427-nsmen-leaked-in-e-mail-error)
-
1.5M patients' data, including PM Lee Hsien Loong's, stolen in major cyberattack
Staff Writer, Singapore | 20 July 2018
Information on Prime Minister Lee Hsien Loong’s outpatient dispense medicines as well as personal particulars of about 1.5 million patients were stolen from SingHealth’s database in a recent “deliberate and well-planned cyberattack”, said the Ministry of Health (MOH) and the Ministry of Communications and Information (MCI) on Friday (20 July).
“The attackers specifically and repeatedly targeted Prime Minister Lee Hsien Loong’s personal particulars and information on his outpatient dispensed medicines,” the authorities added in a joint statement.
In response to the announcement, Lee said attackers would be “disappointed” with what they found about him.
“I don’t know what the attackers were hoping to find. Perhaps they were hunting for some dark state secret, or at least something to embarrass me,” wrote Lee on his Facebook page. “My medication data is not something I would ordinarily tell people about, but there is nothing alarming in it.”
Investigations by the Cyber Security Agency of Singapore (CSA) and the Integrated Health Information System (IHiS) have confirmed that the incident was “deliberate, targeted and well-planned”, but the MOH did not specify the attackers, only adding to say that it was “not the work of casual hackers or criminal gangs”.
Of the attackers, Lee said, “Those trying to break into our data systems are extremely skilled and determined. They have huge resources, and never give up trying.”
Lee had battled cancer twice. In 2015, he underwent surgery to remove his cancerous prostate gland and was given the all-clear for prostate cancer. He had another bout with cancer in 1992 arising from intermediate grade malignant lymphoma.
The attackers also illegally accessed and copied data including the name, NRIC number, address, gender, race and date of birth of about 1.5 million patients who visited SingHealth’s specialised outpatient clinics and polyclinics from 1 May 2015 to 4 July.
Information on the outpatient dispensed medicines of about 160,000 of these patients was also exfiltrated. The records were not tampered with, and no other patient records, such as diagnosis, test results or doctors’ notes, were breached, the MOH added.
“We have not found evidence of a similar breach in the other public healthcare IT systems,” said the MOH.
As a precaution, the IHiS, with CSA’s support, has implemented further measures to tighten the security of SingHealth’s IT systems.
These include temporarily imposing internet surfing separation, additional controls on workstations and servers, reset user and systems accounts, and installed additional system monitoring controls, with similar measures being put in place for IT systems across the public healthcare sector.
The ministry has also directed IHiS to conduct a thorough review of the Republic’s public healthcare system, with support from third-party experts, to improve cyber threat prevention, detection and response.
“Areas of review will include cybersecurity policies, threat management processes, IT system controls and organisational and staff capabilities. Advisories have been sent to all healthcare institutions, public and private, on the cybersecurity precautions and measures to be taken,” the MOH said.
The Minister-in-Charge of Cyber Security will establish a Committee of Inquiry to conduct an independent external review of this incident.
Describing it as a “ceaseless effort”, Lee said, “Government systems come under attack thousands of times a day. Our goal has to be to prevent every single one of these attacks from succeeding. If we discover a breach, we must promptly put it right, improve our systems, and inform the people affected.”
“This is what we are doing in this case. We cannot go back to paper records and files. We have to go forward, to build a secure and smart nation.”
From Friday, SingHealth will be progressively contacting all patients who visited its specialist outpatient clinics and polyclinics from 1 May 2015 to 4 July, to notify them if their data had been illegally exfiltrated.
All the patients, whether or not their data were compromised, will receive an SMS notification over the next five days. Patients can also access the Health Buddy mobile app or SingHealth website to check if they are affected by this incident.
Background to cyber-attack
On 4 July, the IHiS’ database administrators had detected unusual activity on one of SingHealth’s IT databases.
After acting immediately to halt the activity, the IHiS investigated the incident to ascertain the nature of the activity, while putting in place additional cybersecurity precautions.
A week later, investigations confirmed that it was a cyber-attack, and the MOH, SingHealth and CSA were informed.
The CSA also ascertained that the cyber attackers accessed the SingHealth IT system through an initial breach on a particular front-end workstation.
“They subsequently managed to obtain privileged account credentials to gain privileged access to the database. Upon discovery, the breach was immediately contained, preventing further illegal exfiltration,” the MOH added.
SingHealth lodged a police report on 12 July. Police investigations are ongoing.
“With heightened monitoring, further malicious activities were observed. However, no further illegal exfiltration has been detected since 4 July,” said the MOH.
“All patient records in SingHealth’s IT system remain intact. There has been no disruption of healthcare services during the period of the cyberattack, and patient care has not been compromised.”
Source: https://sg.news.yahoo.com/pm-lee-hsien-loongs-outpatient-data-1-5m-patients-info-stolen-major-cyber-attack-102600994.html (https://sg.news.yahoo.com/pm-lee-hsien-loongs-outpatient-data-1-5m-patients-info-stolen-major-cyber-attack-102600994.html)
[Good Summary of case after the release of the COI report]
SingHealth COI report made public: System vulnerabilities, staff lapses, skilled hackers led to cyberattack
Fann Sim | 10 Jan 2019 06:15AM
SINGAPORE: A potent mix of pre-existing system vulnerabilities, staff lapses and extremely skilled hackers led to the cyberattack on SingHealth’s patient database last year, said a report from the Committee of Inquiry (COI) into the breach.
The voluminous 424-page public version of the report was released on Thursday (Jan 10).
The report, with sensitive information preserved and classified “Top Secret”, was submitted earlier to the Minister-in-charge of Cybersecurity S Iswaran in December.
It includes a detailed account of how the cyberattack happened, the responses, the key findings and 16 recommendations made by the four-member COI chaired by former chief district judge Richard Magnus.
The COI was appointed by Mr Iswaran, who is also Minister for Communication and Information.
In total, the COI heard from 37 witnesses in private and public hearings held over 22 days. It also received 26 written submissions from individuals, organisations and industry associations.
*WHAT HAPPENED*
In July last year, the Government said during a press conference that an attack of “unprecedented scale” and the “most serious breach of personal data” in Singapore’s history had taken place.
The attacker, believed to be state-sponsored, got away with SingHealth’s “crown jewels” – personal information of 1.5 million patients including their names, NRIC numbers and addresses. Among them, close to 159,000 patients had their outpatient medication records taken over a one-week period between Jun 26 and Jul 4.
This included the personal information and outpatient dispensed medicine of Prime Minister Lee Hsien Loong which were "specifically targeted and repeatedly accessed".
The attacker had gained initial access into SingHealth’s IT network a year earlier in August 2017 by infecting front-end workstations through a successful phishing attack, the report said.
Evidence suggests that this allowed malware to be installed and executed from one of the affected workstations with outdated security patches and provided password credentials to the attacker, the report added.
The attacker had then laid dormant in the system for several months, which, according to the report, is a sign of a “skilled and sophisticated attacker”. The attacker then moved laterally in the network, gained control and compromised a large number of user and administrator accounts.
The earliest signs of compromise only popped up in June 2018 when the attacker began requesting for information from the patient database managed by the central public healthcare IT agency, Integrated Health Information System (IHiS).
The attacker showed signs of “technical competence and mission-orientation” and targeted the system’s “crown jewels” with clear goals, persistence and advanced tactics, the report said. The attacker was able to exploit vulnerabilities such as weak passwords and loopholes like lapsed security updates and vague incident escalation procedures in the system.
The massive exploitation came to light on Jul 4 when an IHiS member of staff, whose role was to ensure operational efficiency instead of cybersecurity management, came across unusual activity in the patient database.
Worried that the activity was unauthorised, the matter was brought to the cybersecurity team but the cybersecurity manager disagreed that the attack was severe. The report said that the manager’s response to the attack was “severely inadequate”.
Similarly, a senior information security officer whose job is to decide when to report a security incident to management did not carry out his duties. The report described his response as “clearly lacking” and displayed an “alarming lack of concern”.
From that evening, several IHiS administrators worked together to end the suspicious activity by blocking the attacker’s repeated requests for information and changing the passwords of the accounts used to access patient data.
From Jul 5 through to Jul 9, the IT administrators attempted to isolate, contain and defend the attack, such as by performing scans and securing user accounts to limit access. The manager was also insistent on not escalating the incident to upper management.
“To sum up, considerable initiative was shown by officers on the front line … It is a shame that such initiative was then smothered by a blanket of middle management mistakes,” the report said.
A “war room” was later set up on Jul 10 with the matter escalated to upper management, MOH, the SingHealth Board, and the Cyber Security Agency (CSA).
Just when they thought the attack was over when no more malicious activity was detected after Jul 4, the attacker re-entered the system a week later on Jul 18 through another pathway and tried to re-establish control over the network, the report added.
“Apart from evading detection for almost 10 months from August 2017, the attacker was conscientious in erasing logs on compromised workstations and servers. Notably, the attacker even re-entered the network after being detected, to erase system and program logs,” the report said.
Following the detection of the cyberattack, containment measures including Internet Surfing Separation (ISS) were put in place on Jul 20 to contain the threat and prevent further compromise. After this, no further suspicious activity was detected in SingHealth’s network thereafter, the report said.
*FIVE KEY FINDINGS*
The COI made five key findings.
The first two relate to the competencies of and resources available to IHiS staff in responding to cyberattacks. Those in key positions in IT security incident response were found to have failed to take “appropriate, effective, or timely action” resulting in missed opportunities to prevent the cyberattack.
The COI also found that there were a number of vulnerabilities, weaknesses and misconfigurations in the SingHealth network that contributed to the attacker’s success.
Fourth, the attacker was found to be a “skilled and sophisticated” actor with the characteristics of an Advanced Persistent Threat (APT) group. Such groups are usually state-linked, and they conduct extended and carefully planned cyber campaigns to steal information or disrupt operations, the report said.
Lastly, while Singapore’s cyber defences will never be “impregnable” coupled with the advanced skills of an APT group, the success of the attack in obtaining and exfiltrating the data was ultimately “not inevitable”.
The report said it would have made it more difficult for the attacker to achieve its objectives if the number of vulnerabilities, weaknesses and misconfigurations were remedied before the attack.
*‘AXIOMATIC’ MEASURES RECOMMENDED*
The COI made 16 recommendations. These recommendations have three broad aims: To enhance the incident response plans for similar incidents, to better protect SingHealth’s patient database system against similar cybersecurity attacks, and to reduce the risk of such cybersecurity attacks on public sector IT systems which contain large databases of personal data.
They fall into five broad areas ranging from basic cyber hygiene measures to more advanced measures. Among the 16, seven are “priority recommendations” and must be implemented. The remaining nine are additional recommendations that should be implemented if possible.
The first six priority recommendations focus on improving cybersecurity policies and capabilities as well as embedding cybersecurity awareness into daily operations.
“The senior management of SingHealth and IHiS must provide effective and agile leadership for the timely and effective implementation of these recommendations, allocating adequate resources, and keeping a close and careful watch,” the report said.
“There must also be appropriate oversight over and verification of their implementation, including by external entities where appropriate,” it added.
The seventh priority recommendation relates to collective security which the report said is “imperative” due to the high degree of digitalisation and interconnectivity in Singapore.
The nine additional recommendations address specific issues raised in the course of the Inquiry, including technical, organisational, training, and process-related issues.
The measures, which are similarly aimed at uplifting the cybersecurity posture of SingHealth and IHiS, must be implemented or seriously considered, the report said.
“While some measures may seem axiomatic, the cyberattack has shown that these were not implemented effectively by IHiS at the time of the attack,” it added.
The report said the recommendations made are not just for IHiS or SingHealth and are equally applicable to all organisations responsible for large databases of personal data.
“For IHiS, SingHealth, and other organisations responsible for large databases of personal data, getting the fundamentals right is a necessary and vital step in building cybersecurity competencies and the ability to counter the real, present and constantly evolving cybersecurity threats,” it added.
*MOH, SINGHEALTH, IHiS TO IMPLEMENT RECOMMENDATIONS*
SingHealth’s group CEO Professor Ivy Ng, in a media statement, said that SingHealth has reinforced the culture of ownership of cyber defence since the incident. This is so that every staff is empowered to identify and report cybersecurity threats.
Regular broadcasts on cybersecurity threats to educate, and phishing exercises to test and heighten awareness will continue, in addition to table top exercises to test response to cyber threats, she said.
“In the coming months, our priority will be to work closely with the MOH, IHiS and industry experts to proactively implement the recommendations in the COI report to strengthen our cybersecurity defence,” Prof Ng added.
In its response to the report, the Ministry of Health (MOH) said it welcomes “the COI’s recommendations to enhance our cybersecurity safeguards, and will work with our healthcare institutions to study and implement the recommendations and strengthen the healthcare sector’s resilience against cyberattacks.
“We are committed to safeguarding patient data, and will work towards improving our systems and processes to emerge stronger from this incident.”
Similarly, IHiS said it will study the recommendations made by the COI.
“The SingHealth cyberattack has revealed a number of key areas that we need to strengthen – from processes and systems to organisational structure and people. We will carefully study the recommendations in the COI report and do our utmost to drive change throughout our organisation, with patient wellbeing as our priority. We are committed to a continuous process of improvement to further strengthen our cyber defence in the public healthcare sector,” said IHiS CEO Bruce Liang.
Minister for Communications and Information and Minister-in-charge of Cybersecurity S Iswaran and Health Minister Gan Kim Yong are expected to deliver ministerial statements in Parliament next week responding to the COI’s findings and recommendations.
Source: https://www.channelnewsasia.com/news/singapore/singhealth-cyberattack-coi-report-made-public-11104424 (https://www.channelnewsasia.com/news/singapore/singhealth-cyberattack-coi-report-made-public-11104424)
Singapore's privacy watchdog fines IHiS $750,000 and SingHealth $250,000 for data breach
JAN 15, 2019 | Irene Tham
SINGAPORE - Singapore's privacy watchdog has meted out its largest fine of $750,000 to Integrated Health Information Systems (IHiS) for lapses in securing patient data which resulted in the nation's worst data breach.
The cyber attack on SingHealth in June 2018 compromised the personal information of 1.5 million patients, including Prime Minister Lee Hsien Loong.
Even though IHiS is the technology vendor for Singapore's healthcare sector, SingHealth also has to take responsibility as the owner of the patient database system - a point that the Personal Data Protection Commission (PDPC) stressed in dishing out penalties.
SingHealth was fined $250,000, the second largest here.
In a statement on Tuesday (Jan 15), the PDPC said: "Even if organisations delegate work to vendors, organisations as data controllers must ultimately take responsibility for the personal data that they have collected from their customers."
IHiS and SingHealth are wholly owned subsidiaries of MOH Holdings, the holding company through which the Singapore Government owns the corporatised institutions in the public healthcare sector.
In a statement on Tuesday, Professor Ivy Ng, SingHealth group chief executive officer, apologised to patients and accepted the PDPC fine.
She said: “We are making changes to enhance our cyber-security governance structures and improve management oversight of our critical systems.”
“We are also working with IHiS to comprehensively upgrade our cyber-defence systems and processes to more effectively guard against cyber-security risks, as well as to respond in a timely and robust manner to any intrusion.
“We are fully committed to learning and improving from this incident. We will embed cyber-security consciousness into our daily operations and ensure that stringent measures are in place to safeguard our patients’ data.”
Mr Peter Seah, chairman of SingHealth, added that that its senior leadership team, including its group chief executive officer, has voluntarily accepted a financial penalty. SingHealth did not disclose the amount of the penalty.
Singapore's privacy watchdog also found the person handling security incidents involving SingHealth to be unfamiliar with the incident response process. He failed to take further steps to investigate and understand reports on suspicious activities, it noted.
The PDPC was referring to the key technology risk man at IHiS - cluster information security officer Wee Jia Huo - who was in charge of the SingHealth cluster.
In a public report issued last week by the Committee of Inquiry probing the cyber attack, Mr Wee was said to have displayed "an alarming lack of concern" when it was clear that a critical system had been potentially breached.
It was reported on Monday that IHiS had fired two employees and redeployed its technology risk man. Mr Wee, whose job was to decide if upper management should be alerted to incidents, was demoted and redeployed to another role.
IHiS would also impose "significant financial penalty" on five members of its senior management team, including chief executive officer Bruce Liang.
On Tuesday, Mr Liang apologised to patients who were affected.
He said in a statement that IHiS has learnt a lot about advanced cyberattack operations, as well as about its own weaknesses.
“We are determined to improve as an organisation. We are also resolute in partnering the healthcare family to transform our cyber defence capabilities in order to protect the well-being of our patients,” he added.
IHiS also gave an update on the new safeguards it has started to put in place for the IT systems of the three healthcare clusters it is managing.
For example, advanced threat protection technologies have been fully deployed across all three public healthcare clusters in more than 6,000 servers and 60,000 endpoint devices. Privileged access to dedicated local workstations is now restricted.
Additionally, database activity monitoring tools have been rolled out to mitigate the coding vulnerability in SingHealth’s electronic medical record system. It has also stepped up the training and engagement of staff to raise awareness about cyber security.
Those found to be in breach of the Personal Data Protection Act in Singapore could be fined up to $1 million. Karaoke bar chain K Box was among the first batch of organisations punished for breaking the law. It was fined $50,000 over an incident in September 2014 that saw the data of 317,000 customers leaked.
Source: https://www.straitstimes.com/singapore/singapores-privacy-watchdog-fines-ihis-750000-singhealth-250000-for-data-breach (https://www.straitstimes.com/singapore/singapores-privacy-watchdog-fines-ihis-750000-singhealth-250000-for-data-breach)
SingHealth database hackers have targeted other systems here since at least 2017: Symantec
Mar 6, 2019 | Hariz Baharudin
SINGAPORE - The hackers who breached the SingHealth database are from a group which has also targeted other organisations in Singapore for at least the past two years, cyber security company Symantec said.
But while the United States-based company mentioned that the group is state-sponsored, it did not identify the country.
In a statement on Wednesday (March 6), Symantec said: "Symantec researchers have discovered that this attack group, which we call Whitefly, has been operating since at least 2017. It has targeted organisations based mostly in Singapore across a wide variety of sectors, and is primarily interested in stealing large amounts of sensitive information."
The research was carried out independently by Symantec and was not commissioned by the authorities.
Singapore was hit by its worst cyber attack in June last year when hackers went into the database of public healthcare cluster SingHealth and stole the personal data of 1.5 million patients and the outpatient prescription information of 160,000 people, including Prime Minister Lee Hsien Loong.
A Committee of Inquiry (COI) set up to look into the attack recommended a raft of measures to beef up cyber security, such as improving incident response processes.
Responding to queries from The Straits Times about who Whitefly is and where its members are from, Symantec said: "Identifying who or what organisation is directing or funding that activity is not in the scope or focus of what we do.
These measures follows last year's cyber attack on SingHealth that resulted in the theft of 1.5 million patients' personal particulars.
"This level of attribution requires the substantial resources, time and access to information that is generally available only to law enforcement or government intelligence agencies."
In response to the information from Symantec, the Cyber Security Agency of Singapore said: "Cyber security companies regularly produce such reports based on their own intel and research for their various stakeholders. As this is an independent investigation report by a commercial entity, we have no comment on its contents."
In the statement, Symantec said the group attacks its victims using custom malware and misleading files in phishing e-mails.
These files, which run malicious programs in the victim's computers, are usually disguised as documents offering information on job openings or sent from another organisation in the same industry as the victim's.
The COI heard last year that hackers used a phishing ploy to enter SingHealth's network and mount their attack.
"Whitefly compromises its victims using custom malware alongside open-source hacking tools and living off the land tactics, such as malicious PowerShell scripts," said Symantec.
PowerShell scripts are tools in computer systems that run commands to change its settings and automate tasks.
"Living off the land tactics" refers to stealthy cyber attack methods that use tools already installed in the system, which minimises the risk of an attack being blocked or discovered.
According to Symantec, the group launched targeted attacks against multiple organisations, most of which are based here. These include companies in the healthcare, media, telecommunications and engineering sectors. But it stopped short of naming these organisations.
Responding to ST's request for more details, Symantec said that it does not disclose the identity of cyber attack victims and that in most cases, victims are identified due to the evidence of the attacker's activity in their networks.
The company added that the group's tight focus on a limited number of targets here means that it is "likely a small to medium-sized team", although Symantec did not give any specifics.
While the focus of the group seems to be on Singapore, Symantec warned that the group's sponsors, whom it did not name, are likely targeting other countries as well.
"It is possible that the group is part of a broader intelligence-gathering operation in the region," it said.
Source: https://www.straitstimes.com/singapore/singhealth-database-hackers-have-targeted-other-systems-here-since-at-least-2017-symantec (https://www.straitstimes.com/singapore/singhealth-database-hackers-have-targeted-other-systems-here-since-at-least-2017-symantec)
Whitefly: Espionage Group has Singapore in Its Sights
Posted: 6 Mar, 2019 | Threat Intelligence
In July 2018, an attack on Singapore’s largest public health organization, SingHealth, resulted in a reported 1.5 million patient records being stolen. Until now, nothing was known about who was responsible for this attack. Symantec researchers have discovered that this attack group, which we call Whitefly, has been operating since at least 2017, has targeted organizations based mostly in Singapore across a wide variety of sectors, and is primarily interested in stealing large amounts of sensitive information.
Whitefly compromises its victims using custom malware alongside open-source hacking tools and living off the land tactics, such as malicious PowerShell scripts.
Whitefly’s targets
From mid-2017 to mid-2018, Whitefly launched targeted attacks against multiple organizations. While most of these organizations were based in Singapore, some were multinational organizations with a presence in Singapore.
To date, Whitefly has attacked organizations in the healthcare, media, telecommunications, and engineering sectors.
How Whitefly compromises its victims
Whitefly first infects its victims using a dropper in the form of a malicious .exe or .dll file that is disguised as a document or image. These files frequently purport to offer information on job openings or appear to be documents sent from another organization operating in the same industry as the victim. Given the nature of disguise, it’s highly likely that they are sent to the victim using spear-phishing emails.
If opened, the dropper runs a loader known as Trojan.Vcrodat on the computer. Whitefly has consistently used a technique known as search order hijacking to run Vcrodat. This technique takes advantage of the fact that Windows does not require an application to provide a specific path for a DLL that it wishes to load. If no path is provided, Windows searches for the DLL in specific locations on the computer in a pre-defined order. Attackers can therefore give a malicious DLL the same name as a legitimate DLL but place it ahead of the legitimate version in the search order so that it will be loaded when Windows searches for it. Whitefly frequently delivers Vcrodat as a malicious DLL that has the same name as DLLs belonging to legitimate software from various security vendors. The group leverages search order hijacking to assure that its malicious DLLs will be executed. Targeting security applications could allow the attackers to gain higher privileges for the malware, since the vendor’s component may be run with elevated privileges.
Once executed, Vcrodat loads an encrypted payload on to the victim’s computer. The payload contacts a command and control (C&C) domain. Whitefly configures multiple C&C domains for each target. The payload sends system information about the infected computer to the C&C server and downloads additional tools.
Whitefly usually attempts to remain within a targeted organization for long periods of time—often months—in order to steal large volumes of information.
Once the initial computer on the targeted organization’s network is infected with Vcrodat, Whitefly begins mapping the network and infecting further computers. In order to carry out this operation, it uses publicly available tools, including Mimikatz (Hacktool.Mimikatz) and an open-source tool (SHA2: 263dc5a8121d20403beeeea452b6f33d51d41c6842d9d19919def1f1cb13226c) that exploits a known Windows privilege escalation vulnerability (CVE-2016-0051) on unpatched computers. The attackers rely heavily on tools such as Mimikatz to obtain credentials. Using these credentials, the attackers are able to compromise more machines on the network and, from those machines, again obtain more credentials. They perform this tactic repeatedly until they gain access to the desired data.
Whitefly usually attempts to remain within a targeted organization for long periods of time—often months—in order to steal large volumes of information. It keeps the compromise alive by deploying a number of tools that facilitate communication between the attackers and infected computers. These tools include a simple remote shell tool that will call back to the C&C server and wait for commands, and an open-source hacking tool called Termite (Hacktool.Rootkit), which allows Whitefly to perform more complex actions such as controlling multiple compromised machines at a time.
Additional malware used in selected attacks
In some attacks, Whitefly has used a second piece of custom malware, Trojan.Nibatad. Like Vcrodat, Nibatad is also a loader that leverages search order hijacking, and downloads an encrypted payload to the infected computer. And similar to Vcrodat, the Nibatad payload is designed to facilitate information theft from an infected computer.
While Vcrodat is delivered via the malicious dropper, we have yet to discover how Nibatad is delivered to the infected computer. Why Whitefly uses these two different loaders in some of its attacks remains unknown. And while we have found both Vcrodat and Nibatad inside individual victim organizations, we have not found any evidence of them being used simultaneously on a single computer.
Links to other attacks
Some of the tools that Whitefly has used in its attacks have also been deployed in other targeted attacks outside Singapore.
Between May 2017 and December 2018, a multi-purpose command tool (SHA2: 7de8b8b314f2d2fb54f8f8ad4bba435e8fc58b894b1680e5028c90c0a524ccd9) that has been used by Whitefly was also used in attacks against defense, telecoms, and energy targets in Southeast Asia and Russia. The tool appears to be custom-built and, aside from its use by Whitefly, these were the only other attacks where Symantec has observed its use.
In another case, Vcrodat was also used in an attack on a UK-based organization in the hospitality sector.
It's possible Whitefly itself performed these attacks but it’s more likely that they were carried out by one or more other groups with access to the same tools.
Adept attackers with a large toolset
It now appears that the SingHealth breach was not a one-off attack and was instead part of a wider pattern of attacks against organizations in the region. Whitefly is a highly adept group with a large arsenal of tools at its disposal, capable of penetrating targeted organizations and maintaining a long-term presence on their networks. Links with attacks in other regions also present the possibility that it may be part of a broader intelligence gathering operation.
Protection/Mitigation
Symantec has the following protection in place to protect customers against these attacks:
File-based protection
Trojan.Vcrodat
Trojan.Nibatad
Hacktool.Rootkit
Hacktool.Mimikatz
Indicators of Compromise
MD5 SHA2 Description
eab0a521aa7cac62d98d78ef845a8319 a196dfe4ef7d422aadf1709b12511ae82cb96aad030422b00a9c91fb60a12f17 Trojan.Vcrodat
79bef92272c7d1c6236a03c26a0804cc d784a12fec628860433c28caa353bb52923f39d072437393629039fa4b2ec8ad Trojan.Vcrodat
394df628b3c8977661c8bebea593e148 6e874ac92c7061300b402dc616a1095fa7d13c8a18c8a3ea5b30ffa832a7372c Trojan.Nibatad
51862c3615e2f8a807b1d59f3aef3507 ed3cd71eaca603a00e4c0804dc34d84dc38c6c1e1c1f43af0568fb162c44c995 DLL Shellcode Loader
b4a7049b90503534d494970851bdda62 9d9a6337c486738edf4e5d1790c023ba172ce9b039df1b7b9720ed4c4c9ade90 DLL Shellcode Loader
93c9310f3984d96f53f226f5177918c4ca78b2070d5843f08d2cf351e8c239d5 Mimikatz
263dc5a8121d20403beeeea452b6f33d51d41c6842d9d19919def1f1cb13226c CVE-2016-0051 privilege escalation
b2b2e900aa2e96ff44610032063012aa0435a47a5b416c384bd6e4e58a048ac9 Termite
dda22de8ad7d807cdac8c269b7e3b35a3021dcbff722b3d333f2a12d45d9908d Simple command line remote access tool
f562e9270098851dc716e3f17dbacc7f9e2f98f03ec5f1242b341baf1f7d544c Simple command line remote access tool
7de8b8b314f2d2fb54f8f8ad4bba435e8fc58b894b1680e5028c90c0a524ccd9 Multi-purpose command tool
Source: https://www.symantec.com/blogs/threat-intelligence/whitefly-espionage-singapore (https://www.symantec.com/blogs/threat-intelligence/whitefly-espionage-singapore)
Archive 1: https://archive.fo/sDrd7
Reference on "Trojan.Vcrodat": https://www.symantec.com/security-center/writeup/2019-013008-4820-99 (https://www.symantec.com/security-center/writeup/2019-013008-4820-99)
-
70,000 members' data stolen, but Sias unaware for 5 years
News from CSA shocks Sias CEO; incident not linked to SingHealth breach
Thu, Jul 26, 2018 - 5:50 AM | Angela Tan
HACKERS stole the personal data of 70,000 members of the Securities Investors Association of Singapore (Sias) in 2013 - yet for five years, the investor advocate had no clue about the breach.
Sias was informed of the attack only on Wednesday morning when the Cyber Security Agency of Singapore (CSA) paid it an unexpected visit.
CSA - formed in 2015 and involved in the probe into the massive hacking of SingHealth - informed the association that the names, NRIC and telephone numbers of about 70,000 of its members have been stolen and leaked, sometime back in 2013.
"This is really shocking. Five years later, we come to know,'' a clearly distressed David Gerald, Sias' founder and chief executive officer, told The Business Times.
SEE ALSO: Sias urges Shanghai Turbo shareholders to reject proposal to remove board
In a late night media statement, CSA said it "received a tip-off email stating that SIAS members' personal information database might have been compromised". It added that the incident was not related to the SingHealth breach.
It said that as SIAS is not a public sector agency nor Critical Information Infrastructure, the Singapore Computer Emergency Response Team (SingCERT) reached out to SIAS to inform them and asked them to verify the situation.
CSA added: "We noted that SIAS website has some vulnerabilities hackers could have exploited. We alerted SIAS about technical issues in their website design so that they can take the necessary safeguards."
BT understands that hackers could have created a code and injected it into Sias' login page, which enabled the thieves to steal the information. It remains unclear if the cyber thieves are local or foreign entities.
The news comes several days after SingHealth - Singapore's largest group of healthcare institutions - disclosed that hackers stole the personal particulars of 1.5 million SingHealth patients. Of these, 160,000 people, including Prime Minister Lee Hsien Loong and a few ministers, had their outpatient prescriptions stolen as well.
Mr Gerald said the affected SIAS records were not tampered with, ie, no records were amended or deleted.
"We are truly very sorry this had happened even though we took precautionary measures. We are now offline," Mr Gerald said.
While investigations into the breach are being conducted, Sias has disabled its website. It will be launching a new website in a couple of days, after IT experts ensure there's no lingering malware and the site has been scrubbed clean.
"What we can do is to step up the robustness of our IT processes. They can outsmart us, but we must still continue to fight them,'' Mr Gerald said.
So far, there has been no report of any harassment of Sias' members, or detection that the stolen data has been used for commercial purposes.
Eugene Lee, director of business development at Connectivity Global, a local cybersecurity startup, said smaller companies make for easy targets as they often lack the resources, expertise and technical capability to defend themselves against illegal online intrusions. They also lack access to costly enterprise systems, resulting in less sophisticated technologies.
"With email being such an established tool for communication among businesses and reaching all levels of employment, hackers can easily access confidential information or install ransomware in companies' servers through unsuspecting employees on front-end devices," Mr Lee said.
Mr Gerald said Sias has disabled its website and will launch a new website after IT experts ensure there's no lingering malware.
Source: https://www.businesstimes.com.sg/companies-markets/70000-members-data-stolen-but-sias-unaware-for-5-years (https://www.businesstimes.com.sg/companies-markets/70000-members-data-stolen-but-sias-unaware-for-5-years)
-
Grassroots leaders' e-mail addresses mistakenly revealed
PA's Nacli apologises after e-mail addresses of 1,300 leaders were visible in mass e-mail
FABIAN KOH | Aug 16, 2018 06:00 am
The personal e-mail addresses of 1,300 grassroots leaders were accidentally released on Monday by the community leadership development arm of the People's Association (PA).
The National Community Leadership Institute (Nacli) sent a mass e-mail to the grassroots leaders, informing them of the closure of its East Coast Campus from Sept 1. However, an administrative mistake meant that all the recipients' e-mail addresses were visible.
This is the second such incident here this week, following a similar gaffe by an SMRT-backed start-up, reported by The Straits Times (ST) on Monday.
In response to queries from ST, a PA spokesman said it has standard operating procedures in line with government guidelines on using "bcc" when sending mass e-mails to the public.
The bcc function lets recipients view a sent e-mail without being identified.
In this instance, a staff member accidentally used the "cc" function instead of the bcc function, the spokesman said.
"We are looking into the matter. We have also reminded all staff to strictly adhere to the guidelines."
Nacli, which was set up to train community leaders, sent an e-mail on Tuesday evening, seen by ST, to explain and apologise for the lapse to those affected.
"We sincerely apologise for the oversight and endeavour to tighten our internal processes to ensure that such an error will not happen again," it said in the e-mail.
Nacli also said in the e-mail that unread e-mails were immediately recalled, as soon as it found out about the oversight.
Data protection law expert Hannah Yeefen Lim from Nanyang Technological University's Nanyang Business School said: "The Personal Data Protection Act applies only to the private sector and does not apply to the public sector."
On Monday, ST reported that start-up mobilityX sent a mass e-mail last Friday to users of a smartphone app it had created, to introduce a feature, when it included all its users' e-mail addresses in the "to" address field.
Source: https://www.tnp.sg/news/singapore/grassroots-leaders-e-mail-addresses-mistakenly-revealed (https://www.tnp.sg/news/singapore/grassroots-leaders-e-mail-addresses-mistakenly-revealed)
-
Collecting NRIC numbers and making copies of the identity card will be illegal from Sept 1, 2019
Hariz Baharudin | 31 August 2018
SINGAPORE - From Sept 1 [2019] next year, it will be illegal for organisations to collect, use or disclose NRIC numbers or make copies of the identity card, under stricter rules spelt out on Friday (Aug 31)[2018] by the Personal Data Protection Commission.
For years, places like shopping malls have collected NRIC numbers when registering customers for lucky draws and memberships or even to track parking redemptions.
But the updated rules mean organisations will no longer be allowed to do that.
Organisations that have collected NRIC numbers are also encouraged to assess if they need to retain these numbers, and if not, are suggested to dispose of them responsibly and in compliance with Personal Data Protection Act (PDPA) disposal methods by next year.
Organisations which decide to keep their collection must ensure there is adequate protection. They can also choose to anonymise the NRIC. This follows updates to the rules for such collection under the PDPA, which went fully into force in July 2014.
"In today's digital economy, indiscriminate collection or negligent handling of NRIC numbers can increase the risk of unintended disclosure and may result in NRIC numbers being used for illegal activities such as identity theft or fraud," the commission said in a release on Friday (Aug 31)[2018].
It added that such risks arise as the NRIC number is a permanent and irreplaceable identifier.
Companies were also warned that unless required by the law, physically holding on to an individual's NRIC will not be allowed as well from Sept 1 [2019].
Although the Act already prohibits the indiscriminate collection of consumers' personal data, and requires organisations to account for the use of the data, privacy advocates argued that NRIC details were still being collected, sometimes for frivolous reasons. These ranged from booking a movie ticket to renting a bicycle.
Following public feedback, the privacy watchdog proposed updated guidelines which were then put up for public consultation from November to December last year, before the stricter rules were developed.
There are, however, exceptions.
NRIC numbers or copies of the NRIC can only be obtained or shared if they are required by law, such as when subscribing to a new phone line, making a doctor's appointment or checking into a hotel.
The Personal Data Protection Commission wants consumers to have the right to refuse to hand over their NRIC details in scenarios such as buying movie tickets online.
NRIC details may also be collected when it is necessary to precisely verify an individual's identity "to a high degree of fidelity".
This would include visiting pre-schools or transactions involving healthcare, financial or real estate matters, and when not getting it could risk security or could cause significant harm.
"Where the collection, use and disclosure of NRIC numbers or retention of physical NRICs is permitted, organisations must ensure that adequate protection measures are in place to safeguard the personal data in their possession or under their control, in compliance with their obligations under the PDPA," added the commission.
Organisations that are found flouting the Act can be fined up to $1 million.
These updated rules for NRIC numbers also apply to other national identification numbers, like birth certificate numbers, foreign identification numbers and work permit numbers.
Although passports are periodically replaced, the commission said that organisations should avoid collecting the full passport numbers of individuals as well, unless justified.
It acknowledged that some organisations collect a partial NRIC number and clarified that details of up to the last three numerical digits and letter of the NRIC would not be considered the full NRIC number.
But it added that these partial numbers are still considered personal data under the Act, as it could allow an individual to be identified.
The privacy watchdog reiterated that organisations that collect partial NRIC numbers must still comply with the Act's Data Protection Provisions, and must take steps to make sure this data is secured and not disclosed.
It said it does not prescribe the type of identifiers that organisations can use instead of NRIC numbers, and that organisations are encouraged to assess these alternatives based on their own needs.
Some alternatives it suggested include organisation or user-generated ID, tracking numbers or organisation-issued QR codes.
The commission said it will, together with the Infocomm Media Development Authority (IMDA), help organisations adjust by publishing a technical guide on replacing the NRIC number with alternative identifiers.
The commission and IMDA will identify pre-approved technology solutions that companies can take up.
They will also develop template notices that organisations can use to manage customer expectations during this transition period.
Source: https://www.straitstimes.com/singapore/collecting-nric-numbers-and-making-copies-of-the-identity-card-will-be-illegal-from-sept-1 (https://www.straitstimes.com/singapore/collecting-nric-numbers-and-making-copies-of-the-identity-card-will-be-illegal-from-sept-1)
Source 2: https://www.channelnewsasia.com/news/business/guidelines-on-nric-numbers-companies-9382290 (https://www.channelnewsasia.com/news/business/guidelines-on-nric-numbers-companies-9382290)
Source 3: https://www.pdpc.gov.sg/pdpc/news/latest-updates/2018/08/updated-nric-advisory-guidelines-now-available (https://www.pdpc.gov.sg/pdpc/news/latest-updates/2018/08/updated-nric-advisory-guidelines-now-available)
(http://tralvex.com/download/forum/PDPC_Protect%20Your%20NRIC%20Number%20-%20English%20(310818)%20small.png)
Enlarged version: https://goo.gl/yyVUtZ (https://goo.gl/yyVUtZ)
Source: https://www.pdpc.gov.sg/pdpc/news/latest-updates/2018/08/update-nric-rules-to-take-effect-from-1-september-2019 (https://www.pdpc.gov.sg/pdpc/news/latest-updates/2018/08/update-nric-rules-to-take-effect-from-1-september-2019)
-
Dozens of iOS apps secretly collect location history for data monetization, analysis says
By Stephen Silver | Friday, September 07, 2018
GuardianApp, from the Sudo Security Group, finds that a number of iOS apps are secretly collecting and sending location histories and other sensitive user information to third-party data monetization firms.
According to a new report from GuardianApp, "a growing number of iOS apps have been used to covertly collect precise location histories from tens of millions of mobile devices, using packaged code provided by data monetization firms. In many cases, the packaged tracking code may run at all times, constantly sending user GPS coordinates and other information."
The information being collected includes Bluetooth LE Beacon Data, GPS Longitude and Latitude, Wi-Fi SSD and BSSID, and also such information as accelerometer data, battery charge performance and status, and even timestamps for departure/arrival to a location.
GuardianApp lists 24 apps that are "confirmed to send data to a third-party data monetization firm," including ASKfm: Ask Anonymous Questions, C25K 5K Trainer, Classifieds 2.0 Marketplace, Code Scanner by ScanLife, Coupon Sherpa, GasBuddy, Homes.com, Mobiletag, Moco, My Aurora Forecast, MyRadar NOAA Weather Radar, PayByPhone Parking, Perfect365, Photobucket, QuakeFeed Earthquake Alerts, Roadtrippers, ScoutLook Hunting, SnipSnap Coupon App, Tapatalk, The Coupons App, Tunity, Weather Live and YouMail.
GuardianApp has also found code from the monetization firm, RevealMobile, on the apps of several local TV stations owned by the Sinclair Broadcast Group, Tribune Broadcasting Company, LIN Television Corp., Gray Television Group and other broadcasters.
GuardianApp suggests using Apple's built-in Limit Ad Tracking feature to mitigate potential location sharing. The tool can be enabled by navigating to Settings > Privacy > Advertising. Further, vigilant users can select "Don't Allow" when iOS Location Services popup windows instructs them to "See privacy policy" or take similar action. The firm also suggests using a generic name for the SSID of a home Wi-Fi router and switching Bluetooth off when not in use.
Earlier on Friday, two major news stories broke about user data. Adware Doctor, formerly the top paid app in the Mac App Store, was pulled after a security researcher revealed it was exfiltrating user information to China, while a separate investigation revealed other malicious apps in the Mac App Store.
Source: https://appleinsider.com/articles/18/09/07/dozens-of-ios-apps-secretly-collect-location-history-for-data-monetization-analysis-says
-
Online NRIC generators a 'cause for concern', cybersecurity experts say
Aqil Haziq Mahmud | 09 Sep 2018
SINGAPORE: While the Government has issued new guidelines against indiscriminate collection of NRIC details, cybersecurity experts have highlighted a different kind of personal data threat: random NRIC generators.
From September 2019, the Personal Data Protection Commission (PDPC) said organisations can only collect, use or disclose NRIC numbers or NRIC copies "under certain specific circumstances".
But a quick online search by Channel NewsAsia turned up at least two random NRIC generators that can produce "valid" NRIC numbers that are "verified against published checking logic".
Both only required a user to input the desired NRIC number's first letter and corresponding range of birth years before churning out the digits.
When announcing the new NRIC guidelines in August, the PDPC had said that the NRIC number is a "permanent and irreplaceable identifier which can be used to unlock large amounts of information relating to an individual".
-
Ex-ambulance driver fined $1,500 for OSA offence by taking photo of dead body while on duty
Sep 11, 2018 | Fabian Koh
An ambulance driver took a picture of a dead body while attending to a case of a maid who had hanged herself in February last year.
He sent the photo on his mobile phone to his colleagues, and it soon found its way onto social media.
Shaik Haziq Fahmi Shaik Nasair Johar, 29, was working for private ambulance operator Unistrong Technology, which has a contract with the Government for its services.
Yesterday, Haziq, since dismissed from his job, was fined $1,500 under the Official Secrets Act (OSA).
His former colleague, paramedic Nurizzah Afiqah Hussain, 27, was fined $3,000 last month for her role in disseminating the photo by sending it to her then boyfriend. She has also been sacked by Unistrong.
The incident came to light after the maid's employer became aware of the photograph's existence, and informed the investigating officer for the case.
Deputy Public Prosecutor Serene Yap told the court that Haziq was on duty on Feb 1 last year at Marine Parade Fire Post when a message came in from the control room.
The maid's employer had called the police to inform them that the maid had hanged herself while the family was overseas for five days.
Haziq and his team, including Nurizzah, then went to the apartment of the dead woman's employer.
While there, he used his mobile phone to take a photo of the body, as Nurizzah shone a torchlight on it.
It was his first time attending to a case of hanging and he wanted to share the picture in a chat group with his colleagues, although he was not authorised to do so, according to DPP Yap.
Former paramedic fined for unlawfully sending photo of dead maid to boyfriend
Nurizzah, who was in that chat group, later sent the photo to her then boyfriend, who forwarded it to another chat group.
The agent of the dead maid found out about the photo on social media, and told the employer. Shocked, the employer informed the investigating officer, who lodged a report.
The police began investigating, and on Feb 4 last year, Haziq was arrested at his home in Chai Chee Road. His mobile phone was also seized for investigations.
Defence lawyer Amarick Gill said in mitigation that Haziq already had his contract with Unistrong terminated and was remorseful for his actions. When Haziq took the photo, he had intended to send it only to his teammates, and did not personally disseminate it publicly, Mr Gill added.
In sentencing, District Judge Marvin Bay called Haziq's actions "deeply disturbing".
"Your act can cause intense anguish to the family of the deceased, who would be expected to be in a state of grief and shock in the light of her sudden and unnatural demise," he said.
He added that Haziq's actions intruded on the privacy of the family of the dead maid's employer too.
For the offence under the OSA, Haziq could have been jailed for up to two years and fined up to $2,000.
Source: https://www.straitstimes.com/singapore/courts-crime/ex-ambulance-driver-fined-1500-for-osa-offence (https://www.straitstimes.com/singapore/courts-crime/ex-ambulance-driver-fined-1500-for-osa-offence)
-
72 HealthHub accounts suspected hacked, e-service shut down for 6 days
Irene Tham | 18 Oct 2018
SINGAPORE - About 70 HealthHub accounts were suspected to have been hacked recently, prompting a six-day shutdown of the e-service in early October.
The attack on HealthHub - a gateway to citizens' medical records, prescriptions and clinic appointments - came on the heels of a cyber attack on SingHealth in June. That attack led to Singapore's biggest data breach, involving the personal data of 1.5 million SingHealth patients.
In a statement on Thursday (Oct 18), the Health Promotion Board (HPB) and Integrated Health Information Systems (IHiS) said they started investigations after a user reported that her e-mail account had been used to access the portal without her authorisation.
IHiS - an agency that manages the IT systems of all public healthcare institutions, including the HealthHub portal - then discovered unusual increased traffic to HealthHub on Sept 28 and Oct 3, 8 and 9.
Log-in attempts were made with more than 27,000 unique e-mail addresses, of which 72 matched those of HealthHub users. These 72 accounts were also suspected to have been breached.
Nevertheless, IHiS and HPB said there was "no evidence of a breach in the HealthHub system".
Also, illegal access was limited to the basic tier of HealthHub, which contains users' self-populated profiles and any Healthpoints accumulated through participation in HPB programmes.
Source: https://www.straitstimes.com/singapore/health/72-healthhub-accounts-suspected-hacked-leading-to-shut-down-of-e-service-for-6-days (https://www.straitstimes.com/singapore/health/72-healthhub-accounts-suspected-hacked-leading-to-shut-down-of-e-service-for-6-days)
-
Millions of Passengers Hit in Worst Ever Airline Data Hack
By Kyunghee Park and Jinshan Hong | October 25, 2018
Cathay Pacific Airways Ltd. said a hacker accessed personal information of 9.4 million customers, becoming the target of the world’s biggest airline data breach.
The airline’s shares sank the most in almost two years, shaving $201 million off its market value, after the Hong Kong-based carrier disclosed the unauthorized access late Wednesday, seven months after discovering the violation. While passports, addresses and emails were exposed, flight safety wasn’t compromised and there was no evidence any information has been misused, it said, without revealing details of the origin of the attack.
“This is quite shocking,” said Shukor Yusof, founder of aviation consulting firm Endau Analytics in Malaysia. “It’s probably the biggest breach of information in the aviation sector.”
Affecting more people than the population of Cathay Pacific’s home base of Hong Kong, the hack is in another league to breaches reported by British Airways Plc and Delta Air Lines Inc. this year. Those carriers boosted spending on cybersecurity after hacks, which saw personal and financial information of hundreds of thousands of customers illegally accessed.
“At this point, we believe it is uncertain if Cathay Pacific would be liable to any fines imposed by government authorities for such a breach,” Geoffrey Cheng, an analyst at Bocom International Holdings Co., wrote in a research note Thursday. “However, we expect the share price jitters to linger on for a while.”
The data breach at Cathay -- a partner of British Airways in the Oneworld airline alliance -- adds to the carrier’s woes, with Chief Executive Officer Rupert Hogg trying to turn it around after two straight annual losses.
“I’m truly sorry for the concern this may have caused you,” Hogg said, addressing customers in a video posted to the carrier’s website.
For the majority of people affected, the hackers accessed a combination of passenger name, and either phone number or email, Hogg said. No one’s travel, Asia Miles or Marco Polo Club loyalty program profiles were accessed in full, and no passwords were compromised, he said. Cathay Pacific is notifying affected passengers, and will provide free ID monitoring to those who request it, he said.
“Upon discovery, we acted immediately to contain the event and to thoroughly investigate,” Hogg said. “We engaged one of the world’s leading cybersecurity firms to assist us, and we further strengthened our IT security systems too.”
Shares of Cathay Pacific tumbled 3.8 percent in Hong Kong on Thursday, the biggest loss since January 2017.
What got exposed?
Names, nationalities, dates of birth, telephone numbers, email, physical addresses, numbers for passports, identity cards and frequent-flier programs, and historical travel information.
403 expired credit card numbers
27 credit numbers with no CVV, or a security code
About 860,000 passport numbers
245,000 Hong Kong IDs
Hong Kong’s privacy commissioner expressed serious concern over the leak and said the office will initiate a compliance check with the airline. A dedicated website, infosecurity.cathaypacific.com, provides information about the event and what affected passengers should do next.
We have discovered unauthorised access to some of our passenger data. For Data Security Event support, please DM @cxinfosec for assistance.
— Cathay Pacific (@cathaypacific) October 24, 2018
Some local lawmakers criticized Cathay for taking so long to reveal the breach. Lam Cheuk-ting, a member of the Legislative Council’s security committee, told reporters that many people in Hong Kong are angry and the airline should’ve taken the initiative the very first day it found out. Cathay’s Chief Customer and Commercial Officer Paul Loo said the airline wanted to have accurate grasp on the situation and didn’t wish to “create unnecessary panic,” AFP reported.
Upon discovery, Cathay said it took immediate action to contain the event and started a “thorough” probe with the assistance of a cybersecurity firm and bolstered its network security.
British Airways said the hack on its system lasted for more than two weeks during the months of August and September, compromising credit-card data of some 380,000 customers. Delta said in April that cyberattack on a contractor last year exposed the payment information of “several hundred thousand customers.”
Facebook Says 14 Million Users Had Intimate Data Hacked
Cathay is in the midst of a three-year transformation program, as part of which Hogg has reduced jobs starting with the carrier’s head office in Hong Kong to cut costs and introduced better business-class services on long-haul flights to help lure premium passengers.
Source: https://www.bloomberg.com/news/articles/2018-10-25/cathay-pacific-reports-data-breach-affecting-9-4-million-fliers
-
223 State Courts online case files accessed without authorisation due to loophole
Lydia Lam | 28 Nov 2018
SINGAPORE: Electronic case files in the State Courts' online management system were viewed by up to nine unauthorised people who exploited a loophole in the system, the courts said in a statement on Wednesday (Nov 28).
This was the first time that the State Courts had encountered such an incident, a spokesman said in response to media queries.
The Integrated Criminal Case Filing and Management System (ICMS) is a system used to document criminal cases.
The State Courts were alerted to a possible vulnerability in the system on Nov 1.
A total of 223 electronic case files were accessed over the course of the year (2018). Most of them (89 per cent) were concluded cases, while the rest were ongoing cases.
Data accessed from the files included names, personal identity information, addresses, gender of the accused, information about the offences, as well as the status of the case.
"Immediate steps were taken to fix the vulnerability," said the State Courts. "The e-case files had not been tampered with, and the integrity of ongoing proceedings was not affected."
The type of cases accessed by the individuals included criminal cases, coroner's inquiries, magistrate's complaints and a youth court case.
"Our review suggests that this is not a hacking incident and we do not currently have reason to believe that the unauthorised access activities were coordinated," said the State Courts spokesman.
The vulnerability was not found in its other online case filing management systems.
ICMS is used by lawyers, the media and accused persons, with different layers of access for each group of users.
While the State Courts did not have information on the number of ICMS users, the spokesman said there were about 190,000 cases in the system as of Nov 19.
Those who have been accused of crimes can access the ICMS Accused Person portal with a valid account through SingPass authentication.
Preliminary findings show that a few such accused persons exploited a loophole in the ICMS system which allowed them to view court documents in other e-case files.
While the State Courts did not elaborate on what the loophole was, the spokesman said it was patched to prevent unauthorised access to court documents within 12 hours of being alerted to it.
They also reported the matter to the police.
Along with their system vendor Ecquaria Technologies, the State Courts implemented additional measures to protect the security and confidentiality of the information in ICMS by enhancing user access controls within the system.
Investigations by the police are ongoing and letters have been sent to all parties affected.
The State Courts said they have set up a dedicated email (query@statecourts.gov.sg) and hotline (6435 5651) to address queries.
They said that they take a serious view of any unauthorised access of information in their case management systems and will do what is necessary to prevent similar incidents from occurring.
Source: https://www.channelnewsasia.com/news/singapore/223-state-courts-online-case-files-accessed-without-10976490 (https://www.channelnewsasia.com/news/singapore/223-state-courts-online-case-files-accessed-without-10976490)
-
Marriott hack hits 500 million Starwood guests
30 November 2018
The records of 500 million customers of the hotel group Marriott International have been involved in a data breach.
The hotel chain said the guest reservation database of its Starwood division had been compromised by an unauthorised party.
It said an internal investigation found an attacker had been able to access the Starwood network since 2014.
The company said it would notify customers whose records were in the database.
Marriott International bought Starwood in 2016, creating the largest hotel chain in the world with more than 5,800 properties.
Starwood's hotel brands include W Hotels, Sheraton, Le Méridien and Four Points by Sheraton. Marriott-branded hotels use a separate reservation system on a different network.
Marriott said it was alerted by an internal security tool that somebody was attempting to access the Starwood database. After investigating, it discovered that an "unauthorised party had copied and encrypted information".
It said it believed its database contained records of up to 500 million customers.
For about 327 million guests, the information included "some combination" of:
o name
o address
o phone number
o email address
o passport number
o account information
o date of birth
o gender
o arrival and departure information
It said some records also included encrypted payment card information, but it could not rule out the possibility that the encryption keys had also been stolen.
"We deeply regret this incident happened," the company said in a statement.
"Marriott reported this incident to law enforcement and continues to support their investigation. The company has already begun notifying regulatory authorities."
The company has set up a website to give affected customers more information. It will also offer customers in the US and some other countries a year-long subscription to a fraud-detecting service.
In a statement, the UK's Information Commissioner's Office said: "We have received a data breach report from Marriott involving its Starwood Hotels and will be making enquiries. If anyone has concerns about how their data has been handled they can report these concerns to us."
What should I do if I'm affected?
The Marriott group said it would contact affected customers whose email addresses were in the Starwood reservation database.
The database contained details of reservations made on or before 10 September 2018.
The company has set up a dedicated help website for those affected and is also operating a free helpline. For UK customers the number is 0808 189 1065.
Marriott is not certain whether the attackers were able to obtain payment information, so be aware of any suspicious transactions on your account.
Also be aware that scammers may be sending out mass emails pretending to represent the Marriott group.
The company says it will not include attachments in its notification emails and will not ask for personal information over email. If in doubt, call the helpline.
The company is offering affected customers a year-long subscription to a fraud-checking service.
Analysis
by Chris Fox, technology reporter
It's not the biggest data breach we've ever seen (that dubious honour goes to Yahoo!) but it's certainly up there with some of the worst.
Not only were up to 500 million customer records accessed and potentially copied, but the attackers had had unauthorised access since 2014.
And even though payment card information was encrypted, the company thinks the key may have been stolen too.
The UK's data regulator has confirmed it is investigating, and so the threat of a whopping GDPR penalty looms.
Although the Marriott group's headquarters are in the US, it has to comply with the EU's GDPR rules when dealing with citizens in the EU.
The way it has disclosed this breach, notified customers and offered fraud-checking services will certainly help its cause.
But the ICO and other international regulators may rule the company has been too slow to act.
As always with a big data breach, be aware that scammers may send out emails claiming to be from the Marriott group.
The hotel chain says it will not send any notification emails with attachments, and will not request any information from its customers by email.
Source: https://www.bbc.com/news/technology-46401890
-
Quora says 100 million users may have been affected by data breach
Catherine Shu@catherineshu | 3 Dec 2018
Quora said today that a security breach may have compromised data from about 100 million users. In an email sent to users today and a blog post by CEO Adam D’Angelo, the company said a “malicious third party” gained unauthorized access to Quora’s systems on Friday. Its internal security teams and a “leading digital forensics and security firm” are currently investigating the breach. Law enforcement officials have also been notified.
The company believes it has identified the root cause of the breach and “taken steps to address the issue, although our investigation is ongoing and we’ll continue to make security improvements.” Quora also added that anonymous questions and answers were not affected by the breach because it does not store the identities of people who make anonymous postings.
The company is currently notifying users whose data was compromised and logging out all Quora users who may have been affected as a security precaution. It is also invalidating their passwords if they used one. A FAQ about the breach has been set up here.
According to Quora, the following user data may have been accessed:
Account and user information, e.g. name, email, IP, user ID, encrypted password, user account settings, personalization data
Public actions and content including drafts, e.g. questions, answers, comments, blog posts, upvotes
Data imported from linked networks when authorized by you, e.g. contacts, demographic information, interests, access tokens (now invalidated)
Non-public actions, e.g. answer requests, downvotes, thanks
Non-public content, e.g. direct messages, suggested edits
In another article on its help center, Quora said “it is confident that no partner’s financial information has been compromised.” Some access tokens associated with Stripe, the payment processing service used by the company, were “temporarily compromised,” but Quora confirmed with Stripe that no access tokens have been used since the incident and no financial information was breached.
All users with Stripe accounts have also had their access tokens reset. “We are confident that no personal financial information that was accessible through Stripe has been compromised. Furthermore, no personal financial information is currently vulnerable,” Quora said.
Source: https://techcrunch.com/2018/12/03/quora-says-100-million-users-may-have-been-affected-by-data-breach/
-
Another Google+ data bug exposes info for 52.5 million users
Google will shut the service down in April of 2019 instead of August as initially planned.
Andrew Tarantola | 10 Dec 2018
Google's semi-defunct social media platform Google+ has suffered its second data breach in three months and, as a result, will be completely shuttered in April, four months earlier than previously planned.
In October, Google revealed that it had found a major security bug potentially impacting around a half million Google+ users. The company at that point made the decision to shut down the service the following August. Last month, Google once again spotted a security issue, on that could potentially serve up the personal information of some 52.5 million users -- including names, email address, occupation, gender, birthday, relationship status and age, whether they were set to public or not -- to developers using the Google+ API. This was the final straw for the company, which has announced that the service will shut down four months early and its API will cease functioning within 90 days.
While the API bug did potentially impact tens of millions of users, Google asserts that it has found no evidence of the exploit being acted upon or the data being misused. What's more, the security hole has already been patched so the service's few remaining fans will be able to enjoy it, at least until the spring.
Source: https://www.engadget.com/2018/12/10/google-plus-data-leak-info-52-5-millionGoogle (https://www.engadget.com/2018/12/10/google-plus-data-leak-info-52-5-millionGoogle) Source (2nd breach, Dec 2018): https://www.blog.google/technology/safety-security/expediting-changes-google-plus/ (https://www.blog.google/technology/safety-security/expediting-changes-google-plus/)
1st breach (Oct 2018): https://techcrunch.com/2018/10/08/google-plus-hack/ (https://techcrunch.com/2018/10/08/google-plus-hack/)
-
Potential data breach after travel agency employee loses hard disk
Disk contains names, mailing addresses and NRIC details of more than 200 clients
David Sun | Dec 19, 2018
The authorities are investigating a potential data breach after a travel agency employee lost a hard disk containing personal details of clients.
The employee of Insight Vacations had taken the disk out of the office without authorisation and lost it in a taxi on the way home.
The disk, which has not been recovered, contains the names, mailing addresses and NRIC details of more than 200 clients, as well as the names, mailing addresses and mobile numbers of more than 5,000 people on the agency's mailing lists.
The incident came to light only after the agency recently conducted an internal review of best practices for data protection.
A spokesman for Insight Vacations (https://www.insightvacations.com/asia) told The New Paper yesterday the employee was reprimanded and has since resigned.
"We immediately reported the incident to the relevant authorities after we discovered the accidental loss as we felt it was important to take a proactive approach to alerting those affected on the risks of someone misusing their mobile number or mailing address," she said.
"We value the importance of our guests' privacy and, as a company, regularly review policies regarding customer data privacy."
She said there had been no indication that any personal data had been accessed or used inappropriately, but the company wanted to be accountable to its clients and the public.
"Insight Vacations and our parent company, The Travel Corporation, take security of customer data seriously and regret that this incident has happened," she said.
"We have extensive policies and procedures governing the security of customers' personal information, including the use of portable data storage devices, and are conducting a thorough review of potentially affected records and taking measures to further improve our data security going forward."
Insight Vacations said it will be engaging third-party experts on data privacy and system security, and is implementing mandatory training for employees provided by a global data security training provider.
A spokesman for the Personal Data Protection Commission said it is investigating after it was notified of the incident.
Insight Vacations e-mailed its clients and people on its mailing lists yesterday to inform them that it was actively monitoring for indications of information being leaked.
The e-mail also assured them that it had taken the necessary steps and are committed to protecting the information.
The recipients were advised to take precautionary steps to avoid falling victim to fraudulent activities.
Mr Steven Wong, 63, an office manager who received the e-mail, said he had provided his details when he took part in a contest by Insight Vacations.
"I actually found it amusing that someone left the hard disk in a taxi," he said.
Singapore had its most serious data breach in June when the personal data of 1.5 million SingHealth patients was compromised. Noting this and other breaches, Mr Wong said the public should know by now to be more alert of scams.
He said: "I don't know the extent of this new potential breach, but people should always be on the alert of identity theft and scams."
Source: https://www.tnp.sg/news/singapore/potential-data-breach-after-travel-agency-employee-loses-hard-disk (https://www.tnp.sg/news/singapore/potential-data-breach-after-travel-agency-employee-loses-hard-diskReference)
-
Personal details of 284 KrisFlyer members disclosed due to software bug: SIA
Jan 6, 2019 | Tee Zhuo
SINGAPORE - Personal details of over 280 KrisFlyer members may have been seen by other customers due to a software bug affecting Singapore Airlines’ (SIA) website on Friday (Jan 4).
“We have been made aware of a number of cases in which a customer logged in to his or her KrisFlyer account, under certain specific conditions, may have been able to see selective details of another customer,” an SIA spokesman said in response to queries.
These details may have included names, e-mail addresses, account numbers, membership tier statuses, KrisFlyer miles and rewards, travel history and in seven cases, passport details.
The spokesman added that the breach occurred when any two members log in to their KrisFlyer accounts and access transactions displaying their membership information at the same time, while also being assigned the same server by the system.
On Saturday, Facebook user Tricia Leo said in a post that when she logged into her KrisFlyer account, she realised that she could see another person’s e-mail address on her profile page.
“I tried a new login and I could see his entire history, upcoming trips, miles,” she wrote.
“If organisations that demand our personal data don’t guard our information properly, then they need to be called out on it.”
In a statement, SIA said that no changes were made to members’ accounts and no credit card details were disclosed.
Investigations based on system logs determined 284 cases in total, it added.
“We have established that this was a one-off software bug and was not the result of an external party’s breach of our systems or members’ accounts,” SIA said.
"The issue has been resolved and we will carry out a detailed review to ensure this will not happen again."
The software bug arose from a change to SIA’s website homepage on Friday, and the incident occurred between about 2am and 12.15pm.
SIA said that it is following up directly with affected customers, and has voluntarily informed the Personal Data Protection Commission (PDPC).
A PDPC spokesman confirmed that it had been notified of the incident, and added that the commission was looking into it.
“The protection of our customers’ personal data is of utmost importance to SIA, and we sincerely regret the incident,” SIA added.
This comes after a number of data leak incidents here last year.
The Straits Times reported in August that over 4,300 Shangri-La International Hotel Management rewards club members had details like names and e-mail addresses leaked, including "a small number" of Singapore customers.
In July, ST reported that some 3,000 RedMart customers were affected by a data breach that leaked their e-mail addresses and put them at risk of phishing.
The same month, it was reported that Singapore suffered its worst cyber attack when hackers stole personal particulars of over 1.5 million patients from SingHealth.
Source: https://www.straitstimes.com/singapore/transport/personal-details-of-284-krisflyer-members-disclosed-due-to-software-bug-sia
-
Public Report of the Committee of Inquiry (COI) into the cyber attack on Singapore Health Services Private Limited Patient Database
10 January 2019 - The Committee of Inquiry (COI)#, convened to inquire into the events and contributing factors leading to the cyber attack on Singapore Health Services Private Limited (SingHealth)’s patient database system, has released its public report.
# Convened on 24 July 2018, the chairman of the COI is Retired Senior (subsequently termed Chief) District Judge Mr Richard R Magnus. The other members of the Committee are Mr Lee Fook Sun, Director and Chairman of Ensign InfoSecurity; Mr T K Udairam, Group Chief Operating Officer of Sheares Healthcare Management Pte Ltd; and Ms Cham Hui Fong, Assistant Secretary-General of the National Trades Union Congress.
Source: https://www.mci.gov.sg/coireport (https://www.mci.gov.sg/coireport)
PDF of the report (454 pages): https://goo.gl/J3F71E (https://goo.gl/J3F71E)
Cache of the report: https://goo.gl/vuUG5D (https://goo.gl/vuUG5D)
IHiS fined record S$750,000, SingHealth with S$250,000 for Singapore's worst data breach
Jan 15, 2019 - 12:40 PM
SINGAPORE'S privacy watchdog has meted out its largest fine of S$750,000 to Integrated Health Information Systems (IHiS) for lapses in securing patient data which resulted in the nation's worst data breach.
The cyber attack on SingHealth in June 2018 compromised the personal information of 1.5 million patients, including Prime Minister Lee Hsien Loong.
Even though IHiS is the technology vendor for Singapore's healthcare sector, SingHealth also has to take responsibility as the owner of the patient database system - a point that the Personal Data Protection Commission (PDPC) stressed in dishing out penalties.
As such, SingHealth was fined S$250,000, the second largest here.
In a statement on Tuesday, the PDPC said: "Even if organisations delegate work to vendors, organisations as data controllers must ultimately take responsibility for the personal data that they have collected from their customers."
SEE ALSO: SingHealth data breach probe reveals 'blanket' of basic failings
Singapore's privacy watchdog also found the person handling security incidents involving SingHealth to be unfamiliar with the incident response process. He failed to take further steps to investigate and understand reports on suspicious activities, it noted.
The PDPC was referring to the key technology risk man at IHiS - cluster information security officer Wee Jia Huo - who was in charge of the SingHealth cluster.
In a public report issued last week by the Committee of Inquiry probing the cyber attack, Mr Wee was said to have displayed "an alarming lack of concern" when it was clear that a critical system had been potentially breached.
IHiS and SingHealth are wholly owned subsidiaries of MOH Holdings, the holding company through which the Singapore Government owns the corporatised institutions in the public healthcare sector.
It was reported on Monday that IHiS had fired two employees and redeployed its technology risk man. Mr Wee, whose job was to decide if upper management should be alerted about incidents, was demoted and redeployed to another role.
IHiS would also impose "significant financial penalty" on five members of its senior management team, including chief executive officer Bruce Liang.
Those found to be in breach of the Personal Data Protection Act in Singapore could be fined up to S$1 million. Karaoke bar chain K Box was among the first batch of organisations punished for breaking the law. It was fined S$50,000 over an incident in September 2014 that saw the data of 317,000 customers leaked.
Source: https://www.businesstimes.com.sg/government-economy/ihis-fined-record-s750000-singhealth-with-s250000-for-singapores-worst-data
-
The Multi-Billion Dollar Industry That Makes Its Living From Your Data
(http://tralvex.com/download/forum/2018_Personal-data-ecosystem-small.jpg)
Enlarged version: https://goo.gl/QzVHvt
Source: https://www.visualcapitalist.com/personal-data-ecosystem
-
UNAUTHORISED POSSESSION AND DISCLOSURE OF INFORMATION FROM HIV REGISTRY
28th Jan 2019
1. Following an alert by the Police, the Ministry of Health (MOH) has ascertained that confidential information regarding 14,200 individuals diagnosed with HIV up to January 2013, and 2,400 of their contacts, is in the possession of an unauthorised person. The information has been illegally disclosed online. We have worked with the relevant parties to disable access to the information.
2. We are sorry for the anxiety and distress caused by this incident. Our priority is the wellbeing of the affected individuals. Since 26 January, we have been progressively contacting the individuals to notify them and render assistance.
3. On 22 January, MOH was notified by the Police that confidential information from MOH’s HIV Registry[1] may have been disclosed by an unauthorised person. MOH made a Police report on 23 January. On 24 January, MOH ascertained that the information matched the HIV Registry’s records up to January 2013.From 24 to 25 January, MOH worked with the relevant parties to disable access to the information.
4. The records were those of 5,400 Singaporeans diagnosed with HIV up to January 2013 and 8,800 foreigners[2] diagnosed with HIV up to December 2011. The information included their name, identification number, contact details (phone number and address), HIV test results and related medical information. The name, identification number, phone number and address of 2,400 individuals identified through contact tracing up to May 2007 were also included.
5. While access to the confidential information has been disabled, it is still in the possession of the unauthorised person, and could still be publicly disclosed in the future. We are working with relevant parties to scan the Internet for signs of further disclosure of the information.
Background
6. The confidential information is in the illegal possession of one Mikhy K Farrera Brochez, a male US citizen who was residing in Singapore, on an employment pass, between January 2008 and June 2016. Brochez was remanded in Prison in June 2016. He was convicted of numerous fraud and drug-related offences in March 2017, and sentenced to 28 months’ imprisonment. The fraud offences were in relation to Brochez lying about his HIV status to the Ministry of Manpower, in order to obtain and maintain his employment pass, furnishing false information to Police officers during a criminal investigation, and using forged degree certificates in job applications. Upon completing his sentence, Brochez was deported from Singapore. He currently remains outside Singapore.
7. Brochez was a partner of Ler Teck Siang, a male Singaporean doctor. As the Head of MOH’s National Public Health Unit (NPHU) from March 2012 to May 2013, Ler had authority to access information in the HIV Registry as required for his work. Ler resigned in January 2014. He was charged in Court in June 2016 for offences under the Penal Code and the Official Secrets Act (OSA). In September 2018, Ler was convicted of abetting Brochez to commit cheating, and also of providing false information to the Police and MOH. He was sentenced to 24 months’ imprisonment. Ler has appealed, and his appeal is scheduled to be heard in March 2019. In addition, Ler has been charged under the OSA for failing to take reasonable care of confidential information regarding HIV-positive patients. Ler’s charge under the OSA is pending before the Courts.
8. In May 2016, MOH had lodged a Police report after receiving information that Brochez was in possession of confidential information that appeared to be from the HIV Registry. Their properties were searched, and all relevant material found were seized and secured by the Police.
9. In May 2018, after Brochez had been deported from Singapore, MOH received information that Brochez still had part of the records he had in 2016. The information did not appear to have been disclosed in any public manner. MOH lodged a police report, and contacted the affected individuals to notify them.
10. On 22 January 2019, MOH was notified that more information from the HIV Registry could still be in the illegal possession of Brochez. On this occasion, he had disclosed the information online.
11. Brochez is currently under Police investigation for various offences, and the authorities are seeking assistance from their foreign counterparts.
12. This incident is believed to have arisen from the mishandling of information by Ler, who is suspected of not having complied with the policies and guidelines on the handling of confidential information. MOH takes a grave view of such matters, and will not hesitate to take stern action against staff and other individuals who abuse their authority and access to confidential information, or fail to handle such information in a proper manner.
Additional Safeguards in Disease Registries
13. Since 2016, additional safeguards against mishandling of information by authorised staff have been put in place. For example, a two-person approval process to download and decrypt Registry information was implemented in September 2016, to ensure that the information cannot be accessed by a single person. A workstation specifically configured and locked down to prevent unauthorised information removal was designated for processing of sensitive information from the HIV Registry. The use of unauthorised portable storage devices on official computers was disabled in MOH in 2017, as part of a government-wide policy.
14. MOH will continue to regularly review our systems to ensure that they remain secure and that the necessary safeguards are in place.
15. We appeal to members of the public to notify MOH immediately should they come across information related to this incident, and not further share it. Members of the public who have such information or other concerns can contact our hotline at 6325 9220.
[1] The HIV Registry contains information concerning individuals diagnosed with HIV, a notifiable disease under the Infectious Diseases Act (IDA). MOH relies on information from the Registry to monitor the HIV infection situation, conduct contact tracing in relation to HIV patients and assess disease prevention and management measures.
[2] This includes work and visit pass applicants/ holders.
Source: https://www.moh.gov.sg/news-highlights/details/unauthorised-possession-and-disclosure-of-information-from-hiv-registry (https://www.moh.gov.sg/news-highlights/details/unauthorised-possession-and-disclosure-of-information-from-hiv-registry)
HIV data leak: What we know about Mikhy Farrera Brochez
By Afifah Darke | 28 Jan 2019
SINGAPORE: The Ministry of Health (MOH) on Monday (Jan 28) announced
that the HIV-positive status and personal information of 14,200 people
from Singapore’s HIV registry were leaked online by US citizen Mikhy Farrera Brochez, who had previously worked here as a
lecturer in two polytechnics.
Brochez, who was deported in April last year, was jailed in 2016 for
lying about his HIV status to gain an employment pass.
The 32-year-old, who was also convicted of fraud and drug-related
offences, was sentenced to 28 months’ jail.
Here’s what we know about him:
*HOW DID BROCHEZ LEAK THE INFORMATION? *
Brochez was the romantic partner of Ler Teck Siang, a male Singaporean
doctor who was the former head of the National Public Health Unit
at the Ministry of Health (MOH) between March 2012 and May 2013.
According to court documents, the couple started living together in
Singapore in 2008. They got married in New York City on Apr 24, 2014.
As head of MOH's National Public Health Unit, Ler had authority to
access information in the HIV Registry as required for his work, said MOH.
Ler, who resigned in January 2014, is believed to have mishandled the
information and is suspected of not having complied with the policies
and guidelines on the handling of such confidential information.
In May 2016, MOH lodged a police report after receiving information that
Brochez was in possession of confidential information that appeared to
be from the HIV Registry.
Police searched the couple's properties and relevant material was seized
as well.
In May 2018, after Brochez had been deported from Singapore, MOH
received information that he still had part of the records. While the
information did not appear to have been made public, MOH lodged a police
report and contacted the affected individuals to inform them.
On Jan 22 this year, MOH was notified by the police that Brochez may
still have more information from the HIV Registry, and had leaked it online.
*HOW DID BROCHEZ ENTER SINGAPORE? *
Ler helped Brochez, who was HIV-positive, dupe the Ministry of Manpower
(MOM) into issuing the American an employment pass.
On two separate occasions, Ler gave a sample of his own blood to be
submitted so that Brochez could hide his HIV status.
The first instance was in March 2008 for a compulsory medical test
required by the MOM for issuing the employment pass.
Brochez, who suspected he was HIV-positive, knew that he would not be
granted an employment pass if MOM knew his medical status, court
documents showed.
Ler suggested submitting his blood in Brochez's name to MOM in order to
yield a negative result.
On the morning of Mar 13, Ler drew his own blood at home and stored it
in a test tube.
Ler, who was a locum general practitioner at My Family Clinic at
Commonwealth that day, brought the test tube to work with him.
When Brochez visited the clinic that evening for a blood test, Ler
labelled the test tube with Brochez's particulars and submitted it for
testing.
As a result, the test came back negative and MOM issued an employment
pass to Brochez.
In October 2013, MOM received information that Brochez was HIV positive
and directed him to cancel the personalised employment pass he had
obtained in Feb 2011.
Brochez responded by saying that he had been falsely accused and told
MOM he would supply "proof of being free of HIV".
To prevent the pass from being cancelled, the couple repeated the ruse
they had used in 2008 at the clinic Ler was working at at that time.
As a result, MOM allowed him to retain his pass.
According to court documents, Brochez said he and Ler were in love and
the only way for them to be together was to commit the offences due to
the “discriminatory” laws.
He also claimed that he posed no public health risk as he had been
taking antivirals since 2008.
*WHAT ELSE DID HE FAKE? *
When police raided Brochez's residence, they seized several certificates
purportedly issued to him, said court documents.
This included a linguistics degree from Vanderbilt University, a
Master’s degree in developmental and child psychology as well as a
doctorate in psychology and education from the University of Paris. A
professional teaching certificate was also seized.
Investigations revealed that all the certificates were forged and that
Brochez neither attended the institutions nor obtained the qualifications.
He had used the certificates to apply for jobs with educational
institutions in Singapore.
Authorities also found a Bahamian passport with the name Malatesta da
Farrera-Brochez in a safe.
Though the passport bore the same birth date and photograph of Brochez
as shown in his US passport, police confirmed that it was a fake.
During his work in Singapore, Brochez received multiple awards and
recognition for teaching excellence. He also published articles in
scientific journals and books on child psychology.
Brochez has also represented Singapore at international conferences for
academia and research.
In a 2010 interview with a local newspaper, Brochez claimed that he was
enrolled in Princeton University at the age of 13. However, he
transferred to Vanderbilt University in his first year because he felt
the latter offered better linguistic courses.
In the interview, Brochez said he could converse in eight
languages, including Hebrew and Spanish, saying that he was "a gifted
child".
Brochez claimed he was a successful "laboratory rat" of his mother, a Dr
Theresa King, who was purportedly a renowned professor of child and
adolescent psychology in the UK.
"My mother is a really big influence in my life. I would not have made
it without all her help and guidance," he had said in the interview.
However, according to British daily The Independent, there was no
psychologist with such qualifications under the name given by Brochez.
When The Independent contacted a UK-registered psychologist who
qualified under the name given by Brochez, the news site was told that
Brochez was not her son, and that she did not specialise in any of the
relevant areas.
Source: https://www.channelnewsasia.com/news/singapore/hiv-positive-records-leaked-online-singapore-mikhy-brochez-11175718 (https://www.channelnewsasia.com/news/singapore/hiv-positive-records-leaked-online-singapore-mikhy-brochez-11175718)
-
620 million accounts stolen from 16 hacked websites now for sale on dark web, seller boasts
Dubsmash, Armor Games, 500px, Whitepages, ShareThis, and more said to be up for grabs for $$$s in BTC
Chris Williams | 11 Feb 2019
Exclusive Some 617 million online account details stolen from 16 hacked websites are on sale from today on the dark web, according to the data trove's seller.
For less than $20,000 in Bitcoin, it is claimed, the following pilfered account databases can be purchased from the Dream Market cyber-souk, located in the Tor network:
Dubsmash (162 million), MyFitnessPal (151 million), MyHeritage (92 million), ShareThis (41 million), HauteLook (28 million), Animoto (25 million), EyeEm (22 million), 8fit (20 million), Whitepages (18 million), Fotolog (16 million), 500px (15 million), Armor Games (11 million), BookMate (8 million), CoffeeMeetsBagel (6 million), Artsy (1 million), and DataCamp (700,000).
Sample account records from the multi-gigabyte databases seen by The Register appear to be legit: they consist mainly of account holder names, email addresses, and passwords. These passwords are hashed, or one-way encrypted, and must therefore be cracked before they can be used.
There are a few other bits of information, depending on the site, such as location, personal details, and social media authentication tokens. There appears to be no payment or bank card details in the sales listings.
Who are the buyers?
These silos of purportedly purloined information are aimed at spammers and credential stuffers, which is why copies are relatively cheap to buy. The stuffers will take usernames and passwords leaked from one site to log into accounts on other websites where the users have used the same credentials.
So, for example, someone buying the purported 500px database could decode the weaker passwords in the list, because some were hashed using the obsolete MD5 algorithm, and then try to use the email address and cracked password combinations to log into, say, strangers' Gmail or Facebook accounts, where the email address and passwords have been reused.
All of the databases are right now being touted separately by one hacker, who says he or she typically exploited security vulnerabilities within web apps to gain remote-code execution and then extract user account data. The records were swiped mostly during 2018, we're told, and went on sale this week.
The seller, who is believed to be located outside of the US, told us the Dubsmash data has been purchased by at least one person.
Some of the websites – particularly MyHeritage, MyFitnessPal, and Animoto – were known to have been hacked as they warned their customers last year that they had been compromised, whereas the others are seemingly newly disclosed security breaches. In other words, this is the first time we've heard these other sites have been allegedly hacked. This also marks the first time this data, for all of the listed sites, has been peddled publicly, again if all the sellers' claims are true.
Is this legit?
A spokesperson for MyHeritage confirmed samples from its now-for-sale database are real, and were taken from its servers in October 2017, a cyber-break-in it told the world about in 2018. CoffeeMeetsBagel, 8fit, 500px, DataCamp, and EyeEm also confirmed their account data was stolen from their servers and put up for sale this week in the seller's collection. This lends further credibility to the data trove.
Last week, half a dozen of the aforementioned sites were listed on Dream Market by the seller: when we spotted them, we alerted Dubsmash, Animoto, EyeEm, 8fit, Fotolog, and 500px that their account data was potentially being touted on the dark web.
Over the weekend, the underground bazaar was mostly knocked offline, apparently by a distributed denial-of-service attack. On Monday this week, the underworld marketplace returned to full strength, and the seller added the rest of the sites. We contacted all of them to alert them, and ask for a response. Meanwhile, Dream Market has been smashed offline again.
Here's a summary of what is, or briefly was, purported to be on sale:
Dubsmash: 161,549,210 accounts for 0.549 BTC ($1,976) total
11GB of data taken in December 2018. Each account record contains the user ID, SHA256-hashed password, username, email address, language, country, plus for some, but not all the users, the first and the last name. This alleged security breach has not been previously publicly disclosed. Dubsmash is a video-messaging application popular with millennials and younger folk.
New York City-based Dubsmash has hired law firm Lewis Brisbois to probe the online sale. Partner Simone McCormick told us:
Our office has been retained to assist Dubsmash in this matter. Thank you for your alert. We immediately launched an investigation. We plan to notify any and all individuals as appropriate. Again, thank you for bringing this to our attention.
500px: 14,870,304 accounts for 0.217 BTC ($780) total
1.5GB of data taken July 2018. Each account record contains the username, email address, MD5-, SHA512- or bcrypt-hashed password, hash salt, first and last name, and if provided, birthday, gender, and city and country. 500px is a social-networking site for photographers and folks interested in photography.
"Our engineering team is currently investigating and if we can confirm there was a breach we will take the necessary steps to inform our users as per GDPR standards," 500px spokesperson Stephanie Newell told us.
Update: 500px staff are now notifying their users that the site was indeed hacked, and will reset everyone's passwords, starting with the ones weakly hashed using MD5.
"We are able to confirm a breach occurred," Newell told us. "Our engineers immediately launched a comprehensive review of our systems and have since taken every precaution to secure them. All areas of vulnerability have been identified and fixed during our internal investigation, and we’ve found no evidence to date of any recurrence of the issue.
"We are currently working on notifying our entire user base, however, given the amount of users affected, this task will span one day at minimum. We’ve taken every precaution to ensure our users' data is safe. A system-wide password reset is currently underway for all users, prioritized in order of accounts with the highest potential risk, and we have already forced a reset of all MD5-encrypted passwords."
In addition, 500px, which is based in Canada, said it has taken the following steps to shore up its security:
- Vetted access to our servers, databases, and other sensitive data-storage services.
- Analyzed and are continuing to monitor our source code, both public-facing and internal, to improve our security protocols and protect against security issues.
- We have partnered with leading experts in cyber security to further secure our website, mobile apps, internal systems, and security processes.
- Modifications to our our internal software development process.
- Reviewing the PII [personally identifying information] data we collect from users and how it is used on our platform.
- We are continuing to upgrade our network infrastructure. Over the last 12 months, we have undertaken a major upgrade to our network infrastructure—this project is nearing completion, and will also offer a significant increase in security.
EyeEm: 22,360,765 accounts for 0.289 BTC ($1,040) total
1.7GB of data taken February 2018. Each account record contains an email address and SHA1-hashed password, although about three million are missing an email address. This security breach has not been previously publicly disclosed. Germany-based EyeEm is an online hangout for photographers. A spokesperson did not respond to a request for comment.
Update: EyeEm has told its customers it was hacked, and forced a reset of their passwords.
8fit: 20,180,667 accounts for 0.2025 BTC ($728) total
1.9GB of data taken July 2018. Each account record contains an email address, bcrypted-hashed password, country, country code, Facebook authentication token, Facebook profile picture, name, gender, and IP address. This security breach has not been previously publicly disclosed. Germany-headquartered 8fit offers customized workout and diet plans for healthy fitness types.
8fit CEO Aina Abiodun told us her team is investigating, adding: "I need to get back to you on this and can't comment immediately."
Update: 8fit has confessed to its users that it was hacked, and is resetting their passwords.
Fotolog: 16 million accounts for 0.52 BTC ($1,872) total
5.9GB of data taken in December 2018. There are five SQL databases containing information including email addresses, SHA256-hashed passwords, security questions and answers, full names, locations, interests, and other profile information. This alleged security breach has not been previously publicly disclosed. Fotolog, based in Spain, is another social network for photography types. A spokesperson did not respond to a request for comment.
Animoto 25,402,283 accounts for 0.318 BTC ($1,144) total
2.1GB of data taken in 2018. Each account record contains a user ID, SHA256-hashed password, password salt, email address, country, first and last name, and date of birth. This security breach was publicly disclosed by the NYC-headquartered business in 2018, though this is the first time the data has gone on sale, we understand.
"We provided notification about an incident potentially affecting customers back in August 2018 after we identified unusual activity on our system," spokesperson Rebecca Brooks told us. "After identifying the suspicious activity, we immediately took the systems offline and implemented numerous security controls to help prevent an incident like this from happening again."
MyHeritage 92,284,478 accounts for 0.549 BTC ($1,976) total
3.6GB of data taken October 2017. Each account record contains an email address, SHA1-hashed password and salt, plus the date of account creation. This security breach was publicly disclosed by the business last year, though this is the first time the data has gone on sale, we're told. No DNA or similar sensitive information was taken. MyHeritage, based in Israel, is a family-tree-tracing service that studies customers' genetic profiles.
A spokesperson told us:
The date, the number of users affected, and the type of information [in the 2018 disclosure] correspond almost exactly to [the for-sale database], so this does not look like a new breach. It seems likely that the perpetrator(s) of the October 2017 breach or someone who obtained the data from them is now trying to sell it. We will investigate this immediately and report the attempted sale to the authorities so they can try to trace the perpetrators. Until this moment, we have not seen any evidence of circulation or usage or abuse of the breached email addresses and hashed passwords, and this is the first time a mention of them has surfaced since June 4 2018.
MyFitnessPal 150,633,038 accounts for 0.289 BTC ($1,040) total
3.5GB of data taken February 2018. Each account record contains a user ID, username, email address, SHA1-hashed password with a fixed salt for the whole table, and IP address. This security breach was publicly disclosed by the business last year. This may be the first time it has gone on public sale. Under-Armor-owned MyFitnessPal does what it says on the tin: it's an app that tracks diet and exercise. A spokesperson did not respond to a request for comment.
Update: Spokesperson Erin Wendell has told us the biz made every user reset their password following the discovery of the intrusion last year. If you reused your old MyFitnessPal password with other sites, now would be a good time to change your password on those other services, if you have not done so already.
"We responded swiftly to alert users and have since required all MyFitnessPal users who had not changed their passwords since that March 29, 2018 announcement, to reset their passwords," Wendell said.
"As a result, passwords previously used for MyFitnessPal at the time of the data security issue are no longer valid on MyFitnessPal, and we continue to encourage strong password practices including unique and complex passwords for all their accounts to enable users to further protect themselves."
Artsy 1,070,000 accounts for 0.0289 BTC ($104) total
184MB of data taken April 2018. Each account record contains an email address, name, IP addresses, location, and SHA512-hashed password with salt. This security breach has not been previously publicly disclosed. Artsy, located in NYC, is an online home for collecting and organizing art. A spokesperson did not respond to a request for comment.
Update: Artsy has emailed its users to confirm its data was stolen and sold online. It is in the process of investigating how it happened.
Armor Games 11,013,617 accounts for 0.2749 BTC ($988) total
1.8GB of data taken late December 2018. Each account record contains a username, email address, SHA1-hashed password and salt, date of birth, gender, location, and other profile details. This alleged security breach has not been previously publicly disclosed. California-based Armor Games is a portal for a ton of browser-based games. A spokesperson did not respond to requests for comment.
Bookmate 8,026,992 accounts for 0.159 BTC ($572) total
1.7GB of data taken July 2018. Each account record typically contains a username, an email address, SHA512 or bcrypt-hashed password with salt, gender, date of birth, and other profile details. This alleged security breach has not been previously publicly disclosed. British Bookmate makes book-reading apps. A spokesperson did not respond to a request for comment.
CoffeeMeetsBagel 6,174,513 accounts for 0.13 BTC ($468) total
673MB of data taken late 2017 and mid-2018. Each account record contains typically a full name, email address, age, registration date, and gender. This security breach has not been previously publicly disclosed. CoffeeMeetsBagel is a dating website.
Jenn Takahashi, spokesperson for the CoffeeMeetsBagel, told us: "We are not aware of a breach at this time, but our security team is looking into this now." She also said the San-Francisco-based biz does not store passwords, and uses third-party sites for authentication.
"We have engaged with our legal team and forensic security experts to identify any issues and ensure we have the best security stance moving forward," Takahashi added.
Update: CoffeeMeetsBagel has confirmed at least some user account data was stolen by a hacker who broke into the biz's systems as recently as May 2018, as we reported.
"On February 11, 2019, we learned that an unauthorized party gained access to a partial list of user details, specifically names and email addresses prior to May 2018," the company said in a statement.
"Once we became aware, we immediately launched a comprehensive investigation with the help of experienced forensic experts. We are currently working on notifying the affected user base. The security of our users’ information is important to us, and we apologize for any inconvenience this may have caused."
DataCamp 700,000 accounts for 0.013 BTC ($46. 8) total
82MB of data taken December 2018. Each account record contains an email address, bcrypt-hashed password, location, and other profile details. This security breach has not been previously publicly disclosed. US-based DataCamp teaches people data science and programming. A spokesperson told us they are "looking into" the online sale.
"We take this matter seriously and want to further verify if this is indeed the case," said the biz's Lode Vanacken. "We will also investigate access and audit logs to see if we can trace back any potential unauthorised access. If indeed further investigation shows this data to be valid we will communicate with you and with the affected end-users."
Update: Vanacken has told us DataCamp is resetting users' passwords after confirming its data was stolen. "We have notified the users we believe were affected or potentially affected via email," he said.
"Out of an abundance of caution, we are logging out all DataCamp users who may have been affected, and, if they use a password as their authentication method, we are invalidating their passwords and prompting them to reset their passwords.
"We continue to monitor for suspicious activity and to make enhancements to our systems to detect and prevent unauthorized access to user information."
HauteLook 28 million accounts for 0.217 BTC ($780) total
1.5GB of data taken during 2018. Each account record contains an email address, bcrypt-hashed password, and name. This alleged security breach has not been previously publicly disclosed. HauteLook is an online store for fashion, accessories, and so on. A spokesperson for the Los Angeles-based biz did not respond to a request for comment.
ShareThis 41,028,098 accounts for 0.217 BTC ($780) total
2.7GB of data taken early July 2018. Each account record contains a name, username, email address, DES-hashed password, gender, date of birth, and other profile info. This alleged security breach has not been previously publicly disclosed. Palo Alto-based ShareThis makes a widget for sharing links to stuff with friends. A spokesperson did not respond to a request for comment.
Whitepages 17,775,679 accounts for 0.434 BTC ($1560) total
2.9GB of data taken 2016. Each account record contains an email address, SHA1- or bcrypt-hashed password, and first and last name. This alleged security breach has not been previously publicly disclosed. Whitepages is a Seattle-based online telephone and address directory. A spokesperson did not respond to a request for comment.
The seller told The Register they have as many as 20 databases to dump online, while keeping some others back for private use, and that they have swiped roughly a billion accounts from servers to date since they started hacking in 2012.
Their aim is to make "life easier" for hackers, by selling fellow miscreants usernames and password hashes to break into other accounts, as well as make some money on the side, and highlight to netizens that they need to take security seriously – such as using two-factor authentication to protect against password theft. The thief also wanted to settle a score with a co-conspirator, by selling a large amount of private data online.
The hacker previously kept stolen databases private, giving them only to those who would swear to keep the data secret.
"I don't think I am deeply evil," the miscreant told us. "I need the money. I need the leaks to be disclosed.
"Security is just an illusion. I started hacking a long time ago. I'm just a tool used by the system. We all know measures are taken to prevent cyber attacks, but with these upcoming dumps, I'll make hacking easier than ever." ®
Updates below
This article was revised at 0430 UTC on Tuesday, February 12 to include confirmation from 500px that it was hacked, as we reported.
Also on Tuesday, EyeEm informed its users it had been hacked. We understand similar disclosures are due to land this week from ShareThis and others.
On Wednesday, February 13, DataCamp informed us it is resetting its users' passwords after "some user data was exposed by a third party who gained criminal unauthorized access to one of our systems."
Also on Wednesday, CoffeeMeetsBagel told us it is alerting its users to its security breach, we added a statement from MyFitnessPal, and 8fit admitted to its customers that it was hacked.
On Thursday, February 14, Artsy emailed its users to confirm its internal data was stolen and put up for sale, as reported. "On February 11, 2019, we became aware that account information for some of our users was made available on the internet," the biz wrote. "We are still investigating the precise causes of the incident, and together with our engineering team, we are working with a leading cyber forensics firm to assist us."
Source: https://www.theregister.co.uk/2019/02/11/620_million_hacked_accounts_dark_web (https://www.theregister.co.uk/2019/02/11/620_million_hacked_accounts_dark_web)
-
Coffee Meets Bagel announces a data breach on Valentine’s Day
Makena Kelly | Feb 14, 2019
Happy Valentine’s Day! If you were trying to find the love of your life on Coffee Meets Bagel before May 2018, your personal data was possibly stolen. The company sent out an email to users today telling them that some of their personal information may have been breached.
In that email, Coffee Meets Bagel said that, on Monday, an unauthorized party gained access to user data. Luckily, the company said that the hackers didn’t make off with any sensitive information like credit card numbers or passwords.
Coffee Meets Bagel didn’t disclose the number of users who were affected by the breach, but it said that some users who were on the app before May 2018 had their names and email addresses leaked. The company said that the information that was stolen was part of a larger breach reported by The Register yesterday. Over 617 million account details in total from popular apps like Dubsmash, MyFitnessPal and Coffee Meets Bagel have been dumped on the dark web for less that $20,000 in bitcoin. The Register cites 6 million Coffee Meets Bagel account details have been breached.
“As a reminder, we never store any financial information or passwords,” the email read in bold.
“With online dating, people need to feel safe. If they don’t feel safe, they won’t share themselves authentically or make meaningful connections,” Coffee Meets Bagel said in a statement. “We take that responsibility seriously, so we informed our community as soon as possible—regardless of what calendar date it fell on—about what happened and what we are doing about it.
In the email to users, the Coffee Meets Bagel said that it has engaged with forensic security experts who are reviewing its systems to help find out exactly how the breach occurred.
“As always, we recommend you take extra caution against any unsolicited communications that ask you for your personal data or refer you to a web page asking for personal data,” the email says. “We also recommend avoiding clicking on links or downloading attachments from suspicious emails.”
Earlier this week, TechCrunch reported that a number of OkCupid accounts had been hacked, and when some users of the app tried to log in, they saw that their passwords were changed and they were locked out. OkCupid has denied that there has been a security breach.
After a year of data breaches from companies like Facebook and Google, it only makes sense that even our most boring and benign dating data would become the subject of rogue hackers online. Credit card information is one thing, but imagine trying to get into user messages. You would just find one person saying “Hey,” and no one ever responding. Forever.
Updated 2/14/18 12:25 p.m. ET: Updated to include a statement from Coffee Meets Bagel.
Source: https://www.theverge.com/2019/2/14/18224702/coffee-meets-bagel-data-breach-valentines-day (https://www.theverge.com/2019/2/14/18224702/coffee-meets-bagel-data-breach-valentines-day)
Singaporeans hit by dating app leak, data of 6 million users for sale on dark web
They are among six million stolen accounts of US-based Coffee Meets Bagel that were put on sale on the dark web
David Sun | Feb 15, 2019
Millions of people looking for love received a rude Valentine's Day gift yesterday in the form of an e-mail from Coffee Meets Bagel (CMB).
The users of the popular dating platform were informed that their account data may have been stolen by an "unauthorised party".
The data, which includes names and e-mail addresses of more than six million CMB users, has been put on sale on the dark web for 0.13 Bitcoin, or about $600.
CMB, a mobile dating app company based in San Francisco in the US state of California, was launched in April 2012.
It is popular in Singapore, with CMB previously claiming it had made 1.6 million matches, with 28 million messages sent by users here in 2017.
Users are matched based on their interests and can contact each other only on the app after "liking" each other's profiles.
Source: https://www.tnp.sg/news/singapore/dating-app-hacked-data-6-million-users-sale-dark-web
-
Plastic surgeon suspended 3 months for illegally using SGH’s computer system to sort out personal affairs
By Louisa Tang | 06 March, 2019
Dr Leo Kah Woon used a software to spy on his wife’s emails and instant messages. He also tapped a government hospital’s computer system to try and reach her alleged lover’s spouse.
SINGAPORE — Suspecting his wife of having an affair, a plastic surgeon accessed the computer system of the Singapore General Hospital (SGH) to get contact details of the wife of her alleged lover, in the hope of saving his own marriage.
Dr Leo Kah Woon also installed a keylogging software on the laptop he shared with his wife to spy on her personal communications. He later used the information he got in their divorce proceedings.
For his actions, a disciplinary tribunal of the Singapore Medical Council (SMC) suspended him from practising for three months from Dec 18 last year.
In its grounds of decision published on Tuesday (March 5), the tribunal noted that a suspension "would well deter like-minded medical and other professionals who have access to large databases of personal information from abusing the privilege”.
In particular, last year’s SingHealth data leak served as a “timely reminder” for everyone to treat cyber security with “the utmost seriousness”, the tribunal added.
Dr Leo, who has since divorced his wife, now practises at his own clinic at Mount Elizabeth Medical Centre. He was employed at SGH when he committed the offences.
In 2017, he was fined S$13,000 in the court for his actions. The SMC then began disciplinary proceedings against him, as his offences implied a character defect making him unfit for the medical profession.
THE SPYING BEGAN
Dr Leo and his wife tied the knot in 2005. However, sometime in 2011, he started suspecting that she was cheating on him.
Her alleged lover was identified in SMC’s grounds of decision merely as Mr C.
Around September 2012, he installed a keylogging software in the MacBook Pro laptop he shared with his wife. The software captured her keystrokes and took periodic screenshots when she used the computer, which were sent to his email account.
This meant that he could gather information about emails and instant messages that she sent.
The spying continued when she left their home to live with her parents and took the laptop with her.
The tribunal noted that in October 2012, she began “very acrimonious” divorce proceedings against Dr Leo after he asked her to leave their home. The pair, who have two children, finalised their divorce in May 2015.
During their divorce proceedings in the Family Justice Courts, Dr Leo used the information he gathered to explain his concerns about issues relating to the custody, care and control of their children.
He also wanted to find out all he could about Mr C’s wife at the time, identified as Ms A, and reach out to her. Dr Leo hoped that Ms A would be able to convince her husband to leave his family alone.
On Nov 7, 2012, when Dr Leo could not find any reliable public information to contact Ms A, he used a computer at SGH to search for her contact details in the hospital computer system. He then gave the details to his sister and told her to call Ms A.
Ms A came to know of her husband’s infidelity from that call.
Mr C then filed a complaint with the SMC against Dr Leo and the police were called in to investigate when the illegally obtained emails and messages were used in the divorce proceedings.
Dr Leo’s wife was fined S$3,500 by the courts, for abetting a private investigator to unlawfully access his Asus laptop on Dec 18, 2012. She had seen documents related to the divorce proceedings on it and wanted to make copies of them.
A LACK OF INTEGRITY
The SMC sought a suspension of at least six to eight months for Dr Leo, while his lawyers asked for a S$10,000 fine.
While the SMC argued that Dr Leo had displayed dishonesty, which could see him being struck off the registry of medical practitioners, the disciplinary tribunal concluded that there was no clear evidence of that in his conduct.
Instead, it said that he clearly displayed a lack of integrity “to a somewhat appalling extent”.
Dr Leo had hired a private investigator to surveil his wife, including installing the keylogging software on the laptop to gather evidence against her in the event of divorce proceedings. To use this evidence “brings (his) integrity to the lowest of levels”, the tribunal added.
As members of the public expect doctors to keep medical records confidential, a fine would not be enough to correct his breach of trust, it said.
“A suspension would also convey to the public that the disciplinary tribunal does not condone such behaviour and acts, even if they are related to matters in the private family domain. It will convey the message clearly that doctors are expected to conduct themselves with integrity and ethically both in their professional and private lives,” the tribunal added.
Dr Leo was also censured, as well as ordered to give a written undertaking to the SMC not to engage in similar conduct and to pay the costs of the disciplinary proceedings.
Source: https://www.todayonline.com/singapore/plastic-surgeon-suspended-3-months-illegally-using-sghs-computer-system-sort-out-personal
-
S$50,000 fine for psychiatrist who failed to protect patient’s confidential info
By Neo Chai Chin | 06 March, 2019
NUH psychiatrist Soo Shuenn Chiang did not verify the identity of a caller who claimed to be a patient’s husband.
SINGAPORE — A psychiatrist from the National University Hospital (NUH) has been fined S$50,000 for failing to verify a caller’s identity before writing a memo to refer a patient to the Institute of Mental Health.
The caller turned out to be the patient’s brother and not her husband as he had claimed.
And although the memo was addressed to ambulance personnel or the police officer-in-charge, it was handed to the brother, who used it to support his application for a personal protection order against the patient.
The personal protection order was granted by the Family Court.
A three-member disciplinary tribunal found Dr Soo Shuenn Chiang guilty of failing to maintain patient confidentiality.
The tribunal — chaired by cardiothoracic surgeon Joseph Sheares — had wanted to impose the maximum fine of S$100,000, but reduced it by half after considering mitigating factors.
In the grounds of decision released on Tuesday (March 5), the tribunal said that a breach of patient confidentiality is a serious and important matter.
This case justifies a deterrent sentence “so as to create public awareness, more particularly among potential offenders, that punishment will be certain and unrelenting for this type of breaches and offenders”, it said.
The patient's name was not disclosed in the grounds of decision to protect her identity.
FACTS OF THE CASE
On Jan 19, 2015, the patient was admitted to NUH for an overdose of a pain relief drug.
She was reviewed by Dr Soo for adjustment disorder with depressed mood and alcohol misuse. She was noted to have a risk of self-harm as she had a history of depression.
The woman was discharged the next day.
Two months later, Dr Soo received a phone call from the woman’s brother. Dr Soo did not check the caller’s identity by asking for his name, identity card number or contact number, and comparing these against NUH’s records.
The memo he wrote contained her confidential medical information, and he instructed his clinic staff member to pass it to the caller, believing he was the patient’s husband.
While Dr Soo’s response to the phone call was appropriate in trying to rapidly get help for the patient, he failed to take proper care to ensure the memo did not fall into the wrong hands.
Dr Soo’s lawyers said that it was an “honest oversight” during the course of seeing 17 patients that day.
The psychiatrist accepted that he had caused potential harm to the patient.
The tribunal agreed that the lapse occurred on a hectic day, but said that the preventive actions he should have taken by verifying the caller’s identity were simple and “not onerous”.
“We could only conclude that the failure of Dr Soo to take such steps reflected both a lack of concern for or appreciation of the required standards and an indifference to the patient’s medical confidentiality,” the tribunal said.
But it agreed that Dr Soo’s misconduct was not as egregious as a previous case, in which a doctor — who was with the KK Women's and Children's Hospital — was fined S$10,000 in 2011 for accessing the electronic medical records of two patients not under his care, but who were his ex-girlfriends.
At the time, S$10,000 was the maximum fine.
Source: https://www.todayonline.com/singapore/s50000-fine-psychiatrist-who-failed-protect-patients-confidential-info
-
[PART 1] Personal data of over 800,000 blood donors put online by vendor: HSA
Staff Writer, Singapore | 15 March 2019
The private information of more than 800,000 blood donors in Singapore was put online without authorisation by a Health Sciences Authority (HSA) vendor.
The database contained information such as name, NRIC, gender, blood type and dates of blood donations and did not contain other sensitive, medical or contact information, the HSA said in a statement on Friday (15 March).
The authority said preliminary findings show that a cyber security expert discovered the vulnerability and alerted the Personal Data Protection Commission on Wednesday.
HSA then contacted the vendor, Secur Solutions Group (SSG), to disable access to the database, and made a police report.
It noted that the cybersecurity expert had told the HSA that he does not intend to disclose the data that he had accessed, and is working with the agency to delete the information.
Preliminary findings by HSA’s review of the database show that no unauthorised person other than the cybersecurity expert had accessed the database.
HSA had provided the blood donors’ data to SSG for updating and testing purposes. The vendor placed the data on a server that was accessible via the Internet on 4 January without putting adequate safeguards to prevent unauthorised access.
SSG did so without the HSA’s knowledge and approval, and that the action was against the vendor’s contractual obligations, the HSA said.
The leak comes less than two months after the Ministry of Health (MOH) announced the online leak of confidential data belonging to 14,200 HIV-positive individuals and 2,400 others who were identified through contact tracing.
American citizen Mikhy K Farrera Brochez, 34, was fingered as the culprit behind the leak.
In July last year, the MOH announced that health records of 1.5 million Singaporeans, including Prime Minister Lee Hsien Loong, were stolen in a suspected state-sponsored attack information, the country’s biggest ever data breach.
Source: https://sg.news.yahoo.com/personal-data-800000-blood-donors-put-online-vendor-hsa-131843665.html (https://sg.news.yahoo.com/personal-data-800000-blood-donors-put-online-vendor-hsa-131843665.htmlReference)
Reference (Error as at 16 March 2019, 10pm): https://www.secursolutionsgroup.com (https://www.secursolutionsgroup.com)
Improper Handling of Personal Information of Blood Donors
15 MARCH 2019
The Health Sciences Authority (HSA) was alerted on 13 March 2019 that one of its vendor’s servers contained a HSA database that was not adequately safeguarded against access over the internet. The vendor is Secur Solutions Group Pte Ltd (SSG). SSG provides services to HSA and was working on a database containing registration-related information of 808,201 blood donors: Name, NRIC, gender, number of blood donations, dates of the last three blood donations, and in some cases, blood type, height and weight. The database contained no other sensitive, medical or contact information.
2. A cybersecurity expert had discovered this vulnerability and alerted the Personal Data Protection Commission. HSA immediately worked with SSG to disable access to the database. We have also made a Police report. The expert has confirmed to HSA that he does not intend to disclose the contents of the database. HSA is in contact with the expert on deleting the information.
3. Investigations are ongoing. Preliminary findings from HSA's review of the database logs show that other than the cybersecurity expert who raised the alert, no other unauthorised person had accessed the database.
4. HSA had provided the data to SSG for updating and testing. SSG placed the information in an internet-facing server on 4 Jan 2019 and failed to institute adequate safeguards to prevent unauthorised access. It had done so without HSA’s knowledge and approval, and against its contractual obligations with HSA.
5. Chief Executive Officer of HSA, Dr Mimi Choong, said: “We sincerely apologise to our blood donors for this lapse by our vendor. We would like to assure donors that HSA's centralised blood bank system is not affected. HSA will also step up checks and monitoring of our vendors to ensure the safe and proper use of blood donor information.”
6. More details can be found at this link on HSA’s website https://www.hsa.gov.sg/content/hsa/en/News_Events/HSA_Updates/2019/letter-to-blood-donor.html (https://www.hsa.gov.sg/content/hsa/en/News_Events/HSA_Updates/2019/letter-to-blood-donor.html). Donors can also contact HSA at the following hotline number 62200183.
HEALTH SCIENCES AUTHORITY
SINGAPORE
Source: https://www.hsa.gov.sg/content/hsa/en/News_Events/Press_Releases/2019/cybersecurityincident.html (https://www.hsa.gov.sg/content/hsa/en/News_Events/Press_Releases/2019/cybersecurityincident.html)
[PART 2] 800,000 blood donors' personal data accessed illegally and possibly stolen; police investigating
30 March 2019 | Timothy Goh
SINGAPORE - The personal information of more than 800,000 blood donors which was put online improperly for over two months was accessed illegally and possibly stolen, a Health Sciences Authority (HSA) vendor responsible for the mistake said on Saturday (March 30).
It was initially thought that only a foreign cyber-security expert, who spotted the vulnerability in the server that stored the data, had accessed it.
However on Saturday, Secur Solutions Group (SSG), an independent vendor of HSA, said its server was also accessed suspiciously from several other IP addresses between October and March this year. It did not say whether these addresses were local or foreign.
A database containing the personal information of blood donors was uploaded to this server around October last year.
This information included the names, NRIC numbers, gender and number of donations of people who have donated or registered to donate blood in Singapore since 1986.
In some cases, donors' blood type, height, weight and the dates of their last three donations were also included.
On March 13, HSA told SSG that a US cyber-security expert had found that the registration-related information of donors could be accessed because of a vulnerability in the server used by SSG.
The server was immediately cut off from the Internet and secured, said SSG.
The vendor engaged external cyber-security professionals, KPMG in Singapore, to undertake forensic analysis. It also initiated a thorough review of its IT systems.
Preliminary examination had found that the unauthorised access was made by only the US cyber-security expert, who said he did not intend to disclose the database and was working with the authority to delete the information.
But subsequent forensic analysis revealed that the server was also accessed suspiciously from several other IP addresses between Oct 22, 2018, and March 13 this year.
SSG said in its statement: "Based on this new information, SSG cannot exclude the possibility that registration-related information of donors on the server was exfiltrated."
The vendor added that the database contains no other sensitive, medical or contact information.
SSG said that there had also been attacks on the same server in 2017. However, these were unrelated to the current incident, and there was no evidence to suggest that any HSA data was compromised.
It is continuing its investigations into the matter, and is cooperating fully with the police and HSA.
It also apologised to all the affected blood donors.
In a statement, HSA said that it was aware of the situation, and added that it takes a serious view of the matter, which the police are investigating.
The agency said that SSG is in breach of its contractual obligations and it will decide on what steps it should take regarding SSG once investigations are concluded.
HSA added that its centralised blood bank system, which is not connected to the SSG server, remains secure.
Public servant Ryan See, 25, who donates blood regularly, said: "I'm not really too concerned about my details getting leaked, but I have been getting quite a few random SMSes asking if I'd like to gamble online. I'm not sure if they're related."
Another regular donor, 19-year-old student Megan Koh, said: "I think it’s worrying that these sort of data leaks keep happening, especially since we’re increasingly reliant on technology these days and all our data is online."
This is the third IT incident to strike the healthcare sector in recent months.
In January, the Ministry of Health (MOH) revealed that the confidential information of 14,200 HIV-positive individuals had been leaked online by Mikhy Farrera-Brochez, an American who had been living in Singapore.
And in February, MOH said that a computer error had resulted in 7,700 people receiving inaccurate healthcare subsidies when they applied for or renewed their Community Health Assist Scheme cards in September and October last year.
Mr Aloysius Cheang, Asia-Pacific executive vice-president of the Centre for Strategic Cyberspace + Security Science, a London-based think-tank, agreed that the frequency of the recent data leaks was indeed worrying.
"This is not the first time, it's the third time. And when there's a third time, there's bound to be a fourth, a fifth, and so on," he said.
He added that there is a need for Singapore to send a strong signal that its sovereign control over its digital assets has not been compromised, especially since the nation prides itself on being a safe and secure place to do business.
"You have to show people you can protect these things. If you can't even protect your own citizens' data, how can you be trusted to protect that of companies like Google, Amazon, and private banks?"
Dr Ngair Teow-Hin, chief executive officer of data security company SecureAge Technology, said that there is nothing blood donors who may have had their information accessed can do.
"You can't change your NRIC number or date of birth, that's the unfortunate reality of the situation," he said.
He noted that some of the information that was stored in the server, such as the NRIC number and date of birth of donors, is sometimes used by services such as banks and telephone companies to verify one's identity.
Such information could be sold on the Dark Web, or used to impersonate donors.
Both experts said there was a need for harsher penalties to ensure such a mistake does not occur again.
"It's not so much an IT security issue as it is an organisational failure," said Mr Cheang.
Source: https://www.straitstimes.com/singapore/health/800000-blood-donors-personal-data-accessed-illegally-and-possibly-stolen-police
-
China data breaches: 33-mil unprotected job applicant profiles leaked
Amid a series of recent cybersecurity attacks in China, President Xi Jinping has initiated some IT safeguards as the country’s top agenda.
Maynard | March 17, 2019
Cybercrimes remain a global threat. Even a superpower like China has not been spared. Increasingly, cybercriminals in China are attacking industrial facilities.
Huge databases containing the personal details of 33 million candidates of online recruitment sites such as 51Job, lagou, and Zhilian have been laid bare.
These personal details include users’ addresses, mobile numbers, and statuses. Based on resource site Bleeping Computer, other details such as educational, work and salary history were part of the leaked info.
The unencrypted database was found by Sanyam Jain, a security researcher and member of GDI Foundation. The database owner was not identified.
According to Mr Jain, a third-party collected the profiles from these job sites and used them in a few ways. When he reported what he discovered to CNCERT, a Chinese cyber emergency response team, the database was secured.
Amid a series of recent cybersecurity attacks in China, President Xi Jinping has initiated some IT safeguards as the country’s top agenda.
The plan aims to curtail possible areas of entry for hackers and foreign intelligence services as well as strengthen China’s local cyber industry.
Such a corrective measure comes on the heels of last June’s reported data leak that led to 1.9 million 51Job.com user accounts and a resulting case against 51Job.com by Pomerantz LLP, a US law company that focuses on class action lawsuits.
The 2018 data breach did not provide details on where the stolen data was sourced. The absence of these details did not help repair public confidence which further eroded after claims that this breach was related to another massive data breach in 2015 when Chinese IT company NetEase email service was hacked into.
Serious cyber attacks have also been in the minds of Singaporeans, up to 1.5mil of whom had their personal details hacked into during the past few years as well as the first quarter of 2019.
To protect the government’s security systems, the city-state’s Cybr Security Agency sought assistance from local and overseas “white hat” or ethical hackers to eliminate vulnerabilities of five government online agencies.
Source: http://theindependent.sg/china-data-breaches-33-mil-unprotected-job-applicant-profiles-leaked/
-
Stringent LTA Installation Guidelines for Inward-Facing In-Vehicle Recording Devices to Safeguard Commuters’ Personal Data
News Releases |22 May 2018
1 The Land Transport Authority (LTA) has published a set of installation guidelines for inward-facing in-vehicle recording devices (IVRDs) in public service vehicles (PSVs) such as taxis, private hire cars (PHCs) and buses[1] (https://www.lta.gov.sg/apps/news/page.aspx?c=2&id=926783be-b319-46d7-b61c-96b5f163313a&fbclid=IwAR0j9vTtrxBrDj-7mTTwo1uU_pubFGXt5S2pUjkZUtfRHVaW0m9Ow5zUa4Q#_ftn1).The guidelines will come into effect on 22 June 2018.
2 LTA’s guidelines complement the Personal Data Protection Commission’s (PDPC) Advisory Guidelines on in-vehicle recordings[2] (https://www.lta.gov.sg/apps/news/page.aspx?c=2&id=926783be-b319-46d7-b61c-96b5f163313a&fbclid=IwAR0j9vTtrxBrDj-7mTTwo1uU_pubFGXt5S2pUjkZUtfRHVaW0m9Ow5zUa4Q#_ftn2), which clarify the obligations under the Personal Data Protection Act that operators and drivers of transport services for hire must comply with when they use inward-facing IVRDs to capture individuals’ personal data. Together, these guidelines serve to protect commuter safety and their personal data, and prevent unauthorised access to the footage recorded by inward-facing IVRDs.
Key guidelines for installation of inward-facing IVRDs
3 PSV owners must obtain LTA’s approval to install inward-facing IVRDs. Approved installations can only be carried out at LTA-authorised installation centres[3] (https://www.lta.gov.sg/apps/news/page.aspx?c=2&id=926783be-b319-46d7-b61c-96b5f163313a&fbclid=IwAR0j9vTtrxBrDj-7mTTwo1uU_pubFGXt5S2pUjkZUtfRHVaW0m9Ow5zUa4Q#_ftn3). This is to ensure that the inward-facing IVRDs are installed according to the manufacturer’s requirements and LTA’s requirements, and to prevent the inward-facing IVRDs from being tampered with. Some key requirements that the LTA-authorised installation centres have to adhere to include:
a. IVRDs must be secured in such a manner that prevents any unauthorised access to and downloading of the stored data (e.g. locking the memory card slot, blocking the micro USB port).
b. IVRDs must be installed in a fixed position and cannot be rotated in order to prevent the capture of compromising visual records of commuters.
c. IVRDs must not have any audio recording function so that the passengers’ conversations are not recorded
d. All footage created by the IVRD must clearly indicate a date and time stamp, as well as the PSV’s licence plate number to facilitate investigations in the event of misuse of the footage.
Please refer to the Annex (https://www.lta.gov.sg/data/apps/news/press/2018/20180522_IVRDInstallationGuidelines_Final.pdf) for the full list of requirements.
4 PSV owners that have installed inward-facing IVRDs at LTA-authorised installation centres will be required to affix a notice notifying passengers of the inward-facing IVRD in the PSV. In addition, booking service operators must inform commuters if a PSV installed with an inward-facing IVRD is being dispatched to them. PSV owners will also be required to carry out periodic checks to ensure that the inward-facing IVRDs have not been tampered with, and must report any indication of tampering or non-compliance with LTA’s guidelines to LTA immediately.
Restrictions on access to footage
5 Drivers who wish to use LTA approved installed inward-facing IVRDs must obtain the written permission of the Registrar. Drivers will be subjected to further stringent guidelines on the use of installed IVRDs.
6 There will be restricted access to the footage recorded by inward-facing IVRDs. Government agencies and LTA-authorised data controllers[4] (https://www.lta.gov.sg/apps/news/page.aspx?c=2&id=926783be-b319-46d7-b61c-96b5f163313a&fbclid=IwAR0j9vTtrxBrDj-7mTTwo1uU_pubFGXt5S2pUjkZUtfRHVaW0m9Ow5zUa4Q#_ftn4) will be allowed to access the footage to support investigations and enforcement efforts e.g. cases of fare evasion by commuters, or alleged offences by the driver. The data controllers will be required to follow stringent guidelines including requirements such as putting in place proper safeguards on the storage and access to the footage and ensuring that only authorised personnel have access to the footage.
7 Interested parties may approach LTA to apply to be an authorised installation centre, or independent data controller, or both.
Penalties
8 Under the Road Traffic Act, LTA will impose the following penalties to persons found liable for offences relating to the unauthorised installation of inward-facing IVRDs and the unauthorised access of visual records:-
a. A fine up to $1,000, or imprisonment for a term not exceeding 3 months or both upon conviction. In the case of a second or subsequent offence, a fine up to $2,000, or imprisonment for a term not exceeding 6 months or both upon conviction.
b. For taxi and PHC drivers – 21 demerit points, which may lead to the revocation of the driver’s vocational licence under the Chauffeured Private Hire Car and Taxi Driver’s Vocational Licence Demerit Points System.
c. For drivers of private hire buses, excursion buses and school buses – LTA may revoke their vocational licences.
[1] (https://www.lta.gov.sg/apps/news/page.aspx?c=2&id=926783be-b319-46d7-b61c-96b5f163313a&fbclid=IwAR0j9vTtrxBrDj-7mTTwo1uU_pubFGXt5S2pUjkZUtfRHVaW0m9Ow5zUa4Q#_ftnref1) The guidelines do not apply to omnibuses that are licensed to operate regular route services (e.g. SBST and SMRT buses) and private buses (e.g. company buses used to ferry its own employees). [2] (https://www.lta.gov.sg/apps/news/page.aspx?c=2&id=926783be-b319-46d7-b61c-96b5f163313a&fbclid=IwAR0j9vTtrxBrDj-7mTTwo1uU_pubFGXt5S2pUjkZUtfRHVaW0m9Ow5zUa4Q#_ftnref2) The Personal Data Protection Commission’s (PDPC) Advisory Guidelines on In-Vehicle Recordings by Transport Services for Hire, are available at www.pdpc.gov.sg/Legislation-and-Guidelines/Guidelines (http://www.pdpc.gov.sg/Legislation-and-Guidelines/Guidelines).
[3] (https://www.lta.gov.sg/apps/news/page.aspx?c=2&id=926783be-b319-46d7-b61c-96b5f163313a&fbclid=IwAR0j9vTtrxBrDj-7mTTwo1uU_pubFGXt5S2pUjkZUtfRHVaW0m9Ow5zUa4Q#_ftnref3) These could include for example, taxi companies or LTA-authorised inspection centres.
[4] (https://www.lta.gov.sg/apps/news/page.aspx?c=2&id=926783be-b319-46d7-b61c-96b5f163313a&fbclid=IwAR0j9vTtrxBrDj-7mTTwo1uU_pubFGXt5S2pUjkZUtfRHVaW0m9Ow5zUa4Q#_ftnref4) This could include for example, taxi companies.
Source: https://www.lta.gov.sg/apps/news/page.aspx?c=2&id=926783be-b319-46d7-b61c-96b5f163313a&fbclid=IwAR0j9vTtrxBrDj-7mTTwo1uU_pubFGXt5S2pUjkZUtfRHVaW0m9Ow5zUa4Q (https://www.lta.gov.sg/apps/news/page.aspx?c=2&id=926783be-b319-46d7-b61c-96b5f163313a&fbclid=IwAR0j9vTtrxBrDj-7mTTwo1uU_pubFGXt5S2pUjkZUtfRHVaW0m9Ow5zUa4Q)
Annex (cache (http://tralvex.com/download/forum/20180522_IVRDInstallationGuidelines_Final.pdf)): https://www.lta.gov.sg/data/apps/news/press/2018/20180522_IVRDInstallationGuidelines_Final.pdf (https://www.lta.gov.sg/data/apps/news/press/2018/20180522_IVRDInstallationGuidelines_Final.pdf)
-
Andy Hui cheating scandal: Macau issues privacy warning to cabbies
Danny Mok and Emily Tsang | 18 April 2019
Macau has warned taxi and hire car drivers not to illegally install recording equipment inside their vehicles, after a video of Hong Kong superstar Sammi Cheng Sau-man’s husband cheating on her was made public.
The leaked footage showed singer Andy Hui Chi-on kissing and cuddling TVB actress Jacqueline Wong in the back of a car, in a 16-minute video that quickly went viral.
The casino hub’s data protection watchdog issued the warning on Wednesday in response to “a matter that took place in a neighbouring district in which a video recording was made inside a taxi carriage, which has attracted media and public attention”.
Under the new law, the Office for Personal Data Protection said only video and audio devices installed by Macau’s Transport Bureau were legal. Offenders could face prosecution, resulting in heavy fines or imprisonment, it said.
In Hong Kong, the video has reopened the debate surrounding privacy concerns between lawmakers and the taxi industry, and many have urged the government to tighten regulations on the use of digital cameras. Although, it is not known whether the couple were in a taxi, hire car, or private vehicle when the video was taken.
A tearful Hui apologised at a press conference on Tuesday night, which hundreds of thousands of people watched online, while Wong issued a statement on her social media page on Wednesday admitting she was wrong and was ashamed of her actions.
“Sorry, I am wrong. I have done something very wrong, unforgivable, and I feel very ashamed about it,” the 30-year-old wrote.
“I would not dare to ask for everyone’s forgiveness. So, I just beg everyone to give all those involved some room. I seriously repent on my wrongdoings, and will accept any consequences or punishment.”
Wong’s boss at TVB, Virginia Lok, said the company felt the emotional actress needed to take some time off.
Actor Kenneth Ma Kwok-ming, who Wong has been dating for two years, has carried on working on a local drama series throughout the scandal, and asked the public to give the couple some room.
“She is still young and there are a lot of paths ahead of her, I wish everyone can give her some room,” Ma said. “Since Andy Hui has spoken, I would not say anything more. I feel no one else is qualified to have a say about this except his wife [Sammi Cheng].”
The Transport Department, while addressing public concern cameras in hire cars and taxis, said it was drafting guidelines on the matter, and these are expected to be completed this year.
But, lawmaker Michael Tien Puk-sun called the leaking of the video shocking, and said it showed the need for legislation, rather than guidelines that could be followed on a voluntary basis.
“If a guideline does not say when and who could use the camera data, there is no reason to make it,” Tien said.
In a non-binding motion passed by the Legislative Council last year, Tien sought to make the installation of on-board cameras on taxis compulsory, and under which the data could be used by law enforcement agencies investigating disputes between drivers and passengers.
The motion also wanted a restriction that meant the camera could only be pointed at the driver, and for cars to carry notices telling passengers there were recording devices installed.
Chan Man-keung, chairman of the Association of Taxi Industry Development, which has been promoting the compulsory installation of on-board cameras since 2016, said the guidelines would be better than nothing, but also agreed legislation was the best solution.
Taxi drivers have been reluctant to install CCTV in their cars after Hong Kong’s privacy commissioner expressed concerns. Photo: Felix Wong© Felix Wong Taxi drivers have been reluctant to install CCTV in their cars after Hong Kong’s privacy commissioner expressed concerns. Photo: Felix Wong
He added that the devices and the footage would serve to protect both drivers and passengers should disputes arise.
But Dr Hung Wing-Tat, a member of the Committee on Taxi Service Quality, said cabbies were not keen to install the devices after the privacy commissioner voiced concerns over the scheme.
While Craig Choy Ki, a lawyer and convenor of the Progressive Lawyers Group, believed if passengers could be identified in any footage, what was captured would be defined as personal data under existing privacy laws.
Source: https://www.msn.com/en-sg/news/world/andy-hui-cheating-scandal-macau-issues-privacy-warning-to-cabbies/ar-BBW374w?li=BBr8Cnr&ocid=wispr
-
Social worker agrees three-year caution after data protection breach
Alex Turner | April 11, 2019
A social worker has agreed to a three-year caution after being found to have forwarded multiple confidential documents to a personal email account.
The practitioner’s misconduct was only discovered after she had completed an agency stint with a council, which accessed her staff email account to retrieve material relating to work left incomplete.
The local authority found the social worker had forwarded more than 20 documents, including care plans, assessments and court statements, mostly unredacted to her Yahoo account during late 2017.
It referred the case to the Health and Care Professions Council (HCPC), which agreed a caution order by consent at a tribunal hearing in late March, after the social worker admitted the allegation in full. The social worker was not practising at the time of the hearing but hoped to return to social work, the tribunal noted.
No sanction for social worker who referred self to HCPC after confidentiality breach blamed on IT failings
Caution for social worker who breached confidentiality during ‘difficult personal circumstances’
Social worker sanctioned for ‘clearly inappropriate’ sharing of sensitive data
Data breaches by social workers have been something of a regulatory grey area in recent times. A social worker escaped sanction in 2016 after self-referring to the HCPC and arguing he had forwarded emails to a personal account due to a “highly pressurised” work environment and disruption caused by a change in IT system.
Remedial training
In the wake of her being referred to the HCPC, the social worker in the recent case prepared a reflective statement acknowledging her misconduct. She also issued a written apology and completed remedial data protection training.
The social worker confirmed via her legal representative that she was prepared to admit that her fitness to practise had been impaired by her behaviour.
“The panel accepts that by her statement and by agreeing to the draft consent order, the registrant has shown both reflection and insight,” the tribunal said.
“She has further recognised the serious nature of the allegation made against her,” it added. “She has acknowledged the potential ramifications that her actions could have had on service users and the further impact that this conduct could have on the reputation of and public confidence in social workers.”
The data breach was an isolated incident in which no service users had been harmed and the risk of any similar future incident was low, the tribunal concluded in agreeing the sanction.
It added that even had a contested hearing taken place, it was unlikely that a stiffer punishment would have been imposed.
Source: https://www.communitycare.co.uk/2019/04/11/social-worker-agrees-three-year-caution-data-protection-breach
-
Personal info of 4,200-odd individuals compromised after Singapore Red Cross website breach
Staff Writer, Singapore | 16 May 2019
SINGAPORE — Details of more than 4,200 individuals who registered their interest in making blood donations on the Singapore Red Cross (SRC) website were accessed without authorisation on 8 May, the SRC said in a media statement on Thursday (16 May).
SRC said that the compromised information of the 4,297 affected individuals includes their names, contact numbers, emails, declared blood types, preferred appointment dates/times and preferred locations for blood donation.
“No other information was affected. SRC’s other databases have not been compromised. The Health Sciences Authority’s (HSA) systems are similarly unaffected by this incident,” the statement said.
Upon being alerted to the unauthorised access by its web developer, the SRC reported this incident to the police, as well as the Personal Data Protection Commission and HSA. Police investigations are ongoing.
Preliminary findings showed that a weak administrator password could have left the website vulnerable to a breach. As a precaution, the SRC has disconnected the website from internet access, and replaced it with a temporary webpage with links to relevant websites.
The SRC said it has engaged external consultants to conduct forensic investigations to determine the exact factors that led to the incident. It will then take the necessary actions to strength its IT security measures upon receiving the consultants’ findings and recommendations.
SRC secretary general Benjamin William said in the statement, “Our immediate priority is to ensure affected individuals and partners are notified... We apologise to the users of our website whose information may have been affected by this incident.”
Source: https://sg.news.yahoo.com/unauthorised-access-on-singapore-red-cross-website-info-of-4200-odd-individuals-compromised-082033726.html
-
PDPC investigating security vulnerability on Chan Brothers website
24 May, 2019
SINGAPORE — The Personal Data Protection Commission (PDPC) said Friday (May 24) it is investigating a security lapse on Chan Brothers Travel's website which left some personal data of its customers vulnerable to potential exposure.
The vulnerability was discovered by Mr Andrew Goh, who works in the financial technology industry. He told CNA on Thursday that because of a security flaw, he was able to see the booking records and enquiries made by some customers on the Chan Brothers Travel Club webpage
The co-founder of local fintech start-up Factors Platform said he stumbled on the security flaw while doing some research work trying to “scrape” user reviews to predict sales and bookings, and their possible effects on share prices. In doing so, he realised the webpage was “not properly configured” and the permission access was not set correctly.
The customer information which was accessible also included email addresses, phone numbers and NRIC numbers. CNA was also able to view such data when it repeated the techniques used by Mr Goh.
After he discovered the vulnerability, Mr Goh reported it to Chan Brothers.
In response to CNA's queries, Chan Brothers' head of marketing communications Jane Chang said the company had taken action as soon as it became aware of the vulnerability.
"We immediately took action to address the matter including containing the extent of vulnerabilities, assessing the extent of impact and reporting the incident to PDPC. Some of the measures undertaken require continual monitoring, review and action as it involves information that has been publicly cached," she said.
She added that the site has been shut down.
"We are reviewing protection and prevention measures and putting in place operational and policy-related measures, including tightening IT-related security measures and implementing more system monitoring controls," she said, adding that the company deeply regrets that this occurred and takes full responsibility.
"We would like to assure our customers that no sensitive booking and financial information was revealed. That said, we recognise that no personal data should be exposed at all, in any manner and that it is our responsibility and priority to protect our customers’ personal data, said Ms Chang.
Chan Brothers is working with its vendor Aodigy Asia Pacific to investigate the incident. CNA
Source: https://www.todayonline.com/singapore/pdpc-investigating-security-vulnerability-chan-brothers-website
-
Ex-presidential hopeful Tan Kin Lian exposed his own data and refuses to blame himself after getting harassed
Ilyas Sholihyn | May 28, 2019
Believing that the dangers of getting one’s personal information leaked are non-existent, Tan Kin Lian sought out to prove it.
“I find that the paranoia about the privacy of NRIC (National Registration Identity Card) and contact details to be overblown,” he wrote on Facebook yesterday, expressing how he doesn’t see any troubling issue with data leaks.
The former presidential candidate laid bare all his confidential details on Facebook: his NRIC number; email address; mobile number, and date of birth. This made a lot of his detractors chuckle at what was widely regarded as a bad move.
On top of that, he dared anyone to hack into his SingPass account — his personal centralised account used to access various important government e-services. Truly, Tan refused to believe that anyone could do anything criminal with his personal data.
Cut to nearly seven hours later, and Tan learned why he shouldn’t have done so. He was locked out of his own SingPass account because someone entered (probably intentionally) the wrong password way too many times.
Even if he does eventually regain control of his account by changing his password, the cat’s out of the bag — some troll could always disrupt his access again by making repeated failed attempts to log in using his NRIC number.
Though the 71-year-old had no one else to blame but himself, Tan asserted that it was “stupid” to have a maximum of six failed log-in attempts.
“I do not see how they can make SingPass secure by locking out people unnecessarily,” he wrote, totally oblivious to the fact that he brought it on himself.
In the end, Tan had no choice but to change his SingPass login ID to something else other than his NRIC number. He wrung his hands over having to change his log-in details, again oblivious to the fact that (1) he opened himself up to attacks and (2) there are password managers that can keep all his passwords under one roof.
A series of Facebook posts this morning by Tan continued to pin the blame on GovTech for their account lockout policy as he remained adamant that it should not be the case. What he doesn’t seem to understand is that account lockout thresholds are required for security because of something called a Brute Force Attack, in which hackers use bots to aggressively repeat attempts in trying various password combinations to break into accounts.
Fortunately for him, someone used a bot for less nefarious (but still annoying) purposes. According to Tan, his email was registered to about 200 mailing lists. He also had to deal with multiple requests to change the passwords to his various social media accounts.
If that’s how people are messing with his SingPass account, one can only imagine what they’re doing (or planning to do) with his contact number.
With his mobile phone number, anyone could call up his phone’s network carrier; impersonate him; answer some questions regarding his NRIC number or date of birth (both of which Tan has readily provided); ask customer service to reroute the phone number to a different SIM card; profit by receiving two-factor authentication messages and resetting passwords on all accounts associated with the phone number.
And that’s just one simple scenario about the dangers of data leaks. If anything, Tan just conducted a free masterclass in what not to do with one’s personal data.
Source: https://www.asiaone.com/digital/ex-presidential-hopeful-tan-kin-lian-exposed-his-own-data-and-refuses-blame-himself-after-1
-
Enabling Data-Driven Innovation Through Trusted Data Sharing In A Digital Economy
IMDA | 28 JUNE 2019
SINGAPORE – 28 JUNE 2019: The Infocomm Media Development Authority (IMDA) and Personal Data Protection Commission (PDPC) today announced the first comprehensive Trusted Data Sharing Framework (“Framework”) to facilitate trusted data sharing between organisations.
The trusted use of data is the foundation of a vibrant Digital Economy, and trusted data flows have the potential to deliver tremendous benefits to both organisations and consumers. For organisations, it facilitates more effective information exchanges, and enables shared data assets[1] (e.g. between business partners) to support the development of innovative solutions, to customise services and processes for different market segments. For consumers, their willingness to share their data with organisations reflects the amount of confidence they have in an organisation’s ability to use and safeguard data. The intent of the Framework is that with stronger safeguards and clarity on regulatory compliance, consumers will be more ready to share their data and consequently benefit from more personalised goods and services.
While organisations have begun to recognise the value of data, they face the following challenges in sharing their data assets:
- A lack of guidance, methodologies and systemic approaches for data sharing;
- Establishing trust with partners when sharing data;
- Ensuring compliance with regulations such as the Personal Data Protection Act (PDPA);
- Valuing the data assets they currently have; and
- Addressing concerns that data sharing could result in a loss of business competitiveness or exposure of trade secrets.
This can impact their ability to maximise the use of data to develop and bring innovative products and services to market.
To address these challenges, the Framework helps organisations to establish a set of baseline practices by providing a common ‘data-sharing language’, and suggesting a systematic approach to the broad considerations for establishing trusted data sharing partnerships. It incorporates content from existing PDPC guides on personal data anonymisation and sharing; new materials such as a guide to data valuation for data sharing; and sample legal templates to enable contractual data sharing. When using the Framework, organisations will also be guided through the regulatory considerations, and the contractual, technical and operational safeguards needed in a data sharing arrangement.
The Framework can help uplift practice norms – enabling better, trusted data flows for the Digital Economy both within the local ecosystem and globally. They can also empower emerging technologies such as Artificial Intelligence (AI) by incorporating accountability, transparency and human-centricity by-design right from the beginning.
The Framework can be downloaded at www2.imda.gov.sg/AI-and-Data from today.
[1] Data assets encompass all forms of data ranging from raw data to compiled datasets.
-----------------
ISSUED BY THE INFOCOMM MEDIA DEVELOPMENT AUTHORITY
About Infocomm Media Development Authority (IMDA)
The Infocomm Media Development Authority (IMDA) leads Singapore’s digital transformation with infocomm media. To do this, IMDA will develop a dynamic digital economy and a cohesive digital society, driven by an exceptional infocomm media (ICM) ecosystem – by developing talent, strengthening business capabilities, and enhancing Singapore's ICM infrastructure. IMDA also regulates the telecommunications and media sectors to safeguard consumer interests while fostering a pro-business environment, and enhances Singapore’s data protection regime through the Personal Data Protection Commission.
For more news and information, visit www.imda.gov.sg (http://www.imda.gov.sg) or follow IMDA on Facebook IMDAsg and Twitter @IMDAsg.
About Personal Data Protection Commission (PDPC)
The Personal Data Protection Commission administers the Personal Data Protection Act 2012 (PDPA) in Singapore, which aims to safeguard individuals’ personal data against misuse and promote proper management of personal data in organisations. The PDPA enhances Singapore’s competitiveness and strengthens our position as a trusted business hub, among the leading jurisdictions in data protection.
For more information, please visit www.pdpc.gov.sg (http://www.pdpc.gov.sg).
Source: https://www2.imda.gov.sg/news-and-events/Media-Room/Media-Releases/2019/Enabling-Data-Driven-Innovation-Through-Trusted-Data-Sharing-In-A-Digital-EconomyPDF (https://www2.imda.gov.sg/news-and-events/Media-Room/Media-Releases/2019/Enabling-Data-Driven-Innovation-Through-Trusted-Data-Sharing-In-A-Digital-EconomyPDF) Compilation: https://is.gd/84tA92 (https://is.gd/84tA92)
New framework aims to better enable data sharing, increase trust in Singapore's digital economy
28 June 2019
The Trusted Data Sharing Framework helps by providing a common language when businesses discuss sharing of data, as well as sample legal templates.
SINGAPORE: A new framework to facilitate the ease of sharing data between organisations was introduced on Friday (Jun 28), as a means to increase trust in Singapore’s digital economy.
Senior Minister of State for Communications and Information and Transport Janil Puthucheary introduced the Trusted Data Sharing Framework during his speech at the ongoing Innovfest Unbound tech event here on Friday.
The Info-communications Media Development (IMDA) said in its press release that it worked with the Personal Data Protection Commission (PDPC) to speak with industry players before developing the new framework to create a common “data-sharing language”.
Some of the challenges businesses face in this area today include a lack of guidance and systemic approaches to sharing data, establishing trust with partners when sharing data assets and concerns that data sharing could lead to exposing trade secrets or loss of competitiveness, it said.
“While it is widely accepted that intangible assets such as data are valuable, organisations face specific challenges such as ensuring compliance with the Personal Data Protection Act (PDPA) or in accurately measuring the value of data assets,” IMDA said.
This, in turn, can impact their ability to maximise the use of data to develop and bring innovative products and services to market, the agency said.
An example could be a retailer and an e-payments service provider that wants to work together to create more customised shopping experiences and deals, but are unsure how much of their customer data to share with each other to achieve the outcome.
The new framework is thus intended to solve these, by incorporating content from existing PDPC guides on personal data anonymisation and sharing.
It also includes new materials like a guide to evaluating data assets for sharing and sample legal templates to enable the sharing process, it said.
Furthermore, the Trusted Data Sharing Framework can also help improve industry norms by enabling better, trusted data flows for the digital economy - both in Singapore and globally.
For artificial intelligence (AI), in particular, the trusted data would mean more accountability and transparency from the beginning, it said.
This is the latest in a series of initiatives by Singapore to boost the development of AI here.
Minister for Communications and Information S Iswaran had earlier this year introduced the Model AI Governance Framework to guide private sector players on how to use AI solutions ethically.
This initiative won a top award at the World Summit* on the Information Society (WSIS) Forum this April.
The government had also said it will double down on its efforts [2] to build the AI sector here. Minister-in-charge of Smart Nation Initiative said in Parliament an inter-agency taskforce will be formed this year to study how Singapore will develop AI as a strategic capability and become a trusted global hub for test-bedding, deploying and scaling AI solutions.
Source: https://www.channelnewsasia.com/news/singapore/new-framework-aims-to-better-enable-data-sharing-increase-trust-11669498 (https://www.channelnewsasia.com/news/singapore/new-framework-aims-to-better-enable-data-sharing-increase-trust-11669498)
[1] https://www.channelnewsasia.com/news/singapore/singapore-wins-top-prize-for-ai-initiatives-at-un-level-awards-11426920 (https://www.channelnewsasia.com/news/singapore/singapore-wins-top-prize-for-ai-initiatives-at-un-level-awards-11426920)
[2] https://www.channelnewsasia.com/news/singapore/singapore-double-artificial-intelligence-efforts-balakrishnan-11298028 (https://www.channelnewsasia.com/news/singapore/singapore-double-artificial-intelligence-efforts-balakrishnan-11298028)
-
The 15 Biggest Data Breaches
Here are the most notable breaches that have occurred over the last 15 years, in ascending chronological order:
Year Company Impact
2004 AOL 92 million screen names and email addresses stolen
2013 Yahoo All 3 billion accounts compromised
2013 Target 110 million compromised accounts, incl. 40 million payment credentials
2014 eBay 145 million compromised accounts
2015 Anthem Inc 80 million company records were hacked, including Social Security numbers
2016 LinkedIn 117 million emails and passwords leaked
2016 MySpace 360 million compromised accounts
2016 Three 133,827 compromised accounts, including payment methods
2017 Equifax 143 million accounts exposed, including 209k credit card numbers
2016 Uber 57 million compromised accounts
2018 Marriott 500 million compromised accounts
2018 Cathay Pacific 9.4 million compromised accounts, including 860k passport numbers
2018 Facebook 50 million compromised accounts
2018 Quora 100 million compromised accounts
2018 Blank Media 7.6 million compromised accounts
Source 1: https://www.visualcapitalist.com/the-15-biggest-data-breaches-in-the-last-15-years
Source 2 (Original): https://hostingtribunal.com/blog/biggest-data-breach-statistics
(http://tralvex.com/download/forum/2019_The%2015%20Biggest%20Data%20Breaches-small.jpg)
Full image: https://is.gd/0Bi7bq
-
'Data monger' fined $6k by privacy watchdog for selling personal data without notification or consent
Jan 28, 2018, 6:00 pm SGT
Irene Tham | Tech Editor
SINGAPORE - Singapore's privacy watchdog has taken the first "data monger" here to task for breaching the Personal Data Protection Act (PDPA) since the law fully kicked in on July 2, 2014.
A data monger is someone who makes money from dealing in other people's personal data such as phone and NRIC numbers.
The Personal Data Protection Commission (PDPC) fined former telemarketer Sharon Assya Qadriyah Tang $6,000 on Jan 11 for selling personal data without notifying the individuals involved or obtaining their consent.
Tang started buying leads containing people's names, NRIC numbers, mobile numbers and annual income ranges sometime in 2012. It was meant to help her meet her sales targets as a telemarketer.
She paid between 20 and 30 cents to unknown sellers for each lead which contains the details of one person. It is not known if those who sold Tang the leads had obtained the personal data legitimately.
Even if the leads were obtained legitimately, consent from the involved individuals is required by law for a new purpose or for disclosure to another party. Tang had not obtained such consent or notified them before she resold the leads.
Her last purchase was in June 2014, by which time she had accumulated about 30,990 leads stored in Microsoft Excel spreadsheets.
From 2012 through February last year (2017), she resold the database for up to 10 times more - for between 5 cents to 20 cents per lead. Moonlighting earned her a profit of $5,000.
The PDPC said that Tang "had used means to obscure her identity when she was selling the leads, which is indicative of a guilty conscience and of a premeditated and deliberate contravention of the PDPA".
The PDPC added: "The profiteering from the sales of personal data by organisations at the expense of consumer or individuals is the very kind of activity which the PDPA seeks to curb, and hence, must be severely dealt with."
The exact penalty was determined to adequately reflect the seriousness of the breach without imposing "a crushing burden" on Tang as she and her husband were earning modest salaries and had a child to support, PDPC said.
Tang also admitted to the wrongdoing and fully cooperated with the PDPC's investigations.
Some of the industry methods for mining personal data include contests, lucky draws, seminars and surveys. But when stricter privacy rules kick in this year (2018), consumers will be able to refuse to hand over their NRIC details. Instead, the onus will be on providers to use other methods to identify consumers.
The PDPC has fined 22 organisations - one of them twice - a total of $216,500 over the past two years for security breaches that exposed the personal details of Singaporeans. Another 23 organisations have been censured for their shortcomings to date.
Source: https://www.straitstimes.com/singapore/singapore-privacy-watchdog-takes-first-data-monger-to-task
-
Facebook is actually worth more thanks to news of the FTC’s $5 billion fine
Its share price jumped by nearly 2% after reports of the record-breaking fine emerged on Friday.
The news: Facebook is set to be fined $5 billion by the Federal Trade Commission, the US competition watchdog, according to reports from the Wall Street Journal and the Washington Post. The 3-2 vote in favor of the settlement stuck to party lines, with Republicans voting for it and Democrats against. It’s the largest fine ever levied by the FTC, yet when the news broke, Facebook’s share price rose by nearly 2% during late trading on Wall Street. That added about $10 billion to its market value, more than double the cost of the fine.
Why? It’s because the settlement doesn’t challenge anything about the way Facebook collects and shares data, and thus won’t affect its very profitable business model, which relies on advertising.
Other terms: The FTC’s settlement isn’t just financial. Facebook will now have to document its decisions on data before offering new products and keep a closer eye on how third-party apps tap users’ information, and its top executives will have to attest that the company has protected privacy, the Washington Post reports. You might have thought these were mandatory already, but apparently not. Perhaps that’s partly why the settlement was received so badly by so many politicians and industry-watchers.
Next steps: The FTC has now referred the settlement to the Justice Department for sign-off.
Source: https://www.technologyreview.com/f/613957/facebook-is-actually-richer-thanks-to-news-of-the-ftcs-5-billion-fine/
-
New measures to safeguard personal data in public sector
The Public Sector Data Security Review Committee will review and introduce these measures.
by Shamini Priya | 16 July, 2019
The public service is to mandate 13 new measures in the aims of safeguarding citizens’ personal data. These measures are being implemented, following a number of personal data breaches that occurred last year.
This announcement was made by the Public Sector Data Security Review Committee. This committee which was convened by Prime Minister Lee Hsien Loong in March will analyse and recommend measures to the Government for securing personal data of citizens.
A progress report issued by the Smart Nation and Digital Government Office (SNDGO) on Monday, July 15, stated that the committee is concluding a detailed review of the civil service’s data security system. This review includes a consolidation of data management practices across all sectors of the government and detailed inspections of major IT systems that are used.
These detailed inspections on IT systems are focused on five agencies:
- Ministry of Health
- Health Sciences Authority
- Health Promotion Board
- Central Provident Fund
- Inland Revenue Authority of Singapore
This is a result of the high volumes of sensitive data that these agencies deal with.
Personal data breaches of last year
Singapore’s healthcare sector agencies had a tough experience of dealing with security breaches last year.
SingHealth
1.5million SingHealth patients’ non-medical records were retrieved and copied in July last year. Out of that number, 160,000 had their outpatient dispensed medicines’ record taken. Personal data such as patients’ names, NRIC numbers, address, gender, race, and date of birth were stolen.
Singapore’s HIV registry
HIV-positive status and personal data of 14,200 people were leaked online from Singapore’s HIV registry this year.
Health Sciences Authority
The personal information of 808,201 blood donors was leaked online for a period of nine weeks from Jan 4 this year. A press release reported that the information was accessed illegally and possibly extracted.
Committee’s focus
While the current data security system is guarded with strong pillars, there is always a risk of breaching. In an earlier article OpenGov reported that though the number of common cyber threats detected in Singapore saw a decrease in 2018, Singapore continues to be the target of cyber-attacks by advanced actors.
These were findings released by the Cyber Security Agency of Singapore (CSA) in the Singapore Cyber Landscape 2018 publication on 18 June 2019.
Hackers are constantly trying to find loopholes in the system to attack and access information. With IT systems becoming more complex, the use of data is needed now more than ever to provide more and efficient digital services to the public and for improved policy-making.
The committee is looking to improve the system by focusing on three aspects: Technical, Process and People Strategies
Technical
The Government has agreed with the committee’s advice to immediately deploy technical measures that are ready for implantation for existing and new systems, in efforts of improving data security standards.
The most immediate measures focus on the sending and receiving of data:
- Data file integrity verification system to avoid tampering of data
- Strengthening of password and encryption requirements across more types of data files
- Prompts before public servants send out emails with sensitive data
These measures are slated to be deployed by the end of the year. Following which, the Government will deploy 10 other technical measures such as tokenisation.
Process and People measures
Improve high data protection standards by third parties that handle Government data and help to raise the data security capabilities among public officers
Findings and recommendations by the committee are to be submitted to the prime minister by Nov 30.
Source: https://www.opengovasia.com/new-measures-to-safeguard-personal-data-in-public-sector
-
When to disclose your NRIC details after new rules kick in on Sept 1
From Sept 1, organisations will not be allowed to collect, use or disclose a person's NRIC number, or any other national identification numbers such as birth certificate numbers, foreign identification numbers and work permit numbers.
Jul 25, 2019 | Charmaine Ng
From Sept 1, organisations will not be allowed to collect, use or disclose a person's NRIC number, or any other national identification numbers such as birth certificate numbers, foreign identification numbers and work permit numbers. The following are some scenarios where a private security officer may ask for your identification number and whether you should comply.
WHERE YOUR FULL NRIC DETAILS MAY BE ALLOWED TO BE COLLECTED, USED OR DISCLOSED
For entry into sensitive places such as bank vaults, data centres, server rooms or security operations rooms.
However, the details should not be recorded where other visitors or unauthorised persons can view them.
WHERE SECURITY OFFICERS MAY ASK TO VISUALLY INSPECT YOUR NRIC, BUT NOT RECORD THE FULL NUMBER
• Criminal offences such as trespassing. Depending on the severity of the offence and the security risk posed, there may be no need to verify your identity to a high certainty. The officer may instead record a partial NRIC number, full name, mobile number or postal code.
• Civil suits such as nuisance or harassment cases, if the officer believes there is a high chance you are not being truthful about information.
• Violating in-house rules such as smoking or unauthorised parking in a private residence, as the management corporation may need to take follow-up action against the offender.
• Collecting a parcel that was left with a security officer.
SITUATIONS WHERE SECURITY OFFICERS SHOULD NOT ASK FOR YOUR NRIC DETAILS
When claiming or depositing lost or found items.
However, if the item is of a sensitive nature or highly valuable, the officer may inspect your NRIC to verify your identity. If the item is not of a high value, there is no justification for the officer to collect, use or disclose your full NRIC details.
WHAT TO DO IF YOU BELIEVE THE COLLECTION OF YOUR NRIC NUMBER HAS VIOLATED THE PDPA
After Sept 1, you may file a complaint with the Personal Data Protection Commission, which will investigate the matter. An organisation found to have breached the PDPA may be required to stop collecting, using or disclosing the data; destroy the data collected; provide access to or correct the data; and/or be fined up to $1 million.
Source: https://www.straitstimes.com/singapore/when-to-disclose-your-nric-details
-
Examples of PDPC's Enforcement Cases involving Sensitive Personal Data
(http://tralvex.com/download/forum/2019%20PDP%20Digest_Sensitive%20PD-smaller.png)
Enlarged version: http://tinyurl.com/spd19p (http://tinyurl.com/spd19p)
-
Watchdog probing customer data breach at retailer Sephora
Sephora has apologised and cancelled all existing passwords for customer accounts.
Jul 30, 2019 | Hariz Baharudin
Singapore's privacy watchdog is investigating international beauty retailer Sephora, after it reported a breach of its online users' data, affecting customers in Singapore, as well as other countries including Malaysia, Indonesia, Thailand, the Philippines, New Zealand and Australia.
Yesterday, the retailer, which has 12 stores in Singapore, issued a notice to its online customers stating that the data breach was discovered over the past two weeks.
In the e-mail, Sephora's managing director for South-east Asia Alia Gogi said: "Some personal information may have been exposed to unauthorised third parties, including first and last name, date of birth, gender, e-mail address and encrypted password, as well as data related to beauty preferences."
She added that no credit card information was accessed and that the company had "no reason to believe that any personal data has been misused".
In response to queries from The Straits Times, a spokesman for the Personal Data Protection Commission (PDPC) said: "PDPC has been notified by Sephora Digital SEA Pte Ltd of the incident and is looking into it."
On its website, Sephora said none of its physical stores was affected and it was safe for customers to use its mobile app and website.
"The security incident was limited to a database serving our South-east Asia, Hong Kong and Australia/New Zealand customers who used our online services," said Sephora.
It is not known how many customers were affected in the data breach.
Responding to queries from The Strait Times, a spokesman for Sephora South-east Asia said the experts it engaged found "no major vulnerability" on the company's websites.
No traces of a cyber attack were found either and the spokesman added that the company had no evidence any personal data has been misused.
The company has apologised and cancelled all existing passwords for customer accounts.
It has also conducted a review of its security systems and is offering a free personal data monitoring service to its customers, through a third-party provider. Impacted customers here can sign up for this service for a year, said the Sephora South-east Asia spokesman.
Customers who wish to avail themselves of the service can sign up at a link provided by Sephora while using a unique code by Nov 30.
In the e-mail, the company also recommended that its customers change the passwords of their accounts.
One Sephora customer, Miss Ada Sulaiman, said she was surprised when she found out about the breach, but was relieved to know that her payment details were not exposed.
"That said, I think it is still a cause of concern as the personal information that was breached is still a gateway to my financial details," said the 27-year-old media consultant.
"I wish there were more details about the monitoring service and possible recourse," she added.
"The next step for them after this is assuring me that my data will be safeguarded moving forward."
Source: https://www.straitstimes.com/tech/watchdog-probing-customer-data-breach-at-retailer-sephora (https://www.straitstimes.com/tech/watchdog-probing-customer-data-breach-at-retailer-sephora)
Sephora data breach: 3.7m customer records up for sale on Dark Web, says cybersecurity firm
Kevin Kwang | @KevinKwangCNA | 01 Aug 2019
SINGAPORE: About 3.7 million customer records “likely to be related” to the Sephora data breach are on sale on the Dark Web, according to one cybersecurity vendor.
Singapore-headquartered company Group-IB said in a news release on Thursday (Aug 1) its threat intelligence team found two databases with customer data on underground forums, with the leak dating back to as early as February this year.
CEO Ilya Sachkov said in the release that the first database was advertised on two underground forums on Jul 6 and Jul 17, respectively. According to the seller, the database consists of 500,000 records including the user names and hashed passwords from Sephora’s Indonesia and Thailand websites.
The listing said the data was from February this year, he added.
The second database surfaced on an underground forum on Jul 28 this year, a day before news of the breach broke. The database name - “Sephora 2019/03 – Shopping - [3.2 million]” – contained 3.2 million records and was leaked in March this year, the company said.
The CEO said his team used its proprietary tools to “infiltrate sources in closed hacking communities” to contact the seller, who then provided the sample of the data being sold.
The sample showed the databases contains login, encrypted password, date of registration and last activity, IP of registration, last IP, gender, name, surname, ethnicity, eye color, skin tone, skin type, hair color, hair concerns, makeup essentials, and skincare routines, he said, adding the set of data was being sold for US$1,900 (S$2,613).
“Even though the records do not include any payment information or decrypted passwords, such detailed information about the customers can be used to carry out social engineering or targeted phishing attacks. That is why the scale of the breach shouldn’t be underestimated,” Mr Sachkov said.
CNA has contacted Sephora for its comments on Group-IB's findings.
The international beauty retailer said on Monday personal details of Sephora’s online customers in Singapore, Malaysia, Indonesia, Thailand, the Philippines, Hong Kong, Australia and New Zealand have been leaked but did not disclose the number of affected customers.
It added that no credit card information was accessed and it has no reason to believe that any personal data has been misused. It also contracted external experts, who concluded that there was no major vulnerability found on Sephora’s Southeast Asia websites and found no trace of a cyberattack.
However, these statements drew criticism from another cybersecurity vendor. Mr Nabil Hannan, managing principal at Synopsys Software Integrity Group, questioned Sephora’s claim that it found no reason any personal data has been misused.
“This is very hard to claim given they have made a statement that user data has been breached, including things like first and last name, date of birth and gender,” Mr Hannan said. “It’s not possible to determine how this data may have been misused after the breach.”
He also pointed out that while no major vulnerability was found, this may not be required for a breach to happen.
“Organisations also need to consider that potential malicious insider threats may exist,” Mr Hannan said. “For example, when looking at where the database was breached, it’s important to understand the threat model of the system, and determine things like who had access to the database and if they really needed to have access.”
The Personal Data Protection Commission of Singapore (PDPC) said it has been notified by Sephora Digital SEA of the incident and is “looking into it”.
Source: https://www.channelnewsasia.com/news/singapore/sephora-data-breach-customer-records-for-sale-dark-web-11772722
(http://tralvex.com/download/forum/201907_Sephora1.jpg)
Source: https://www.nulled.to/topic/809538-private-shopping-sephora-500k-database/
(http://tralvex.com/download/forum/201907_Sephora2.jpg)
Source: https://raidforums.com/Thread-Database-Trading-Buying-Selling?page=86
Reference 1: https://paste.ee/p/HEjFu
Reference 2: https://paste.ee/p/iwtpv
Reference 3: https://paste.ee/p/TOZIV
-
Watchdog probes electricity retailer over data breach
Source: Straits Times
Article Date: 31 Jul 2019
Author: Hariz Baharudin
Geneco exposed 350 potential customers' e-mail addresses.
The privacy watchdog is investigating electricity retailer Geneco, after the company exposed the personal e-mail addresses of more than 350 of its potential customers - the second breach of private data discovered in a week.
Last Saturday, the company e-mailed some of its potential customers to ask for a copy of their Singapore Power (SP) bill to verify their account with Geneco.
The e-mail, which was seen by The Straits Times (ST) on Monday, copied the e-mail addresses in the "To" field so the contacts were visible to all recipients.
The firm should have used the BCC - blind carbon copy - option to conceal the e-mail addresses of other recipients.
In a separate e-mail sent a day later, Geneco's senior manager of customer experience Florence Joseph admitted the mistake and apologised to these customers.
In response to queries from ST, a spokesman for the Personal Data Protection Commission (PDPC) acknowledged on Monday that it had been notified of the incident by Seraya Energy, which is the provider for Geneco, and was looking into it.
According to Ms Joseph, the earlier e-mail was mistakenly disseminated to some of Geneco's customers with other recipients' e-mail addresses clearly visible.
She added that the company took full responsibility for the incident and that it regretted that the situation had occurred.
"We apologise for the inconvenience that this matter may have caused you, and for the potential unsolicited e-mails that may occur as a result of this incident. We have identified the issue and taken measures to rectify it," she said.
Those still keen to proceed to activate their accounts were told not to reply to the previous e-mail that was sent and to e-mail their SP bills directly to Geneco.
Mr Bryan Tan, a lawyer from Pinsent Masons MPillay specialising in technology law and data protection, said the gaffe could be a breach of the Personal Data Protection Act.
"In the PDPC's guide to preventing accidental disclosure when processing and sending personal data, it states that companies have to implement e-mail procedures to ensure all e-mails sent externally to a group of recipients have the recipients' e-mail addresses placed in the BCC field to avoid disclosing recipients' e-mail addresses to all other recipients of the e-mail," he said.
Geneco is one of the new electricity retailers that have popped up since the electricity market was opened up last November.
On Monday, ST reported that the PDPC is investigating international beauty retailer Sephora, after it reported a breach of its online users' data, affecting customers in Singapore as well as in other countries, including Malaysia, Indonesia, Thailand, the Philippines, New Zealand and Australia.
The e-mail, which was seen by The Straits Times on Monday, copied the e-mail addresses in the "To" field so the contacts were visible to all recipients. The firm should have used the BCC - blind carbon copy - option to conceal the e-mail addresses of other recipients.
Source: https://www.singaporelawwatch.sg/Headlines/watchdog-probes-electricity-retailer-over-data-breach
-
Ikea Singapore apologises after more than 400 e-mail IDs revealed to customers
Ikea accidentally inserted 410 individual e-mail addresses into the wrong field in a promotion mailer, allowing other recipients to see the addresses.
Aug 4, 2019 | Malavika Menon
SINGAPORE - Swedish retailer Ikea apologised to affected customers in Singapore on Sunday (Aug 4) after the company inserted 410 individual e-mail addresses in the wrong message field of a promotional mailer and sent it out.
A spokesman for Ikea Singapore said the error occurred at 4.57pm last Thursday and that the company "regretfully made an error of inserting 410 individual e-mail addresses in the 'To' field in an Ikea Service Delivery Promotion e-mail sent to our customers", therefore making all the e-mail addresses visible to all recipients of the mailer.
However, an e-mail it then sent to quickly notify affected customers about the leak and to apologise included an internal draft of the apology instead. This second e-mail was sent to half the recipients.
"In our haste to notify the customers as quickly as possible, we again made a mistake by sending half the recipients an internal draft of the apology notice instead, an oversight that we are embarrassed about," Ikea said.
Ikea said that it takes customers' personal data integrity seriously and had notified the Personal Data Protection Commission of Singapore (PDPC) when the error was discovered.
Under the Personal Data Protection Act, organisations must generally have an individual's knowledge and consent when collecting, using or disclosing their personal data.
Apologising for causing customers "unease and inconvenience", Ikea said: "Confidence and trust in our company including our data protection policies is important to us and we will look at and implement effective ways to prevent this from happening again, through reviews of procedures, technology and training."
Last month, international beauty retailer Sephora issued a notice to its online customers after it discovered a data breach which affected customers in Singapore, Malaysia, Indonesia, Thailand, Philippines, New Zealand and Australia.
Encryption adds levels of security to data, so that even if stolen, hackers would not be able to use the information, experts said.
The breach exposed customers' personal information including first and last names, date of birth, gender, e-mail addresses and encrypted passwords to unauthorised third parties.
Electricity retailer Geneco was probed by the PDPC last month after it exposed the personal e-mails of more than 350 of its potential customers.
The company e-mailed some of its potential customers to ask for a copy of their Singapore Power bill to verify their account with Geneco.
Similar to Ikea Singapore's incident, Geneco's mail copied the e-mail addresses in the "To" field so the contacts were visible to all recipients.
Source: https://www.straitstimes.com/singapore/ikea-singapore-apologises-after-more-than-400-e-mail-ids-revealed-to-customers
-
World-first framework spells out role, training for data protection officers
Cynthia Choo | 17 July, 2019
The framework will help companies in the hiring of data protection officers (DPO) and sets out appropriate training for them.
SINGAPORE — Singapore’s privacy watchdog on Wednesday (July 17) unveiled a world-first competency framework and training roadmap for an increasingly vital member of any organisation — a data protection officer (DPO).
The aim is to streamline and improve data protection training among organisations here, while encouraging data innovation, to ensure DPOs achieve prescribed standards.
Organisations are beginning to see how good data protection practices contribute to business growth and innovation, and the job scopes of DPOs have expanded, said the Personal Data Protection Commission (PDPC).
Under the Personal Data Protection Act (PDPA), every organisation must appoint a DPO to oversee the use and protection of data in organisations.
Announcing the new framework at the Personal Data Protection Seminar, Minister for Communications and Information S Iswaran said on Wednesday that the role of the DPO is “critical to the success” of every enterprise in the digital age.
The new framework spells out the set of skills DPOs require, from entry-level officers in small companies to those with regional responsibilities.
It also provides guidance on a viable career path in the nascent sector — such as a list of competencies that DPOs should have as they progress in their roles.
The framework — which can be found on the PDPC’s website — is also meant to serve as a guide for business owners in hiring decisions, and in planning the training for DPOs and data protection teams.
Mr Iswaran said businesses should not see data protection as simply a cost, a compliance requirement or a defensive measure.
“That would take a very limiting approach in our attitude towards data as a resource. Rather, if we manage this well, the management of data can be a source of business competitiveness and a means to create new opportunities,” he said.
At least 30,000 DPOs are registered with the PDPC, but before the release of the new framework, the training and skills required by these employees had not been standardised.
They were mostly trained in an ad hoc fashion, picking up skills in managing data breaches and stakeholder management among others, to ensure compliance with the PDPA.
In an industry survey by the PDPC this year, 39 per cent of organisations flagged concerns over whether their DPOs are equipped with the knowledge and skills to mitigate the risks of data breaches and recover from them.
The greater clarity on the career progression for aspiring and current DPOs could help provide new career opportunities and career progression pathways for workers, said National Trades Union Congress (NTUC) assistant secretary-general Patrick Tay.
For a start, PDPC will work together with the NTUC, Employment and Employability Institute (e2i) and NTUC LearningHub to launch a 12-month pilot programme for DPOs, said the PDPC.
The pilot programme, which will start in October, is expected to benefit about 500 DPOs in the first year.
The PDPC is also working with other training partners such as the Institute of Singapore Chartered Accountants, National University of Singapore, Law Academy, Singapore Management University Academy and Singapore Polytechnic.
CHALLENGES IN HANDLING DATA
Some of the challenges that DPOs face include varying levels of understanding in amassing personal data.
Ms Eunice Toh, executive director of the Tan Tock Seng Hospital (TTSH) Community Fund, said that the standardised training would be helpful in tightening processes such as obtaining consent.
As the designated DPO of the charity arm of TTSH, which receives personal data of donors, beneficiaries and industry partners, Ms Toh said that there could be differences in interpreting when one gives consent.
“For example, (when) we work with beneficiaries, some may wish to say they are a patient, but not wish to disclose their condition.”
“To someone who is not trained, they could interpret a verbal ‘yes’ as consent,” she said.
Training is hence important for staff to learn how to nail down the “finer points” — such as getting consent for “the specific use of the information, how it will be used and when it can be used”.
Ms Joyce Chiew, who is the DPO of IT solutions provider Oneberry Technologies, said that one challenge in her work is drafting comprehensive legal contracts between the firm and external vendors.
“When we engage external vendors, they (have access) to our personal data, so we must ensure that clauses in our contracts lay out that such data cannot be spread,” she said.
She said undergoing courses identified in the training roadmap will give her more confidence to draft such legal contracts in greater detail.
Source: https://www.todayonline.com/singapore/world-first-framework-spells-out-role-training-red-hot-career-data-protection-officer (https://www.todayonline.com/singapore/world-first-framework-spells-out-role-training-red-hot-career-data-protection-officerReference)
DPO Competency Framework and Training Roadmap
(http://tralvex.com/download/forum/2019_DPO%20CF%20&%20TR%20Job%20Fn.gif)
Infographics:
(http://tralvex.com/download/forum/2019_DPO%20CF%20&%20TR%20Infographics.png)
(http://tralvex.com/download/forum/2019_DPO%20CF%20&%20TR%20CvsPL.gif)
(http://tralvex.com/download/forum/2019_DPO%20CF%20&%20TR.png)
Source 1: https://www.pdpc.gov.sg/Organisations/Data-Protection-Officers/DPO-Competency-Framework-and-Training-Roadmap
Source 2: https://www.pdpc.gov.sg/Organisations/Data-Protection-Officers/DPO-Competency-Framework-and-Training-Roadmap/Competencies#dpm (https://www.pdpc.gov.sg/Organisations/Data-Protection-Officers/DPO-Competency-Framework-and-Training-Roadmap/Competencies#dpm)
-
NTUC LearningHub launches four new data protection courses
HR & EDUCATION | Staff Reporter, Singapore | Published: 14 Oct 19
It is expected to support 500 officers within the first year of roll-out.
NTUC LearningHub, in partnership with National Trades Union Congress’ (NTUC) e2i (Employment and Employability Institute) and the Personal Data Protection Commission (PDPC), has launched four new data protection-related courses for Data Protection Officers (DPOs), an announcement revealed.
Approximately 500 DPOs are expected to benefit from the courses within the first year of rollout. The. The courses were based on PDPC’s Data Protection Competency Framework and Training Roadmap, and aim to upgrade the competencies of DPOs in data protection and risk management.
NTUC LearningHub added that they will also subsequently release 10 other data protection courses.
The four courses are: Monitor and Assess Organisation’s Personal Data Protection Policies and Practices; Develop and Implement a Data Protection Management Programme; Identify Risks Associated with Collection, Use, Disclosure and Storage of Personal Data; and Assess Risks Within a Defined Functional Area, and Develop Countermeasures and Contingency Plans.
The framework consists of nine competencies broadly classified under two categories: Data Protection─which enables businesses to build customer trust and progress towards accountability, and Data Innovation─to harness the value of data to deliver new and improved products and services.
Source: https://sbr.com.sg/hr-education/more-news/ntuc-learninghub-launches-four-new-data-protection-courses
Reference: https://www.straitstimes.com/singapore/500-data-protection-officers-to-be-trained-to-safeguard-company-data
C1.1 "Monitor and Assess Organisation’s Personal Data Protection Policies and Practices": https://courses.ntuclearninghub.com/browse/cyber-security/programs/monitor-and-assess-organisation-personal-data-protection-policies-and-practices
C1.2 "Develop and Implement a Data Protection Management Programme": https://courses.ntuclearninghub.com/browse/cyber-security/programs/develop-and-implement-a-data-protection-management-programme-dpmp
C2.1 "Identify Risks Associated with Collection, Use, Disclosure and Storage of Personal Data": https://courses.ntuclearninghub.com/browse/cyber-security/programs/identify-risks-associated-with-collection-use-disclosure-and-storage-of-personal-data
C2.2 "Assess Risks Within a Defined Functional Area, and Develop Countermeasures and Contingency Plans": https://courses.ntuclearninghub.com/browse/cyber-security/programs/assess-risks-within-a-defined-functional-area-and-develop-countermeasures-and-contingency-plans
-
High Court quashes conviction of NUH psychiatrist Soo Shuenn Chiang over confidentiality breach
18 October 2019
SINGAPORE - The High Court has quashed the conviction of a psychiatrist who was hauled to court for providing information on his patient to a man claiming to be her husband.
In a judgment issued on Friday (Oct 18), Chief Justice Sundaresh Menon said that the charge of professional misconduct against Dr Soo Shuenn Chiang for failing to maintain a patient's medical confidentiality was not made out.
The Chief Justice said a doctor may disclose a patient's confidential medical information without her consent when he reasonably regards it as necessary to protect the patient from potentially serious self-harm, the disclosure is in the patient's best interests and the patient's consent cannot reasonably be obtained.
In such circumstances, the disclosure should be made to those closest to the patient, such as her next of kin, the Chief Justice noted.
The decision on Friday came after the Singapore Medical Council applied to the Court of Three Judges in May to quash the conviction and $50,000 fine against Dr Soo, a psychiatrist at the National University Hospital.
He had been charged with giving a memo on a patient's medical condition to her brother, who had posed as her husband.
The patient filed a complaint with the council, saying that her brother used the memo provided by the doctor to get a protection order against her in a family court.
The patient's brother later put online his version of what happened. He said in his Facebook post that while he spoke to the doctor, the patient's husband was with him and agreed with what he was doing.
Dr Soo had pleaded guilty to not verifying who the man was.
The disciplinary tribunal said a reasonable and competent doctor would have obtained the man's name and identity card number, and checked it against the patient's records.
The judgment resulted in an online petition - which garnered thousands of signatures - arguing that Dr Soo had been trying to help the patient, whom the caller said was suicidal.
Source: https://www.straitstimes.com/singapore/high-court-quashes-conviction-of-psychiatrist-soo-shuenn-chiang-over-confidentiality (https://www.straitstimes.com/singapore/high-court-quashes-conviction-of-psychiatrist-soo-shuenn-chiang-over-confidentiality)
S$50,000 fine for psychiatrist who failed to protect patient’s confidential info
By Neo Chai ChinUpdated 08 March, 2019
SINGAPORE — A psychiatrist from the National University Hospital (NUH) has been fined S$50,000 for failing to verify a caller’s identity before writing a memo to refer a patient to the Institute of Mental Health.
The caller turned out to be the patient’s brother and not her husband as he had claimed.
And although the memo was addressed to ambulance personnel or the police officer-in-charge, it was handed to the brother, who used it to support his application for a personal protection order against the patient.
The personal protection order was granted by the Family Court.
A three-member disciplinary tribunal found Dr Soo Shuenn Chiang guilty of failing to maintain patient confidentiality.
The tribunal — chaired by cardiothoracic surgeon Joseph Sheares — had wanted to impose the maximum fine of S$100,000, but reduced it by half after considering mitigating factors.
This case justifies a deterrent sentence “so as to create public awareness, more particularly among potential offenders, that punishment will be certain and unrelenting for this type of breaches and offenders”, it said.
The patient's name was not disclosed in the grounds of decision to protect her identity.
FACTS OF THE CASE
On Jan 19, 2015, the patient was admitted to NUH for an overdose of a pain relief drug.
She was reviewed by Dr Soo for adjustment disorder with depressed mood and alcohol misuse. She was noted to have a risk of self-harm as she had a history of depression.
The woman was discharged the next day.
Two months later, Dr Soo received a phone call from the woman’s brother. Dr Soo did not check the caller’s identity by asking for his name, identity card number or contact number, and comparing these against NUH’s records.
The memo he wrote contained her confidential medical information, and he instructed his clinic's staff member to give it to the caller, believing he was the patient’s husband.
While Dr Soo’s response to the phone call was appropriate in trying to rapidly get help for the patient, he failed to take proper care to ensure the memo did not fall into the wrong hands.
Dr Soo’s lawyers said that it was an “honest oversight” during the course of seeing 17 patients that day.
The psychiatrist accepted that he had caused potential harm to the patient.
The tribunal agreed that the lapse occurred on a hectic day, but said that the preventive actions he should have taken by verifying the caller’s identity were simple and “not onerous”.
“We could only conclude that the failure of Dr Soo to take such steps reflected both a lack of concern for or appreciation of the required standards and an indifference to the patient’s medical confidentiality,” the tribunal said.
But it agreed that Dr Soo’s misconduct was not as egregious as a previous case, in which a doctor — who was with the KK Women's and Children's Hospital — was fined S$10,000 in 2011 for accessing the electronic medical records of two patients not under his care, but who were his ex-girlfriends.
At the time, S$10,000 was the maximum fine.
Source: https://www.todayonline.com/singapore/s50000-fine-psychiatrist-who-failed-protect-patients-confidential-info (https://www.todayonline.com/singapore/s50000-fine-psychiatrist-who-failed-protect-patients-confidential-info)
Reference: "[2018] SMCDT 11" Singapore Medical Council vs Dr Soo Shuenn Chiang, https://www.healthprofessionals.gov.sg/docs/librariesprovider2/published-grounds-of-decision/year-2019/grounds-of-decision-(181217)---dr-soo-shuenn-chiang---anonymised.pdf (https://www.healthprofessionals.gov.sg/docs/librariesprovider2/published-grounds-of-decision/year-2019/grounds-of-decision-(181217)---dr-soo-shuenn-chiang---anonymised.pdf)
MOH issues guidelines to medical practitioners on information disclosure
By Low Youjin | 23 October, 2019
The Ministry of Health has come up with seven "key guiding principles" for communicating medical information over the phone.
SINGAPORE — The Ministry of Health (MOH) on Wednesday (Oct 22) released a circular to medical practitioners that contains guidelines pertaining to the communication of medical information over the phone.
The circular comes days after the High Court overturned a psychiatrist’s conviction for failing to protect his patient’s confidential information.
Dr Soo Shuenn Chiang, a psychiatrist at the National University Hospital (NUH), was fined S$50,000 earlier this year by the Singapore Medical Council’s (SMC) tribunal for not verifying a caller’s identity and sharing confidential information about a patient’s condition with her brother, who had posed as her husband.
The medical watchdog eventually applied to the courts to quash the conviction.
WHAT ARE THESE GUIDELINES?
The MOH said in its circular that the guidelines were formed after a review that started in May this year, during which views from public healthcare institutions, private hospitals and polyclinics were sought.
Here are the seven "key guiding principles" that the MOH has come up with for communicating medical information over the phone:
- Balance the need to act in a patient’s best interest with the need to respect patient confidentiality when considering requests for medical information.
- Proper avenues and processes should be adhered to unless there is a “legitimate urgent need”.
- Reasonable effort should be made to verify the identity of an individual requesting information. For instance, healthcare institutions could ask for: Three patient identifiers, the caller’s relationship to the patient, or even return the call through the designated next-of-kin’s number as per the patient’s records.
- Only relevant information that is needed for urgent care should be shared.
- Healthcare providers should carefully choose the appropriate method to disclose the information to ensure that the intended person receives it.
- Proper documentation must be made by both the caller (if he is a healthcare professional) and the receiver of the call. The documentation should include: The reasons for the urgent need for medical information, the type of information requested and released, as well as the identities of those involved in the call.
- Healthcare institutions should regularly monitor the workflows for the requests and release of medical information such that the telecommunication process can be validated when necessary.
WHAT DOES THE LAW SAY?
According to SMC’s ethical code and guidelines, patients have a right to expect that any information provided to them in the context of clinical care will be kept confidential.
An exception can only be made if a patient gives his consent for specific disclosure to other parties.
Furthermore, under the Private Hospitals and Medical Clinics Regulations, adequate safeguards must be made by medical institutions to protect medical records against accidental or unlawful loss, modification or destruction, or unauthorised access, disclosure, copying, use or modification.
WHAT DR SOO’S CASE WAS ABOUT
Dr Soo’s patient was admitted to NUH in January 2015 after a drug overdose.
In March that year, the patient’s brother — posing as her husband — contacted Dr Soo, telling him that she was suicidal and needed to be taken to the Institute of Mental Health.
The caller was able to provide the patient’s name, medical history and identification number.
Dr Soo noted that she had a history of depression and was at risk of harming herself.
The doctor then issued a memo to refer the patient to IMH.
The brother later used that memo to successfully get a personal protection order against the patient. He had earlier applied to the Family Court on behalf of the patient’s son for the order.
The patient then filed a complaint with the SMC. It is not known if the patient was eventually referred to IMH.
WHAT HAPPENED NEXT
In March this year, Dr Soo was fined S$50,000 by the SMC’s tribunal. This sparked an outcry among doctors and two petitions emerged, one in support of the psychiatrist and the other urging the SMC to consider the ruling’s impact on medical practice.
The MOH, in response to TODAY’s queries, subsequently said it was looking into the ruling.
On March 14 this year, the SMC said it would be appealing for a reduction of the fine.
Two months later, the council said it would seek to overturn the conviction, citing the emergence of new information which it said raised doubt on the “circumstances surrounding the incident”.
On Oct 18, the High Court quashed Dr Soo’s conviction.
Source: https://www.todayonline.com/singapore/moh-issues-guidelines-medical-practitioners-information-disclosure (https://www.todayonline.com/singapore/moh-issues-guidelines-medical-practitioners-information-disclosure)
-
'I bought this property for $1.5 million': Condo resident yells profanities at security guards over visitor parking
The man was outraged by a parking fee he was told he needed to pay for his guests to park inside the condominium.
Oct 26, 2019 | Jean Iau
SINGAPORE - A video of a man yelling at his condominium security guards and hurling vulgarities at them has attracted much attention online since it was posted on Friday (Oct 25).
The man, dressed in a blue sleeveless shirt and shorts, who identified himself as Ramesh in the video, was outraged by a parking fee he was told he needed to pay for his guests to park inside the condominium.
Two security agency associations have released separate statements on Saturday (Oct 26) regarding the incident, defending the security officer in the video.
A police report has also been made on Saturday (Oct 26) by the officer in the video who was the security supervisor on site.
The video in question was uploaded on YouTube on Friday (Oct 25) by user Mohamed Sharil and has received more than 3,000 views since.
It was also submitted by a reader of alternative news website All Singapore Stuff and has attracted about 1,800 reactions and 2,600 shares on their Facebook page.
Netizens have criticised the man for being rude to the security guards.
President of the Security Association Singapore (SAS) Raj Joshua Thomas said: "SAS has been made aware of a recently uploaded video on YouTube, where a security officer was subject to verbal abuse by a condominium resident when trying to fulfil his duties."
Mr Thomas added: "A key role of security officers deployed at condominiums is to enforce the in-house rules. These are set by the MCSTs (Management Corporation Strata Title). Their work is instrumental in helping keep the living environment a safe and civil one for all residents. In the event that security officers are lenient in enforcing in-house rules, the security agency is often penalised though onerous liquidated damages."
In the video, a blue car is stopped in front of the security post of the condominium as the man tells the security officers that he bought his apartment for $1.5 million, adding: "You're putting my visitors in such a position. You're telling me for Diwali they can't visit after 11 o'clock?"
He is heard shouting vulgarities at the security officer who says: "We are just enforcing the rules here."
He becomes more agitated when told that his guests can pay $10 to park.
The video ends with the man getting into the car with his friend and driving into the underground carpark.
The Straits Times tried contacting the man in the video, but the call went straight to his voicemail.
Association of Certified Security Agencies (ACSA) president Robert Wiener condemned the behaviour of the resident and applauded the security officer, he said: "We do not tolerate the abuse of our security officers whilst they are discharging their duties. It is essential that the public understand that security staff are there representing the building owners and MCSTs and they have to enforce the by laws of the estate without fear or favour.
"Please respect the security personnel whom are helping to keep Singapore and your neighbourhood and estates safe and secure," he said.
Source: https://www.straitstimes.com/singapore/housing/condo-resident-yells-profanities-at-security-guards-over-visitor-parking-police
Cache: https://archive.md/zAhMq
Police report (personal data of the condo resident blurred) made by KH Security (Eight Riversuites Condo's Security firm):
(http://ip5.us/download/forum/20191026_EightRiversuites_PoliceRpt.jpg)
Source: https://www.prolificskins.com/forum/current-affairs/security-guard-lodged-police-report-against-j-p-morgan-director-ramesh-erramalli
Cache 1: https://archive.md/zAhMq
Cache 2: https://web.archive.org/web/20191029153744/https://www.prolificskins.com/forum/current-affairs/security-guard-lodged-police-report-against-j-p-morgan-director-ramesh-erramalli
-
Singtel fined $25,000 and Ninja Van $90,000 for data breaches
Nov 5, 2019
SINGAPORE - Telco Singtel has been fined $25,000 for a data breach involving its My Singtel mobile app, according to a decision released on Monday (Nov 4) from the Personal Data Protection Commission (PDPC), Singapore’s official privacy watchdog and enforcer of the Personal Data Protection Act.
Because of a design problem, My Singtel users could potentially access other customers’ accounts, exposing the billing information - including names and addresses - of up to 330,000 subscribers.
Separately, Ninja Logistics - which operates goods delivery startup Ninja Van - was fined $90,000 for leaving up to 1.26 million individuals’ data exposed to website users, in a decision also out on Monday.
From 2016 to 2018, users of the order tracking function on Ninja Logistics’s website were able to enter a different tracking number and view information, such as names, addresses and signatures, of customers whose parcel delivery statuses were set to “completed”.
Another 2.6 million tracking numbers had earlier been archived in August 2016, which removed those older customers’ data from view.
Ninja Logistics must now also ensure that tracking numbers expire after a certain time once orders are completed - a time “as reasonably short as possible while meeting business needs”, the PDPC ruled.
The PDPC, which acted on a complaint about Ninja Logistics in April 2018, noted that there was no evidence that the exposed personal data had been “exfiltrated” or maliciously collected.
Ninja Logistics had also tried - albeit unsuccessfully - to introduce a second layer of authentication by requiring part of a customer’s name or mobile number to verify the identity of the person using a tracking number.
The company did so for about three months after the tracking function was launched in December 2014, but later said that “these methods were not workable” - for example, as customers might forget what name they used for their orders.
Still, based on “the foreseeable risk” of using tracking numbers alone to access the tracking function webpage, “it is inexcusable for the organisation to neglect its obligations to implement a workable security arrangement to protect the exposed personal data”, the PDPC ruled.
The PDPC also found that, had Ninja Logistics set a fixed expiry period for tracking number validity after deliveries are completed - which has since been implemented - the risk of unauthorised access and exposure would have been “significantly” reduced.
Ninja Logistics said in a statement that its webpage was not hacked and “there is no evidence that personal data from the previous version of the tracking webpage was scraped or harvested”.
There is a limit on how many times a single user can try to retrieve parcel details and, based on its records, there have been no anomalies in access patterns, the company said.
“We apologise for any distress this incident may have caused and want to reassure our customers and parcel recipients that immediate corrective measures were taken to rectify the matter,” it added.
The company cited changes such as not letting parcels be tracked two weeks after delivery, and removing recipients’ names and signatures from its webpage from mid-October 2019.
Meanwhile, the Singtel breach came to light through an anonymous tip-off to the PDPC in May 2017, which alleged that communications between the app and Singtel’s servers could be manipulated to gain access to other users’ accounts.
Anyone with working knowledge of how a mobile app communicates with servers could have exploited the vulnerability, and the tools needed to do so are available online, the PDPC said in its decision.
“The informant accessed four billing accounts and extracted the customer’s name, billing address, billing account number, mobile phone number as well as customer service plans (including data, talk time and SMS usage),” the PDPC noted.
“While there was no further evidence of unauthorised access, the personal data of approximately 330,000 of the organisation’s customers who were using the mobile app at the material time were put at risk of disclosure.”
The PDPC found that Singtel - which faced a maximum penalty of $1 million - had “failed to put in place reasonable security arrangements” to protect customers’ personal data, although the decision document also said that the PDPC went with a smaller penalty “given that the exploitation of the vulnerability requires some level of technical expertise”.
Singtel had hired a third-party vendor for regular security tests on the mobile app and systems. But the design flaw that led to the latest data breach was not detected - even though a similar vulnerability had been detected and rectified in 2015, two years earlier.
“Despite having received professional advice to take precautions against such vulnerabilities, the organisation omitted to conduct a full code review…and hence failed to discover (the vulnerability) that was exploited in this case,” the PDPC said.
The PDPC noted that the vulnerability “is a relatively basic design issue and well-known security risk that a reasonable person would have considered necessary to detect and prevent”.
It found that Singtel “ought to have been more diligent in performing a thorough assessment” after a similar vulnerability was found in the 2015 security test.
The My Singtel app has since been fixed, and the latest version does not have this design issue, according to the PDPC’s report.
When contacted, a spokesman for Singtel said that the app has been strengthened with “improved data encryption and new standards”.
“Additionally, we conduct frequent third-party penetration tests, and comprehensive security awareness and training programmes for our app development teams, to prevent such incidents from recurring,” she said.
Source: https://www.straitstimes.com/business/companies-markets/singtel-fined-25000-and-ninja-van-90000-for-data-breaches (https://www.straitstimes.com/business/companies-markets/singtel-fined-25000-and-ninja-van-90000-for-data-breaches)
-
Personal data protection in public sector set for overhaul; 3 in 4 agencies found non-compliant with Govt standards
By Low Youjin | 27 November, 2019
SINGAPORE — Personal data protection systems across Singapore’s public sector are set for a significant overhaul after a high-level committee released a report on Wednesday (Nov 27) which found that about three in four agencies fell short of Government standards in at least one area.
The Public Sector Data Security Review Committee – set up in March after a string of data lapses, especially in the healthcare sector – inspected 336 systems across 94 public sector agencies as part of a major review aimed at better protecting Singaporeans’ personal data.
The committee said that about 75 per cent of the agencies had at least one finding of non-compliance with a set of policies that were written to protect and manage government data under their control.
Based on the findings, the committee led by Senior Minister Teo Chee Hean, the Coordinating Minister for National Security and the Minister-in-charge of Public Sector Data Governance, outlined five main recommendations and an action plan.
The Prime Minister’s Office issued a statement on Wednesday stating that Prime Minister Lee Hsien Loong has accepted the recommendations and the timetable for implementing them. The committee submitted its report on Tuesday.
The recommendations include enhancing data protection and preventing data compromise; improving the competencies of public officers to safeguard data securely; being accountable for data protection at every level and reducing the scope for attack by minimising data collection, retention, access and downloads.
Mr Teo said all the relevant recommended measures would be implemented across 80 per cent of government systems by the end of 2021. The other 20 per cent, involving more complex systems or those needing redesign, would be implemented by the end of 2023, he said.
Speaking at a press conference on Wednesday, Mr Teo said the measures will “significantly enhance safeguards and hold officers to account”, and that they are comparable to international and industry best practices.
The committee also included five international and private sector representatives with expertise in data security and technology, as well as four other ministers who are involved in Singapore’s Smart Nation efforts.
Mr Teo said that the committee was satisfied that the recommended measures “would have prevented or mitigated the impact of the past data incidents”.
In the past two years, several data-related incidents in the public sector have made the headlines, such as the SingHealth cyberattack in July 2018, and the disclosure in January this year that a deported American fraudster had leaked the confidential records of 14,200 HIV-positive individuals online.
In light of these high-profile incidents, the committee was formed on March 31 this year when PM Lee called for a comprehensive review of all of Singapore’s 94 public agencies’ systems and data management practices.
RECOMMENDATIONS
1) Enhance data protection and prevent data compromise
A total of 13 technical and 10 process safeguards were proposed for incorporation into information and communications technology and data systems in different combinations, depending on the security risks the agencies are expected to face.
Some of the goals of these safeguards are to reduce the surface areas of attack by minimising data collection, retention, access and downloads; to enhance logging and monitoring to detect high-risk or suspicious activity; and to protect data directly when it is stored and distributed to render it unusable even if extracted.
Beyond these measures, the committee has also recommended, among other things, improving an audit framework to detect gaps in practices and policies before they result in incidents.
2) Enhance detection and response to data incidents
The recommendations to detect and respond to data incidents swiftly and effectively are structured around the following five stages:
- i. Detect: Creating a central contact point for the public to report Government data incidents
- ii. Analyse: Tasking the Government Data Office to monitor and analyse data security incidents that pose significant harm to individuals
- iii. Respond: Appointing the Government IT Management Committee as the central body to respond to large scale incidents
- iv. Remediate: Putting in place a framework for all public agencies to notify individuals who are significantly impacted by data security incidents
- v. Post-incident follow-up: Creating a standard process for post-incident inquiry for all data incidents, and sharing the findings with all agencies
3) Raise competencies, instil culture of excellence
The report states that public officers need to be aware of data security risks when handling citizens’ data, and noted that the recommended safeguards are effective only if they are “well executed” by the officers.
All public officers, including top leadership, will undergo an annual training programme to keep them up to date on data security considerations.
These officers will be made aware of their exact roles and responsibilities when it comes to the management of data security.
The committee also recommended “cultivating an environment conducive to open reporting of data incidents whether major or minor”.
4) Accountability for data protection at every level
Six sub-recommendations in this category include mandating that top leadership be held accountable for their respective organisation’s data security regime, improving the accountability of third-party vendors and improving transparency.
Holding leadership accountable: While individual public officers who mishandle Government data are liable to a fine of up to S$5,000, a jail term of up to two years, or both, the committee noted that no financial penalties or sanctions are imposed on the agencies.
The report states that this is because the monies come from the same public purse.
The committee said a more effective measure would be to hold those in positions of responsibility accountable for their organisations’ effectiveness in maintaining data security. It also recommended taking action against individual officers who allowed data security to be compromised.
Third-party vendor accountability: Tightening the legislation governing the accountability of these vendors becomes more important as the Government works more closely with them to deliver services to the public, said the committee.
To do so, the committee has recommended that the Personal Data Protection Act cover agents of the Government.
This amendment would also include provisions to take non-public officers to task for “recklessly or intentionally” mishandling any personal data.
Improving transparency: To maintain public confidence in the Government’s management of data, the committee has recommended publishing its policies and standards relating to personal data.
The report says this will allow the public to understand the Government’s approach to personal data protection, and the measures in place.
It also recommends publishing an annual update on the Government’s efforts in safeguarding personal data.
5) Ensure sustainability and resilience
While improvements are underway to improve data security in the public sector, the committee said that Singapore should institutionalise such efforts so that “they are sustained and continue to evolve” to address new challenges.
It recommended the appointment of the Digital Government Executive Committee as a high-level Whole-of-Government body to oversee public sector data security.
Chaired by a permanent secretary, it will drive the implementation of the committee’s recommendations.
The committee also recommended setting up the Government Data Security unit in the Government Data office to drive security efforts.
FINDINGS
The inspection covered 336 systems across all 94 public agencies, except for the Pioneer Generation Office. It was renamed the Silver Generation Office and joined the non-Government entity Agency of Integrated Care in April 2018.
A key finding was that about 75 per cent of agencies had one finding on non-compliance with Instruction Manual 8 (IM8), which contains guidelines on data security.
The most common lapses, which informed the recommendations, were in the following areas:
- Privilege user management and monitoring. This refers to the management of user accounts on critical devices and applications.
- User access reviews
- The encryption of emails with highly sensitive data
- Management of production data extraction
The committee also found that 64 per cent of agencies were rated as low risk, while 23 per cent were rated as medium risk.
The remaining 13 per cent were rated as high risk. The committee’s report did not specify which agencies fall under this category.
The committee also found that smaller agencies tend to have smaller information technology teams and lack the resources to implement data security measures.
At the public officer level, the committee also found that not all officers have “internalised the potential impact of their actions” on individuals whose data have been compromised.
IMPLEMENTATION
Mr Teo said that three technical measures have already been implemented in October.
These pertain to data file integrity verification, password protecting and encrypting of files, and an email data protection tool.
He added that the rest of the recommended measures will be implemented in 80 per cent of Government systems by the end of 2021.
In a letter to the committee, PM Lee said that the Government accepts all the recommendations.
“Data is the lifeblood of the digital economy and a digital government,” said Mr Lee.
“We need to use and share data as fully as possible to provide better public services. In doing so, we must also protect the security of the data and preserve the privacy of individuals, and yet not stifle digital innovation.”
Although this applies to every field of government, he said that this is “especially so in healthcare”.
Being the custodians of vast amounts of data, Mr Lee added that the Government must take this responsibility seriously.
While the Government will do its utmost to minimise the risk of data breaches, he said that in the event it occurs, it is crucial to detect such breaches quickly and respond effectively to limit the breach and minimise the harm done.
Source: https://www.todayonline.com/singapore/personal-data-protection-public-sector-set-overhaul-after-high-powered-committee-finds-3-4
Reference (with Video): https://www.channelnewsasia.com/news/singapore/government-improve-data-security-contact-public-report-breaches-12130700
Completion of public sector data security review: To secure and protect citizens’ data [Last updated on 27 Nov 2019]
1. The Public Sector Data Security Review Committee (“the Committee”) was convened on 31 March 2019 to conduct a comprehensive review of data security policies and practices across the Public Service. We have completed the work and have submitted our recommendations to the Prime Minister on 26 November 2019.
2. The Committee was led by Senior Minister Teo Chee Hean, the Coordinating Minister for National Security and the Minister-in-charge of Public Sector Data Governance. The Committee’s Terms of Reference are:
- i. Review how the Government is securing and protecting citizens’ data from end-to-end, including the role of vendors and other authorised non-Government entities;
- ii. Recommend technical measures, processes and capabilities to improve the Government’s protection of citizens’ data, and response to incidents; and
- iii. Develop an action plan of immediate steps and longer-term measures to implement the recommendations.
Approach
3. The Committee notes that the Government has been actively strengthening its data security and cybersecurity. The Government’s data protection standards were first established in 2001. Subsequently the PDPA was enacted in 2012 to govern data protection in the private sector, taking reference from the Government’s standards. In 2018, additional data security provisions were included in the Public Sector Governance Act to strengthen the data security regime.
4. In formulating our recommendations, we:
- Conducted an inspection of 336 systems across 94 agencies to identify data security risks and the common causes of data breaches.
- Studied global and industry best practices, including the practices of the Governments of Canada and the United Kingdom, and companies in the finance and security sectors.
- Reviewed the Government’s data security related legislation and guidelines i.e. Instruction Manual 8 (“IM8”) and Public Sector Governance Act (“PSGA”) against the requirements for private sector organisations in the Personal Data Protection Act (“PDPA”).
- Evaluated whether the proposed recommendations would have prevented or mitigated the impact of past data incidents.
Key Recommendations
5. Based on our findings from the above, we have made five key recommendations as follows:
(http://tralvex.com/download/forum/2019_PSDrTable.gif)
Conclusion
6. We are confident that our recommendations, when implemented, will significantly improve the Government’s data security regime and enhance the public’s confidence in the Government’s data security regime. The recommendations will also make it clear that requirements and standards imposed on the public agencies are no less stringent than what the private sector has to comply with.
7. Mr Lee Fook Sun, Chairman, Ensign Infosecurity, said, “The inspections and stock-take have shown that agencies can be better supported in the implementation of data security measures. The Committee has recommended deploying technical tools more widely, which will ensure consistently high compliance with data security measures across the public sector.”
8. Mr David Gledhill, Senior Advisor, DBS, said, “We conducted a comprehensive review to ensure the recommendations are holistic and are in line with international best practices and industry standards. We are confident that the Committee’s recommendations, if applied then and implemented consistently would have prevented or mitigated the impact of past data incidents.”
9. Mr Ho Wah Lee, Former KPMG Partner, said, “Taking into account the evolving data security risks and the need to share data effectively and securely within the public sector, we have worked closely with the Government to identify areas that can be improved upon, and taken immediate steps to reduce data risks, protect the public’s data better and strengthen the data security regime. With the recommended enhancements to the audit frameworks, the Government should be able to prevent, detect and respond swiftly and effectively to data incidents.”
------
PUBLIC SECTOR DATA SECURITY REVIEW COMMITTEE
27 NOVEMBER 2019
Enclosed (7z file) (http://tralvex.com/download/forum/2019_PSDr.7z):
a. Opening remarks by Senior Minister Teo Chee Hean
b. Public Sector Data Security Review Committee Report
c. Annexes to the Public Sector Data Security Review Committee Report
d. PSDSRC Infographic
For media enquiries, please contact:
Ms Nasrath Hassan
Senior Assistant Director, Adoption and Engagement Directorate
Smart Nation and Digital Government Office, Prime Minister’s Office, Singapore
Mobile: 9001 0050
Email: Nasrath_HASSAN@pmo.gov.sg
Mr Goh Yu Chong
Senior Manager, Adoption and Engagement Directorate
Smart Nation and Digital Government Office, Prime Minister’s Office, Singapore
Mobile: 9644 1674
Email: Goh_Yu_Chong@pmo.gov.sg
About the Public Sector Data Security Review Committee
The Prime Minister convened the Public Sector Data Security Review Committee to review how the Government secures and protects citizens’ data to deliver better services to Singaporeans. This is in view of the increasing complexity of our systems and the evolving data landscape.
The Committee, chaired by Senior Minister and Coordinating Minister for National Security, Mr Teo Chee Hean, was formed on 31 Mar 2019. It included Ministers involved in Singapore’s Smart Nation initiative as well as non-Government members with expertise in data security and technology.
Source: https://www.smartnation.sg/whats-new/press-releases/completion-of-public-sector-data-security-review--to-secure-and-protect-citizens-data
-
Love, Bonito customers' data breached, credit card details exposed, watchdog investigating
Hariz Baharudin | Dec 14, 2019
SINGAPORE - Singapore's privacy watchdog is investigating a data breach involving home-grown fashion label Love, Bonito, after it reported that its online users' data had been compromised.
On Friday (Dec 13), the retailer, which has three stores in Singapore, sent an e-mail to its online customers telling them that the data breach had been confirmed on Tuesday and a malicious code had been added to its e-commerce website.
The malicious code has since been removed.
In the e-mail, Love, Bonito's co-founder Rachel Lim said that based on the company's investigations, some of its customers' personal information may have been exposed, including credit card numbers, expiry dates and CVVs, full names, shipping addresses, order details and phone numbers.
The e-mail did not say how many people were affected by the breach.
Responding to queries from The Straits Times about how it was alerted to the breach, a company spokesman apologised and said that a "small number" of its customers, were affected.
The spokesman later added: "We can confirm that based on Love, Bonito's investigations, approximately 3 per cent of its customers may have had their personal information exposed.
"Out of which, a small number may have had their financial data accessed."
The company was founded in 2010 and has offices in Malaysia and Indonesia. It is not known how many registered online users it has.
The spokesman said: "We took immediate actions to remove the malicious code and further steps to secure our systems. The relevant authorities have been notified, and we are working closely with them and our security vendors to investigate and resolve this matter.
"As the incident is currently under investigation, no further details can be provided."
In response to queries from ST, a spokesman for the Personal Data Protection Commission (PDPC) said that it has been notified of the incident and investigations are ongoing.
According to Miss Lim, her company has engaged a data security expert to conduct a forensic investigation of the incident and to review, audit and enhance its security controls and processes.
In addition to informing the PDPC, she said it has reported the incident to the police.
Love, Bonito is also working with "relevant vendors" to investigate and resolve this matter, but it did not specify who these vendors are.
Miss Lim advised Love, Bonito customers to check their payment card or personal account statements for unauthorised charges and report such charges promptly to their banks.
She also told customers to ensure that two-factor authentication (2FA) has been set up for their credit cards and to notify their bank of any unusual incidents immediately, as well as to request for a credit card replacement.
Source: https://www.asiaone.com/digital/love-bonito-customers-data-breached-credit-card-details-exposed-watchdog-investigating
-
267 million Facebook users IDs and phone numbers exposed online
Paul BischoffTECH WRITER, PRIVACY ADVOCATE AND VPN EXPERT
@pabischoff December 19, 2019
A database containing more than 267 million Facebook user IDs, phone numbers, and names was left exposed on the web for anyone to access without a password or any other authentication.
Comparitech partnered with security researcher Bob Diachenko to uncover the Elasticsearch cluster. Diachenko believes the trove of data is most likely the result of an illegal scraping operation or Facebook API abuse by criminals in Vietnam, according to the evidence.
The information contained in the database could be used to conduct large-scale SMS spam and phishing campaigns, among other threats to end users.
Diachenko immediately notified the internet service provider managing the IP address of the server so that access could be removed. However, Diachenko says the data was also posted to a hacker forum as a download.
Timeline of the exposure
The database was exposed for nearly two weeks before access was removed. Here’s what we know:
- December 4 – The database was first indexed.
- December 12 – The data was posted as a download on a hacker forum.
- December 14 – Diachenko discovered the database and immediately sent an abuse report to the ISP managing the IP address of the server.
- December 19 – The database is now unavailable.
Typically, when we find exposed personal data like this, we take steps to notify the owner of the database. But because we believe this data belongs to a criminal organization, Diachenko went straight to the ISP.
What data was exposed
In total 267,140,436 records were exposed. Most of the affected users were from the United States. Diachenko says all of them seem to be valid. Each contained:
- A unique Facebook ID
- A phone number
- A full name
- A timestamp
(http://tralvex.com/download/forum/201912_Facebook%20Data%20Breach.gif)
The server included a landing page with a login dashboard and welcome note.
Facebook IDs are unique, public numbers associated with specific accounts, which can be used to discern an account’s username and other profile info.
Facebook scraping
How criminals obtained the user IDs and phone numbers isn’t entirely clear. One possibility is that the data was stolen from Facebook’s developer API before the company restricted access to phone numbers in 2018. Facebook’s API is used by app developers to add social context to their applications by accessing users’ profiles, friends list, groups, photos, and event data. Phone numbers were available to third-party developers prior to 2018.
Diachenko says Facebook’s API could also have a security hole that would allow criminals to access user IDs and phone numbers even after access was restricted.
Another possibility is that the data was stolen without using the Facebook API at all, and instead scraped from publicly visible profile pages.
“Scraping” is a term used to describe a process in which automated bots quickly sift through large numbers of web pages, copying data from each one into a database. It’s difficult for Facebook and other social media sites to prevent scraping because they often cannot tell the difference between a legitimate user and a bot. Scraping is against Facebook’s–and most other social networks’–terms of service.
Many people have their Facebook profile visibility settings set to public, which makes scraping them trivial.
This isn’t the first time such a database has been exposed. In September 2019, 419 million records across several databases were exposed. These also included phone numbers and Facebook IDs.
Dangers of exposed data
A database this big is likely to be used for phishing and spam, particularly via SMS. Facebook users should be on the lookout for suspicious text messages. Even if the sender knows your name or some basic information about you, be skeptical of any unsolicited messages.
Facebook users can minimize the chances of their profiles being scraped by strangers by adjusting their account privacy settings:
- Open Facebook and go to **Settings**
- Click **Privacy**
- Set all relevant fields to **Friends** or **Only me**
- Set **”Do you want search engines outside of Facebook to link to your profile** to **No**
This will reduce the chances of your profile being scraped by third parties, but the only way to ensure it never happens again is to completely deactivate or delete your Facebook account.
How and why we discovered this data
Comparitech works with Bob Diachenko to uncover unsecured databases and report them to the public. Our aim is to limit access to and abuse of personal data by malicious parties, and to raise awareness among those affected about the potential risks.
Upon discovering exposed data, Diachenko immediately notifies those responsible so the database can be shut down or secured. We then analyze the leak to identify victims, the duration of the exposure, and any potential threats victims might face.
Previous reports
Comparitech and Diachenko regularly team up to uncover exposed data. Some of our other reports include:
- 2.7 billion exposed email addresses from mostly Chinese domains, 1 million of which included passwords
- Detailed personal records of 188 million people found exposed on the web
- 7 million student records exposed by K12.com
- 5 million personal records belonging to MedicareSupplement.com exposed to public
- 2.8 million CenturyLink customer records exposed
- 700k Choice Hotels customer records leaked
Source: https://www.comparitech.com/blog/information-security/267-million-phone-numbers-exposed-online/
-
Personal data of 2,400 MINDEF, SAF personnel potentially affected; 2 vendors hit by malware
21 Dec 2019
SINGAPORE: The personal data of 2,400 Ministry of Defence (MINDEF) and Singapore Armed Forces (SAF) personnel may be affected by a potential ST Logistics personal data breach.
ST Logistics said in a media release on Saturday (Dec 21) that the potential breach was a result of a recent series of email phishing activities involving malicious malware sent to its employees’ email accounts.
“This data, contained in working files residing in affected workstations, may have been exfiltrated,” it added.
MINDEF said in a statement that preliminary investigations indicate that the personal data could have been leaked.
The affected systems contained full names and NRIC numbers, and a combination of contact numbers, email addresses or residential addresses.
ST Logistics said that it had carried out “extensive forensic investigations” into these activities through its own cyber security team and with the support of external cyber security experts.
The company also added that it informed the Personal Data Protection Commission (PDPC) and the Singapore Computer Emergency Response Team (SingCERT) of the "possible breach" of personal data on Dec 16.
The company operates several logistics services, including an eMart retail and equipping servicefor MINDEF and SAF personnel since 1999.
“In some instances, to ensure that these services are carried out correctly, some personal data is utilised,” it said.
ST Logistics chief executive officer Loganathan Ramasamy said that the company is committed to ensuring that all personal data in the company’s possession is treated with “high standards of integrity”.
“We apologise sincerely for this incident and we owe this to our customers and stakeholders to ensure their personal data is robustly protected,” he added.
DATA OF 98,000 PERSONNEL IN AFFECTED HMI INSTITUTE SERVER
In a separate data incident, the HMI Institute of Health Sciences said that it discovered a file server to be encrypted by ransomware on Dec 4.
The affected server, which primarily contained backup information, was immediately taken offline and isolated from the Internet and internal network, HMI Institute said in a media advisory on Saturday.
The institute added that its learning management system was not impacted and that daily operations were “unaffected and continued as usual”.
Preliminary investigations indicated that the likelihood of a data leak to external parties was low, MINDEF said, adding that the affected system contained personal data of 120,000 individuals.
This included the full names and NRIC numbers of about 98,000 MINDEF and SAF personnel who previously attended a cardiopulmonary resuscitation and automated external defibrillation (AED) course.
The HMI Institute has been contracted by the SAF to conduct CPR and AED training for MINDEF and SAF personnel since 2016.
Data containing full names, NRIC numbers, contact numbers, email addresses, dates of birth and residential addresses of other HMI Institute customers was also affected.
HMI institute data breach notification
A notification received by a full-time national serviceman on Dec 21, 2019.
Upon discovery of the incident, HMI Institute said it immediately engaged a cybersecurity firm to conduct investigations.
The institute said the findings so far show that the likelihood of a data leak was low and that the incident was a “random and opportunistic attack” on the file server.
There was also no evidence that the information had been copied or exported, the institute added.
“We take this incident very seriously and we deeply apologise to the students and applicants affected for the inconvenience caused,” said HMI Institute executive director Mr Tee Soo Kong.
Additional measures to fortify the institute’s systems against increasingly sophisticated cyber intrusions have also been put in place, he added.
HMI Institute said it has reported the incident to the PDPC and SingCert.
It is also currently completing the implementation of additional IT security enhancement initiatives including the establishment of a secured wide-area network and an enhanced cybersecurity protection suite.
Affected students and applicants have been informed via multiple communication channels including emails, letters and face-to-face meetings.
Students and applicants may email or call the institute should they have further enquiries regarding the incident, said the institute.
SECURITY OF SYSTEMS AN "IMPORTANT FACTOR"
MINDEF and the SAF said they take a serious view on the secure handling of personal data by their vendors.
“The security of their IT systems is an important factor that will be taken into account in the award of contracts,” MINDEF said.
MINDEF added that it is also engaging other vendors who hold information of MINDEF and SAF personnel to strengthen the security of their IT systems.
The PDPC is also conducting investigations into both cases, MINDEF said.
In response to the malware incidents, Defence Cyber Chief Brigadier-General Mark Tan said: “The malware incidents affected the IT systems of our vendors. Although MINDEF/SAF’s systems and operations were not affected, the malware incidents in these vendor companies may have compromised the confidentiality of our personnel’s personal data."
He added that MINDEF and the SAF will review the cybersecurity standards of their vendors to ensure that they are able to protect their personnel’s personal data and information.
Affected personnel will be notified from Saturday, said MINDEF.
CNA/zl
Source: https://www.channelnewsasia.com/news/singapore/st-logistics-mindef-saf-2400-personal-data-breach-hmi-institute-12202786
-
Security camera maker Wyze said it left the personal information of 2.4 million customers exposed on the internet for weeks
Tyler Lizenby/CNET
Security camera startup Wyze has confirmed it suffered a data leak this month that may have left the personal information of millions of its customers exposed on the internet. No passwords or financial information were exposed, but email addresses, Wi-Fi network IDs and body metrics were left unprotected from Dec. 4 through Dec. 26, the company said Friday.
More than 2.4 million Wyze customers were affected by the leak, according to cybersecurity firm Twelve Security, which first reported on the leak
The data was accidentally left exposed when it was transferred to a new database to make the data easier to query, but a company employee failed to maintain security protocols during the process, Wyze co-founder Dongsheng Song wrote in a forum post.
"We are still looking into this event to figure out why and how this happened," he wrote.
In an update Sunday, Song said Wyze discovered a second unprotected database during its investigation of the data leak. It's unclear what information was stored in this database, but Song said passwords and personal financial data weren't included.
Keeping sensitive information private continues to be a challenge for database managers. Among this year's more high-profile data leaks were the names, addresses and demographic data of 80 million US households, as well as the expected salaries of more than a million job seekers and thousands of Facebook passwords.
Among the data exposed in the Wyze leak was the height, weight, gender and other health information of about 140 beta users participating in the testing of new hardware, Wyze said.
The company said there was no evidence that login tokens had been exposed but signed out all users to generate new tokens. Customers can also expect their cameras to automatically reboot in the coming days as an additional security action.
Wyze said it takes its product security seriously and will reexamine its procedures.
"This is a clear signal that we need to totally revisit all Wyze security guidelines in all aspects, better communicate those protocols to Wyze employees, and bump up priority for user-requested security features beyond 2-factor authentication," Wyze said.
Wyze representatives didn't respond to a request for additional information and comment.
Source: https://www.cnet.com/news/wyze-data-leak-may-have-exposed-personal-data-for-millions-of-users/
-
Creative Tech, MSIG's service provider, PeopleSearch, 4 other entities penalised for personal data breach
Fri, Jan 10, 2020 | Tay Peck Gek
SEVEN organisations were found in breach of the Personal Data Protection Act (PDPA) and were fined S$90,000 in total penalties. The companies included Creative Technology, MSIG's service provider and a recruitment company that was attacked by ransomware.
Among the seven, Globalsign.in, the email marketing service provider of MSIG Insurance (Singapore) was slapped with the highest penalty, S$34,000 for having its mass emailing system accessed without authorisation in August 2017 and abused to send spam emails to 149,172 MSIG’s customers.
Creative was handed a S$15,000 penalty. The company did not install patches to address a vulnerability in the software used to operate and host an online forum. This resulted in the unauthorised disclosure of personal data of forum users - 484,512 of them whose account information was accessed and extracted in May 2018.
PeopleSearch was a victim of ransomware attack last March. The company offering professional recruitment and staffing services in Asia received a ransom note asking for payment in exchange for the decryption key to the files of 944 individuals' personal information. PeopleSearch admitted that security scans, penetration testing or patching of the server had not been performed for at least 12 months preceding the incident. It was fined S$5,000.
A SAFRA National Service Association employee inadvertently leaked the personal data of 780 shooting club members in September 2018. When he sent out emails to 491 of these members, the emails had attached spreadsheets that included other members' names, National Registration Identity Card (NRIC) numbers, dates of birth, addresses, telephone numbers and email addresses. The association was fined S$10,000.
Society of Tourist Guides (Singapore) had disclosed sensitive information of 111 members in March last year, exposing their NRIC numbers, driving licence and photographs through links on its website. The publicly accessible directories on the website were found to store images of identification documents, which contained data of the affected members including their thumbprints, addresses and dates of issue of the documents. The society was given a S$20,000 penalty.
National Healthcare Group did not restrict access through the Internet to a list of 129 general practitioners (GPs) who had registered to be partner doctors of the organisation. Personal information of five members of public who submitted feedback on the website was also publicly accessible. For this, the organisation has to pay a penalty of S$6,000.
Personal data of seven L’Oreal Singapore customers had been exposed to the risk of unauthorised disclosure, as a result of the company's failure to ensure appropriate testing of its website or make other security arrangements to protect the personal data. The company instructed its vendor to make some changes to the website in November 2018.
However, it failed to scope the user acceptance tests to include the normal functioning of the website, in particular the login and caching functions of the customer login page. This resulted in the personal data of a customer to be cached when he or she logged in, and this data would then be disclosed to customers who subsequently logged in until the next cache refresh. Having considered the representations and taking into account all the relevant circumstances, the Personal Data Protection Commission issued a warning to the company.
Source: https://www.businesstimes.com.sg/companies-markets/creative-tech-msigs-service-provider-peoplesearch-4-other-entities-penalised-for (https://www.businesstimes.com.sg/companies-markets/creative-tech-msigs-service-provider-peoplesearch-4-other-entities-penalised-for)
-
Big Microsoft data breach – 250 million records exposed
22 Jan 2020 | by Paul Ducklin
Microsoft has today announced a data breach that affected one of its customer databases.
The blog article, entitled Access Misconfiguration for Customer Support Databases, admits that between 05 December 2019 and 31 December 2019, a database used for “support case analytics” was effectively visible from the cloud to the world.
Microsoft didn’t give details of how big the database was. However, consumer website Comparitech, which says it discovered the unsecured data online, claims it was to the order of 250 million records containing:
…logs of conversations between Microsoft support agents and customers from all over the world, spanning a 14-year period from 2005 to December 2019.
According to Comparitech, that same data was accessible on five Elasticsearch servers.
The company informed Microsoft, and Microsoft quickly secured the data.
Microsoft’s official statement states that “the vast majority of records were cleared of personal information,” meaning that it used automated tools to look for and remove private data.
However, some private data that was supposed to be redacted was missed and remained visible in the exposed information.
Microsoft didn’t say what type of personal information was involved, or which data fields ended up un-anonymised.
It did, however, give one example of data that would have been left behind: email addresses with spaces added by mistake were not recognised as personal data and therefore escaped anonymisation.
So if your email address were recorded as “name@example.com” your data would have been converted into a harmless form, whereas “name[space]@example.com” (an easy mistake for a support staffer to make when capturing data) would have been left alone.
Microsoft has promised to notify anyone whose data was inadvertently exposed in this way, but didn’t say what percentage of all records were affected.
What to do?
We don’t know how many people were affected or exactly what personal data was opened up for those users.
We also don’t know who else, besides Comparitech, may have noticed in the three weeks it was exposed, although Microsoft says that it “found no malicious use”.
We assume that if you don’t hear from Microsoft, even if you did contact support during the 2005 to 2019 period, then either your data wasn’t in the exposed database, or there wasn’t actually enough in the leaked database to allow anyone, including Microsoft itself, to identify you.
It’s nevertheless possible that crooks will contact you claiming that you *were* in the breach.
They might urge you to take steps to “fix” the problem, such as clicking on a link and logging in “for security reasons”, or to “confirm your account”, or on some other pretext.
Remember: if ever you receive a security alert email, whether you think it is legitimate or not, avoid clicking on any links, calling any numbers or taking any online actions demanded in the email.
Find your own way to the site where you would usually log in, and stay one step ahead of phishing emails!
Source: https://nakedsecurity.sophos.com/2020/01/22/big-microsoft-data-breach-250-million-records-exposed/
Reference: https://msrc-blog.microsoft.com/2020/01/22/access-misconfiguration-for-customer-support-database/
-
Singapore, Malaysia credit card details dumped online in massive data breach
March 07, 2020 | Tashny Sukumaran
Hundreds of thousands of credit card details from at least six Southeast Asian countries – including Malaysia and Singapore – have been leaked online, according to India-based cybersecurity start-up Technisanct (https://www.technisanct.com).
The company said this week it had found a series of data breaches involving credit card details issued by top banks in Singapore, Malaysia, the Philippines, Vietnam, Indonesia and Thailand.
“The results are alarming as it seems no one is aware that such a huge volume of payment card details – including the CVV and PIN – are available,” said CEO Nandakishore Harikumar, referring to the card verification value and personal identification number.
Anyone with access to those details could cause financial losses to the owner of the cards, he added.
Technisanct said its research found that credit card holders in the Philippine were the worst hit, with 172,828 cards breached, while Malaysia and Singapore had 37,145 and 25,290 cards breached respectively.
According to Nandakishore, in the past week his team had identified even more cards available for sale from these six countries. Although many systems required a one-time transaction password, there were portals that did not require this, he said.
Nandakishore said he had emailed the Computer Emergency Response Team (CERT) – which handles cybersecurity incidents – in each country and advised them to take action, although not all had responded.
In Malaysia, both Cybersecurity Malaysia and the central bank, which regulates financial institutions, declined to comment.
CIMB Group Holdings – allegedly one of the affected banks – said it had “no credible evidence that any actionable customer data has been compromised from us”.
“CIMB takes data privacy and protection seriously and has taken the necessary security measures to ensure all customers’ personal information remain secured. We continuously monitor all avenues to ensure that our customer data remains protected where possible,” a spokesperson said.
This Week in Asia understands the CERTs of both Vietnam and Malaysia are investigating the matter.
Meanwhile, the Monetary Authority of Singapore said it was constantly monitoring cyber threats, including cyberattacks that may result in payment card fraud, as part of its surveillance.
“We note that security vendors have reported a rise in incidents of data theft internationally, including loss of card details from compromised e-commerce websites,” a spokesperson said, adding that it had strict requirements for financial institutions in Singapore to implement information technology controls to protect sensitive information from unauthorised disclosure.
“Card issuers have well established processes to handle credit cards whose details have been leaked. Card issuers have also put in place real time fraud monitoring to detect and block suspicious transactions promptly,” the MAS said.
Southeast Asian countries have been hit by growing cybercrime including high-profile data breaches.
Last year, subsidiaries of Indonesian low-cost airline Lion Air suffered a massive data breach, resulting in the information of millions of passengers – including passport details, home addresses and phone numbers – being leaked onto data exchange forums.
In 2018, the details of millions of mobile service subscribers in Malaysia were leaked online, while popular beauty products retailer Sephora revealed online accounts of residents of Hong Kong, Singapore and Malaysia were compromised by a data leak.
Singapore has been the target of several data leaks, including a widely-reported incident where the confidential information of over 14,000 people diagnosed with HIV was leaked online and another where personal data of 1.5 million patients of SingHealth’s specialist clinics – including Prime Minister Lee Hsien Loong – was compromised.
Source: https://www.asiaone.com/singapore/singapore-malaysia-credit-card-details-dumped-online-massive-data-breach
-
Indonesia's Tokopedia probes alleged data leak of 15 million users
May 3, 2020 | Fanny Potkin
SINGAPORE (Reuters) - Tokopedia, Indonesia’s largest e-commerce platform, said on Saturday it was investigating claims that the details of millions of its users had been leaked online by a hacker.
“We found that there had been an attempt to steal data from Tokopedia users,” a spokesman for the company said in a statement. “However, Tokopedia ensures that crucial information such as passwords remains successfully protected behind encryption.”
“At this moment, we continue to investigate further into this matter and there is no additional information that we can share,” the statement added.
Data breach monitoring service Under the Breach published a Twitter post on Saturday showing screenshots from an unnamed individual who claimed he had acquired the personal details of 15 million Tokopedia users during a March 2020 hack on the e-commerce site.
According to the screenshots, which show names, emails and birthdays, the hacker alleges he or she is in possession of a much bigger user database and asks for assistance to “crack” users’ passwords.
Backed by $2 billion in funding from investors including SoftBank Group Corp’s Vision Fund and Alibaba, Tokopedia, whose founder and CEO William Tanuwijaya is one of the country’s most prominent tech entrepreneurs, claims more than 90 million monthly active users.
The spokesman declined to comment on details of the allegations in the screenshots. Under the Breach was not immediately reachable for comment.
Source: https://in.reuters.com/article/us-tokopedia-cyber/indonesias-tokopedia-probes-alleged-data-leak-of-15-million-users-idINKBN22E0Q2
-
Common framework to safeguard citizens' personal data set up
May 1, 2020 | Lester Wong
The public will now be able to whistleblow on suspected data breaches by government agencies under a common framework to safeguard citizens' personal data.
It is among the first set of recommendations by the Public Sector Data Security Review Committee being rolled out after a spate of breaches over the last two years.
The common framework will replace current practices being followed by public agencies, many of which have devised the protocols themselves.
Yesterday, the Smart Nation and Digital Government Office (SNDGO) said: "(The new measures) will improve accountability and transparency of the public sector data security regime, and enhance the Government's effectiveness in responding to incidents promptly, and notifying affected individuals in the event of a data incident."
The committee was convened by Prime Minister Lee Hsien Loong in March last year following a spate of cyber-security breaches, including the SingHealth incident in which hackers stole the data of 1.5 million patients and the outpatient prescription information of 160,000 people in June 2018.
In the spirit of transparency, the Government's approach to data security is also published on the Smart Nation website. Annual reports highlighting efforts to continually improve data security standards will be made available to the public on the site.
Meanwhile, members of the public can flag unauthorised disclosures of government data by completing a form on the Smart Nation website.
"The Smart Nation and Digital Government Group will work with the public and the relevant public sector agency or agencies involved to investigate the suspected data incident, and take remedial steps to address any confirmed data incident in a timely manner," the spokesman said.
Other recommendations implemented this month include clarifying the roles and responsibilities of public officers involved in managing data security, and mandating that top public sector leadership be accountable for putting in place a strong organisational data security regime.
The SNDGO said that efforts are on track to implement the committee's recommendations where relevant in 80 per cent of government systems by the end of next year.
The rest will follow by the end of 2023 as some systems will require significant redesign.
Other new measures include encrypting sensitive files, and hiding away in a separate system with tighter controls highly sensitive information about individuals, such as their HIV status. The personal information of ministers and other important people will also be kept in separate systems with more stringent protection.
Source: https://www.straitstimes.com/singapore/common-framework-to-safeguard-citizens-personal-data-set-up
-
Hack Brief: An Adult Cam Site Exposed 10.88 Billion Records
CAM4 has taken the server offline, but not before it leaked 7TB of user data.
It’s all too common for companies to leave databases chock full of sensitive information exposed to the great wide internet. But when that company operates an adult livestreaming service, and that data comprises 7 terabytes of names, sexual orientations, payment logs, and email and chat transcripts—across 10.88 billion records in all—the stakes are a bit higher.
The site is CAM4, a popular adult platform that advertises “free live sex cams.” As part of a search on the Shodan engine for unsecured databases, security review site Safety Detectives found that CAM4 had misconfigured an ElasticSearch production database so that it was easy to find and view heaps of personally identifiable information, as well as corporate details like fraud and spam detection logs.
“Leaving their production server publicly exposed without any password,” says Safety Detectives researcher Anurag Sen, whose team discovered the leak, “it’s really dangerous to the users and to the company.”
The Hack
First of all, very important distinction here: There’s no evidence that CAM4 was hacked, or that the database was accessed by malicious actors. That doesn’t mean it wasn’t, but this is not an Ashley Madison–style meltdown. It’s the difference between leaving the bank vault door wide open (bad) and robbers actually stealing the money (much worse).
"The team concluded without any doubt that absolutely no personally identifiable information, including names, addresses, emails, IP addresses or financial data, was improperly accessed by anyone outside the SafetyDetectives firm and CAM4’s company investigators," the company said in a statement.
The company also says that the actual number of people who could have been identified was much smaller than the eye-popping number of exposed records. Payment and payout information could have exposed 93 people—a mix of performers and customers—had a breach occurred, says Kevin Krieg, technical director of Smart-X, which manages the CAM4 database. Safety Detectives put the number at "a few hundred."
The mistake CAM4 made is also not unique. ElasticSearch server goofs have been the cause of countless high-profile data leaks. What typically happens: They’re intended for internal use only, but someone makes a configuration error that leaves it online with no password protection. “It’s a really common experience for me to see a lot of exposed ElasticSearch instances,” says security consultant Bob Diachenko, who has a long history of finding exposed databases. “The only surprise that came out of this is the data that is exposed this time.”
And there’s the rub. The list of data that CAM4 leaked is alarmingly comprehensive. The production logs Safety Detectives found date back to March 16 of this year; in addition to the categories of information mentioned above, they also included country of origin, sign-up dates, device information, language preferences, user names, hashed passwords, and email correspondence between users and the company.
Out of the 10.88 billion records the researchers found, 11 million contained email addresses, while another 26,392,701 had password hashes for both CAM4 users and website systems.
"The server in question was a log aggregation server from a bunch of different sources, but server was considered non-confidential," says Krieg. "The 93 records got into the logs due to a mistake by a developer who was looking to debug an issue, but accidentally logged those records when an error happened to that log file."
Who’s Affected?
It’s hard to say exactly, but the Safety Detectives analysis suggests that roughly 6.6 million US users of CAM4 were part of the leak, along with 5.4 million in Brazil, 4.9 million in Italy, and 4.2 million in France. It’s unclear to what extent the leak impacted both performers and customers.
Again, there’s no indication that bad actors tapped into all those terabytes of data. And Sen says that CAM4's parent company, Granity Entertainment, took the problematic server offline within a half hour of being contacted by the researchers. That doesn’t excuse the initial error, but at least the response was swift.
Moreover, despite the sensitive nature of the site and the data involved, it was actually fairly difficult to connect specific pieces of information to real names. “You really have to dig into the logs to find tokens or anything that would connect you to the real person or anything that would reveal his or her identity,” says Diachenko. “It should not have been exposed online, of course, but I would say it’s not the scariest thing that I’ve seen.”
How Bad Is It?
Which is not to say that everything’s totally fine. If anyone were to have done that digging, they could have found out enough about a person—including sexual preferences—to potentially blackmail them. On a more mundane level, CAM4 users who reuse their passwords would be at immediate risk for credential stuffing attacks, potentially exposing any accounts where they don’t use strong, unique credentials.
Or consider the inverse: If you have the email address of a CAM4 user, Sen says, there’s a decent chance you can find an associated password from a previous data breach, and break into their account.
The data in the leak could have potentially put CAM4 at risk, as well; privileged fraud and spam detection information would have given potential attackers a road map for how to get around those defenses.
Krieg says that the CAM4 has already taken steps to prevent a repeat of the data leak. "It’s a server that should not have an outward facing IP in the first place," he says. "We’re going to be moving it to our internal LAN to make it a lot harder for people to get access to this type of server, while making sure that nothing is on it that should not be on it, which includes any personally identifiable information."
Data leaks happen. They’re not as bad as breaches, but with information this sensitive, the onus is on companies to take every precaution to protect it—not the bare minimum.
This story has been updated to include a statement from CAM4 and comments from Kevin Krieg of Smart-X.
Source: https://www.wired.com/story/cam4-adult-cam-data-leak-7tb/
-
US Marshals says prisoners’ personal information taken in data breach
Zack Whittaker@zackwhittaker / May 9, 2020
Justice Department Inspector General Releases Report On Investigation Into FISA Warrant Process During The 2016 Election
A data breach at the U.S. Marshals Service exposed the personal information of current and former prisoners, TechCrunch has learned.
A letter sent to those affected, and obtained by TechCrunch, said the Justice Department notified the U.S. Marshals on December 30, 2019 of a data breach affecting a public-facing server storing personal information on current and former prisoners in its custody. The letter said the breach may have included their address, date of birth and Social Security number, which can be used for identity fraud.
But the notice didn’t say how many current and former prisoners are affected by the breach.
As the law enforcement arm of the federal courts, U.S. Marshals are tasked with capturing fugitives and serving federal arrest warrants. Last year, U.S. Marshals arrested more than 90,000 fugitives and served over 105,000 warrants.
A spokesperson for the Justice Department did not respond to a request for comment by email or phone.
It’s the latest federal government security lapse in recent weeks.
The Defense Information Systems Agency, a Dept. of Defense division charged with providing technology and communications support to the U.S. government — including the president and other senior officials — said a data breach between May and July 2019 resulted in the theft of employees’ personal information.
Last month, the Small Business Administration admitted that 8,000 applicants, who applied for an emergency loan after facing financial difficulties because of the coronavirus pandemic, had their data exposed.
Source: https://techcrunch.com/2020/05/08/us-marshals-prisoner-data-breach
-
New TraceTogether token to have no GPS or internet connectivity to track user’s whereabouts: Vivian Balakrishnan
Raj Nadarajan | 08 June, 2020
SINGAPORE — The portable contact-tracing device that the Government is developing will not record its user’s location data and will not have Global Positioning System (GPS) or mobile internet connectivity, the Minister-in-charge of the Smart Nation initiative Vivian Balakrishnan said.
He also said that the Bluetooth proximity data collected by this device will be encrypted in the device, is auto-erased after 25 days. It will be extracted only if the user is infected by Covid-19.
Dr Balakrishnan was speaking during a media briefing on Monday (June 8 ) held by the governmental task force tackling the Covid-19 pandemic.
The first batch of these devices, which will be named the TraceTogether token, will be delivered in the later half of this month and progressively distributed to Singapore households, he added.
In a statement on Monday, Smart Nation and Digital Government Group (SNDGG), which is the Government-led initiative behind the application, said that the token will be a standalone device that functions in “the same way" that the TraceTogether mobile application does — by using Bluetooth signals to record other nearby TraceTogether devices.
The token has no GPS, which means the device does not capture geolocation data and only proximity data. “This means a person cannot be tracked, and no one will know where the person has been,” it added.
If a user is infected with Covid-19, the data from the token would then be extracted by authorised contact tracers from the Ministry of Health. SNDGG added that only a “small number of personnel have access to the data for contact tracing purposes”.
Dr Balakrishnan also gave the assurance that there will not be “one, big, giant central database” that will hold the data collected by these tokens, adding that since the tokens do not have internet connectivity, users’ data cannot be extracted without their knowledge.
“Even the finite silos of data that are uploaded are protected by the public sector data security recommendations. All the officers involved are covered by the Official Secrets Act and we will continue to audit and make sure no data leakage occurs,” Dr Balakrishnan said.
“We will continue to test the devices and test our systems… and also reassure people that we are getting the balance right between defending public health and protecting personal privacy. I believe it is possible to protect both.”
Dr Balakrishnan had said in Parliament last Friday that the Government was developing and would soon roll out a portable wearable device that will achieve the same objective as the TraceTogether mobile app.
He said that unlike the app, this device will not depend on the need for users to possess a smartphone, adding that if this portable device works, the Government might then distribute it to everyone in Singapore.
PROBLEMS WITH APPLE DEVICES
Dr Balakrishnan had noted on Friday that aside from the fact that not everyone has a smartphone, there were other issues with the TraceTogether app, which has so far been downloaded 1.5 million times or by about 25 per cent of the population.
It does not appear to work as well on Apple devices because the iOS operating system suspends Bluetooth scanning when the app is running in the background, he said.
“We’ve had repeated discussions both at the technical and policy level with Apple, but we have not yet been able to find a satisfactory solution.”
Over the weekend, some Singaporeans raised concerns about privacy issues related to the wearable device.
A petition titled “Singapore says 'No' to wearable devices for Covid-19 contact tracing” has since gathered more than 32,000 signatures.
The Singapore People’s Party released a statement on Sunday (June 7) expressing its concerns about the risk as well, that the data collected may be abused. It said that the pandemic does not justify the need for a wearable contact tracing device and that the Government should select more “proportionate measures”.
Source: https://www.todayonline.com/singapore/tracetogether-token-has-no-gps-or-internet-connectivity-track-users-whereabouts-vivian (https://www.todayonline.com/singapore/tracetogether-token-has-no-gps-or-internet-connectivity-track-users-whereabouts-vivian)
Reference: OpenTrace source codes (Kotlin, TypeScript, Swift) in Github, https://github.com/opentrace-community (https://github.com/opentrace-community)
-
Fake Malicious Mobile Applications Imitating Contact-Tracing Applications
12 Jun 2020
Many countries are implementing contact tracing applications as they progressively move out of their lockdown phase. Threat actors are capitalising on such implementations to conduct malicious activities through fake mobile applications that imitate official COVID-19 contact tracing applications. These fake applications are usually embedded with trojans or malware that, when executed, could be used to monitor user's activities on the device and/or steal their personal data.
Users are recommended to adopt the following measures to avoid downloading fake and malicious applications to your mobile devices:
- Only download applications from the official Play Store (Android) and App Store (iOS).
- Check the developer information on the application listing. Only download applications developed and listed by the official developer.
- Pay attention to the security permissions required by the application and/or its privacy policy before downloading. Be wary of applications that ask for unnecessary permissions on your device.
- Look through the application’s reviews, and be wary of poorly-reviewed applications. Multiple poor reviews or comments may be an indication of issues with the application.
Users who have downloaded applications from unofficial sources are recommended to delete them, and perform an anti-virus scan on their device(s) thereafter. In the event that users are unable to delete the application after it has been installed, they may wish to perform a factory reset on their device(s) to try to remove it. Users are reminded to do a backup of important data from the device(s) before proceeding to perform the factory reset.
References:
https://www.csa.gov.sg/gosafeonline/go-safe-for-me/homeinternetusers/android-mobile-security-what-you-need-to-know-about-malicious-apps
https://support.tracetogether.gov.sg/hc/en-sg/articles/360050057093-10-June-2020-Android-APKs-impersonating-TraceTogether
https://www.anomali.com/blog/anomali-threat-research-identifies-fake-covid-19-contact-tracing-apps-used-to-monitor-devices-steal-personal-data
***
Source: https://www.csa.gov.sg/singcert/advisories/ad-2020-004
Additional Reference: https://www.facebook.com/GovTechSG/photos/a.411947277510/10156998483617511
-
IT giant Cognizant confirms data breach after ransomware attack
Lawrence Abrams | June 17, 2020
In a series of data breach notifications, IT services giant Cognizant has stated that unencrypted data was most likely accessed and stolen during an April Maze Ransomware attack.
Cognizant is one of the largest IT managed services company in the world with close to 300,000 employees and over $15 billion in revenue.
As a managed service provider (MSP), Cognizant remotely manages many of its clients to fix issues, install patches, and monitor their security.
On April 17th, Cognizant began emailing their clients to warn them that they were under attack by the Maze Ransomware so that they could disconnect themselves from Cognizant and protect themselves from possibly being affected.
This email also contained indicators of compromise that included IP addresses utilized by Maze and file hashes for the kepstl32.dll, memes.tmp, and maze.dll files. These IP addresses and files are known to be used in previous attacks by the Maze ransomware actors.
While Cognizant stated that it was an attack by Maze, the Maze operators told BleepingComputer at the time that they weren't behind the attack.
Unencrypted data most likely were stolen
In two data breach notification letters [1, 2] filed with the Office of the Attorney General of California, Cognizant states that the Maze Ransomware operators were active on Cognizant's network between April 9th and the 11th.
During the time they had access, they "likely exfiltrated a limited amount of data from Cognizant’s systems."
Before deploying ransomware and encrypting devices, the Maze Ransomware operators will first spread laterally through the network and steal unencrypted files.
These stolen files are then used as an extortion tactic by threatening to publicly release the data on the Maze data leak site if the victim does not pay the ransom.
In the data breach notifications, Cognizant warned sensitive personal information such as SSN, Tax IDs, financial information, and driver's licenses, and passports may have been stolen.
"We have determined that the personal information involved in this incident included your name and one or more of: your Social Security number and/or other tax identification number, financial account information, driver’s license information, and/or passport information," the Cognizant customer data breach notification stated.
For employees who have corporate credit cards, Cognizant warned that they were likely exposed during the attack.
"The majority of the personal information that was impacted was information relating to our corporate credit cards. Out of an abundance of caution, we are giving notice to all associates who have an active corporate credit card. All associates who have an active corporate credit card will be offered credit and identity theft monitoring services from ID Experts"
For those affected, Cognizant is providing a free year of ID theft and dark web monitoring.
BleepingComputer suggests that victims utilize this free offer to detect and prevent threat actors from using the stolen information to open credit card accounts, bank accounts, or perform other identity theft.
Source: https://www.bleepingcomputer.com/news/security/it-giant-cognizant-confirms-data-breach-after-ransomware-attack/
Reference 1: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/
Reference 2: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Reference 3: https://www.tripwire.com/state-of-security/featured/maze-ransomware-what-you-need-to-know/
-
Hackers Leaked 269 GB of U.S. Police and Fusion Centers Data Online
June 22, 2020 | Swati Khandelwal
A group of hacktivists and transparency advocates has published a massive 269 GB of data allegedly stolen from more than 200 police departments, fusion centers, and other law enforcement agencies across the United States.
Dubbed BlueLeaks, the exposed data leaked by the DDoSecrets group contains hundreds of thousands of sensitive documents from the past ten years with official and personal information.
DDoSecrets, or Distributed Denial of Secrets, is a transparency collective similar to WikiLeaks, which publicly publishes data and classified information submitted by leakers and hackers while claiming the organization itself never gets involved in the exfiltration of data.
According to the hacktivist group, BlueLeaks dump includes "police and FBI reports, bulletins, guides and more," which "provides unique insights into law enforcement and a wide array of government activities, including thousands of documents mentioning COVID19.
As you can see in the screenshot below, a quick analysis of the BlueLeaks dump shows the data contains over millions of files including images, documents, videos, web pages, text files, emails, audio files, and more, though it's yet to be investigated how many files are classified and are not supposed to be public.
Some alerts and guides leaked in BlueLeaks also contained intelligence on the protests, including the recent countrywide Black Lives Matter protests in the U.S. following the death of George Floyd at the time he was in the custody of Minneapolis police.
(http://edusg.us/images/20200624_fbi-data-leak.jpg)
Some of the U.S. agencies listed in BlueLeaks are:- Alabama Fusion Center
- Austin Regional Intelligence Center
- Boston Regional Intelligence Center
- Colorado Information Analysis Center
- California Narcotic Officers' Association
- Delaware Information and Analysis Center
- FBI Houston Citizens Academy Alumni Association
- FBI National Academy Association Arkansas/Missouri Chapter
- FBI National Academy Association Michigan Chapter
- FBI National Academy Association of Texas
It appears that the source of this massive data stems from a security breach at Houston-based web hosting company 'Netsential Inc,' where the webserver for National Fusion Center Association (NFCA) is hosted, security blogger Krebs reported.
Fusion centers are basically information centers that enable intelligence sharing between local, state, tribal, territorial law enforcement and federal agencies, maximizing their ability to detect, prevent, investigate, and respond to criminal and terrorist activities.
In a statement, NFCA confirmed Krebs that the "dates of the files in the leak actually span nearly 24 years — from August 1996 through June 19, 2020 — and that the documents include names, email addresses, phone numbers, PDF documents, images, and a large number of text, video, CSV and ZIP files."
Netsential confirmed that a threat actor had leveraged a compromised Netsential customer user account and the web platform's upload feature and exfiltrated other Netsential customer data, including several U.S. police agencies, including Fusion Centers.
Netsential is the same web hosting company that was previously abused by attackers to infect targeted victims with ransomware by sending spoofed spear-phishing emails disguised as NFCA.
Source: https://thehackernews.com/2020/06/law-enforcement-data-breach.html
-
Personal details of more than 3,000 people in Singapore leaked online
July 01, 2020 | David Sun
(http://edusg.us/images/2020701_scamm.jpg)
The scam features a celeb in the victim's location, like Bryan Wong in Singapore, saying he or she had made a fortune on a cryptocurrency investment platform.
GROUP-IB
The personal records of 3,499 people in Singapore have been leaked online, and they are being targeted in a bitcoin scam. The records, which include names, phone numbers and e-mail addresses, were discovered by Singapore-based cyber security company Group-IB recently.
In a release yesterday, it said the records were part of a larger haul comprising the records of almost 250,000 people.
Most are from Britain, tallying more than 147,000 records, while the rest are from Australia, South Africa, the US, Singapore, Malaysia, Spain and other countries.
The source of the leak and how the details were stolen are unknown.
The leaked details are being used by scammers, who send victims text messages disguised as being from recognised media outlets with an enticing headline and a link.
Sample messages acquired by Group-IB researchers showed the headline would usually feature a celebrity relevant to the victim's location, such as Bryan Wong in Singapore or Chris Brown in the US.
Those who click the link are taken to a fake news site featuring celebrities saying they made a fortune on a new cryptocurrency investment platform.
Clicking any link in the article takes victims to the scam bitcoin investment platform website.
The Group-IB team found the scam platform used the names Crypto Cash, Bitcoin Rejoin, Bitcoin Supreme and Banking on Blockchain.
Mr Ilya Sachkov, chief executive and founder of Group-IB, warned that the elaborate nature of the scheme showed that cyber criminals were getting more sophisticated.
"Bitcoin investment scams have been around for a while and we regularly detect new instances of crypto fraud," he said.
"This time, however, the scheme was significantly upgraded, and a tremendous amount of personal information was leaked. The bad guys got smarter in a bid to increase the success rate of their fraudulent operations."
Group-IB said one should be wary of long redirect chains and double check the domain name before entering personal data on a site.
In response to the leak, a spokesman for the Cyber Security Agency of Singapore said members of public should stay vigilant and warned that scammers will use topics of high interest to lure victims.
"These could take the form of investments that promise high returns, General Election-related news, or threats to freeze their online accounts," she said.
"(Members of public) should not disclose personal or financial details, make transfers or follow any instructions to install apps or log into their banking accounts."
Source: https://www.asiaone.com/singapore/personal-details-more-3000-people-singapore-leaked-online
-
(http://edusg.us/images/20200822_SDA-CenturySquare.jpg)
"This was reluctantly shared by the owner of a store in Century Square as he initially wanted to avoid any implication from the authorities, thinking this could be an one-off incident.
However, this Social distancing officer got too bossy and nosey by coming every other day to disturb the staffs, terrorizing to take photos and write reports if they breach any measures. He claimed that the staffs must stand 1-metre apart when serving customers.
When staff requested him to scan SafeEntry before entering store, he always simply replied he’s not required becos he’s Social distancing officer..
In this video, the staff is under duress to polish his “Tiffany Platinum” for him.. didn’t even bother to ask properly.
On another occasion, the staffs shared that he even asks the staff if he could get his ears pierced for free and he will close one eye if he sees something amiss.
Hope relevant authorities can look into the conduct of such officer to prevent further abuse of authority.
Mothership.sg
CNA
Stomp
Enterprise Singapore
Source: https://www.facebook.com/SGAROOO/posts/3600535369965964 (https://www.facebook.com/SGAROOO/posts/3600535369965964)
Reference 1: https://mothership.sg/2020/08/century-square-safe-distancing-officer/ (https://mothership.sg/2020/08/century-square-safe-distancing-officer/)
Reference 2: https://www.asiaone.com/singapore/sda-fired-after-unprofessional-behaviour-soliciting-favours-store-esg (https://www.asiaone.com/singapore/sda-fired-after-unprofessional-behaviour-soliciting-favours-store-esg)
-
Scoot: No data breach in e-mails mistakenly sent for Guangzhou flight
Aug 25, 2020 | Fiona Lam
SCOOT on Tuesday clarified that an e-mail meant for passengers booked on flight TR100 from Singapore to Guangzhou was mistakenly sent to other customers who were not on the flight.
TR100 is scheduled to depart Singapore on Aug 30 at 5.15am. The e-mail was meant to inform passengers about new travel requirements for the flight.
A spokesperson for the airline said in a statement that Scoot is investigating the matter and will provide an update on the findings when possible.
"For now, it has been established that there was no data breach or leak of personal information," said the budget arm of Singapore Airlines.
The spokesperson added that "many" individuals received the e-mail erroneously, although it did not specify a number.
Source: https://www.businesstimes.com.sg/companies-markets/scoot-no-data-breach-in-e-mails-mistakenly-sent-for-guangzhou-flight (https://www.businesstimes.com.sg/companies-markets/scoot-no-data-breach-in-e-mails-mistakenly-sent-for-guangzhou-flight)
Sample Email:
(http://edusg.us/images/20200825_Scoot-email.gif)
-
Instagram account outed for posting voyeuristic photos of pregnant women in Singapore
August 28, 2020 | Ilyas Sholihyn
An Instagram account sharing only pictures of pregnant women in Singapore who didn't seem to know that their photos were being taken and uploaded online has been outed.
With over 5,000 followers, the Instagram account holds over 5,600 posts of random women in public, including on the MRT, in shopping malls or even on the streets. While most of the photos are of expecting women in Singapore, some posts appear to have been taken overseas, including Hong Kong.
Aside from the common thread of clearly pregnant women throughout the posts, the pictures shared appear to be hastily taken and without the subject’s knowledge.
Some of the women also appear as if they realised their photo was being surreptitiously taken, judging from their direct gaze into the lens.
Furthermore, it seems the photographer takes multiple shots of the women each time.
A woman took to Facebook yesterday (Aug 27) to urge others to make a police report about the Instagram account, which remains public and active as of writing.
The account follows 326 other Instagram profiles that revolve around pregnancy and maternity, including other similar accounts that exclusively post pictures of expectant mothers.
According to Singapore Legal Advice, this does not constitute a breach of the Personal Data Protection Act (PDPA) as the person who took the photos did so in their personal capacity in a public area.
Those who had their picture taken and published without consent are advised to request the other party to remove the photo.
”Should that party not comply with your request and/or should you seek compensation from him as well, you may then consider taking legal action,” Singapore Legal Advice posted.
AsiaOne has reached out to the administrator behind the Instagram account.
Source: https://www.asiaone.com/digital/instagram-account-outed-posting-voyeuristic-photos-pregnant-women-singapore (https://www.asiaone.com/digital/instagram-account-outed-posting-voyeuristic-photos-pregnant-women-singapore)
-
Razer Data Leak: Over 100,000 Gamers' Personal Information Exposed Due to Server Misconfiguration
A server misconfiguration exposed customers' data including phone number and email address to be easily accessible to hackers
Krishnendu Banerjee | September 13, 2020
The gaming peripheral company Razer suffered a data leak that exposed over 100,000 customers' personal information. The leak affected customers who purchased Razer products from its website before September 9, 2020.
The information contained customers' names, phone numbers, email and shipping addresses, order and billing details. Razer is a popular Singapore-American gaming hardware company that manufactures peripherals such as mice, keyboards, gaming products and laptops.
Unprotected Server
Security researcher Volodymyr Diachenko on August 19 first noticed the issue and immediately contacted the company's support team. After a few back and forth emails, Razer fixed the issue on September 9, saying that it was a result of a misconfigured server which led to information being easily accessible. However, the customer information was exposed for nearly a month and the impacted number could be higher than 100,000.
"The exact number of affected customers is yet to be assessed as originally it was part of a large log chunk stored on a company's Elasticsearch cluster misconfigured for public access since August 18, 2020 and indexed by public search engines. Based on the number of the emails exposed, I would estimate the total number of affected customers to be around 100K," Diachenko said.
(http://edusg.us/images/202009_razer-data-leak.jpg)
Thousands of customers' data were exposed LinkedIn/ Volodymyr Diachenko
After Diachenko took it to LinkedIn, Razer responded with a statement, saying that the server misconfiguration was fixed and customers' financial details such as credit/ debit or passwords were not exposed.
"We were made aware by Mr. Volodymyr of a server misconfiguration that potentially exposed order details, customer and shipping information. No other sensitive data such as credit card numbers or passwords was exposed. The server misconfiguration has been fixed on 9 Sept, prior to the lapse being made public," said Hung Wei Goh, Razer's Global Marketing Director in a statement.
Should You Worry?
For people who purchased any product directly from the Razer website between August 18 and September 9, their data might have been exposed. Cybercriminals can use personal information to target customers through a phishing attack. Scammers can pose as Razer or someone related to the company and send malicious emails or texts to steal data that could include banking information, BleepingComputer reported.
If you have purchased Razer products from its website, be alert. If you receive mails or texts from Razer, be sure to check directly on the company website. Don't click on any link from that may be suspicious.
This is not the first time Razer has come in the news for all the wrong reasons. In 2019, a security vulnerability was found in Razer laptops. It could have allowed "attackers to safeguard rootkits with Intel Boot Guard, downgrade the BIOS to exploit older vulnerabilities such as Meltdown, and many other things." A patch was released to fix the security flaw only after two weeks and during that time, many laptops would have been exposed to cyberattacks.
Source: https://www.ibtimes.sg/razer-data-leak-over-100000-gamers-personal-information-exposed-due-server-misconfiguration-51456 (https://www.ibtimes.sg/razer-data-leak-over-100000-gamers-personal-information-exposed-due-server-misconfiguration-51456)
Cache: https://archive.fo/OKCqr (https://archive.fo/OKCqr)
Gaming firm Razer wins lawsuit against IT vendor over data leak, awarded $8.7m in damages
The damages awarded comprised largely US$6.1 million in loss of profits from Razer’s e-commerce platform.
Selina Lum | 9 December 2022
SINGAPORE - Gaming hardware company Razer has won its lawsuit against an IT vendor over a data leak, and was awarded US$6.5 million (S$8.7 million) in damages by the High Court on Friday.
Shipping information and order details of thousands of customers worldwide were leaked in a widely reported cyber-security breach in September 2020. The gaming firm, which is dual-headquartered in Singapore and the United States, sued the vendor, Capgemini, in the same year over the breach.
The damages awarded comprised largely US$6.1 million in loss of profits from Razer’s e-commerce platform.
The amount awarded also included about US$60,000 that Razer paid for a forensic expert to investigate the incident, about US$320,000 to engage a law firm to deal with regulators, and a US$2,000 payment to cyber-security consultant Bob Diachenko, who discovered the breach.
The dispute arose over the misconfiguration of a server file, which in turn led to the data leak.
Razer, represented by Mr Wendell Wong and Mr Andrew Chua of Drew & Napier, said the misconfiguration occurred during a 16-minute window on June 18, 2020.
Razer said former Capgemini employee Argel Cabalag, who was tasked to do troubleshooting after Razer staff could not log in to the system, was the only one who accessed the server during the 16-minute window.
Razer said Mr Cabalag added a “#” command to a configuration file that controlled security to a computer application. This misconfiguration allowed unauthenticated access into the application.
Capgemini, represented by Senior Counsel Andre Yeap of Rajah & Tann, said its employee did not cause the misconfiguration and suggested that new IP addresses set up by Razer could have been the cause.
However, on the sixth day of trial, Mr Cabalag admitted that he had been the one who caused the misconfiguration.
In a written judgment, Justice Lee Seiu Kin found that Mr Cabalag’s assistance on the login problem fell within the scope of work set out in an April 2020 agreement between the parties.
The judge said Capgemini had breached its contractual obligations to Razer and had also been negligent in its response to Razer’s login problem.
Source: https://www.straitstimes.com/singapore/courts-crime/gaming-firm-razer-wins-lawsuit-against-it-vendor-over-data-leak-awarded-87m-in-damages
Archive: https://archive.vn/aFe1Z
-
Over $150M Drained in KuCoin Crypto Exchange Hack
Sep 26, 2020 | Ada Hui, Wolfie Zhao
Over $150 million of an Asian cryptocurrency exchange’s funds have been compromised in a security breach.
The Singapore-headquartered digital asset exchange KuCoin said in a statement that it detected large withdrawals of bitcoin (BTC) and ethereum (ETH) tokens to an unknown wallet beginning at 19:05 UTC time on Friday.
In a live stream on 4:30 UTC time Saturday, KuCoin CEO Johnny Lyu said that one or more hackers obtained the private keys to the exchange’s hot wallets. KuCoin transferred what was left in them to new hot wallets, abandoned the old ones and froze customer deposits and withdrawals, Lyu said.
KuCoin’s cold wallets were unaffected, Lyu claimed. Cold cryptocurrency wallets are not connected to the Internet and are considered more secure than hot cryptocurrency wallets.
In an updated statement on its website, KuCoin released a list of BTC, bitcoin SV (BSV), ETH, LTC, XRP, Stellar lumens (XLM), Tron (TRX) and Tether (USDT) wallet addresses where the stolen funds were transferred.
Two Ethereum wallets belonging to KuCoin have sent more than 11,480 ETH, which currently trades at a price of about $350, to the Ethereum wallet address (https://etherscan.io/address/eb31973e0febf3e3d7058234a5ebbae1ab4b8c23) associated with the hack, according to data from blockchain explorer Etherscan.
The Ethereum wallet address has also received over 150 Ethereum-based tokens worth more than $150 million from the two KuCoin Ethereum wallets, Etherscan’s data shows.
The other identified wallets have received exactly 14,713 BSV (https://blockchair.com/bitcoin-sv/address/15mC7zKbLyErSKzGRHpy6gyqS7GyRpWjEi), 26,733 LTC (https://blockchair.com/litecoin/address/LQtFoidy5TmLrPP77MZzgMRffqPsmRfMXE), 18,495,798 XRP (https://blockchair.com/ripple/account/r3mZvvHVLPtRWAujzBsAoXqH11jhwQZvzY) and 999,160 USDT (https://blockchair.com/bitcoin/address/1NRsEQRg5EjmJHbPUX7YADVPcPzCQBkyU7), along with over 1,008 BTC (https://blockchair.com/bitcoin/address/1NRsEQRg5EjmJHbPUX7YADVPcPzCQBkyU7), 9,588,383 XLM (https://blockchair.com/stellar/account/GBM3PJWNB5VKNOFXCDTTNXPMUNBMYTLAAPYDIIKLHUGMKX7ZGN2FNGFU), and 199,038,936 TRX (https://tronscan.org/#/address/TB3j1gUXaLXXq2bstiSMfjQ9R7Yh9DdDgK), according to blockchain explorers Blockchair and Tronscan.
The cryptocurrencies are trading around roughly $10,700 per BTC, $165 per BSV, $45 per LTC, $0.25 per XRP, $0.07 per XLM, $0.02 per TRX and $1 per USDT, as of writing.
Tether and several cryptocurrency exchanges such as Bitfinex have blacklisted the wallet addresses, according to the updated statement.
Over 200 cryptocurrency assets trade on KuCoin with a combined daily average volume of around $100 million, ranking it as one of the busiest trading exchanges, according to the cryptocurrency data site CoinGecko.
The price of KuCoin’s exchange token KCS fell by 14% to $0.86 within an hour on Saturday as news of the security breach spread on social media.
KuCoin is investigating the hack with international law enforcement and stolen customer money will be “covered completely” by an insurance fund, Lyu said.
UPDATE (Sept. 27, 2020, 1:00 UTC): Addresses and balances for cryptocurrency wallets associated with KuCoin’s hack have been added.
Source: https://www.coindesk.com/hackers-drain-kucoin-crypto-exchanges-funds (https://www.coindesk.com/hackers-drain-kucoin-crypto-exchanges-funds)
---------------------------------------
The Latest Updates About the KuCoin Security Incident——Continually Updated
2020/09/26 | Updated at 16:20 on September 27, 2020 (UTC+8)
Dear KuCoin Users,
In response to this incident, our internal audit and related handling process is proceeding in order. We will continuously update the progress of the incident in this announcement.
The latest updates:
- Add BTC suspicious addresses:
12FACbewf5Fy9nmeaLQtm6Ugo5WS8g2Hay
1TYyommJW3uhjhcnHhUSuTQFqSBAxBDPV
- Orion Protocol has announced that they have reissued ORN via a token swap.
Relevant information:
https://twitter.com/orion_protocol/status/1309919891445690369 (https://twitter.com/orion_protocol/status/1309919891445690369)
- Covesting has announced that they have frozen the COV tokens that were transferred to the suspicious address.
Relevant information:
https://twitter.com/covesting/status/1310103008152350725 (https://twitter.com/covesting/status/1310103008152350725)
- KardiaChain has announced that the new KAI takes place today.
Relevant information:
https://twitter.com/KardiaChain/status/1310096090788589568 (https://twitter.com/KardiaChain/status/1310096090788589568)
Bitfinex CTO Paolo Ardoino confirmed that Tether has successfully frozen a total of 22,000,000 USDT.
Relevant information:
https://twitter.com/paoloardoino/status/1309771801581494272 (https://twitter.com/paoloardoino/status/1309771801581494272)
https://twitter.com/paoloardoino/status/1309850765398245376 (https://twitter.com/paoloardoino/status/1309850765398245376)
https://twitter.com/paoloardoino/status/1309856162146377729 (https://twitter.com/paoloardoino/status/1309856162146377729)
- Project Partners
At the same time, we have been in touch with related project partners and will work closely with them to resolve this incident. We will keep you updated with the details.
Velo Labs has announced that they will re-deploy and replace each of the VELO tokens that were transferred to the suspicious address. The VELO tokens affected will be invalidated.
Relevant information:
https://twitter.com/veloprotocol/status/1309850056489488384 (https://twitter.com/veloprotocol/status/1309850056489488384)
VIDT_Datalink has announced that they will freeze the VIDT tokens that were transferred to the suspicious address.
Relevant information:
https://twitter.com/VIDT_Datalink/status/1309880082337615872 (https://twitter.com/VIDT_Datalink/status/1309880082337615872)
Silent Notary has announced that they will re-issue new SNTR, and replace all affected tokens.
Relevant information:
https://twitter.com/SilentNotary/status/1309876794372354050 (https://twitter.com/SilentNotary/status/1309876794372354050)
The currently suspicious addresses are as following (continuously updated):
ETH: 0xeb31973e0febf3e3d7058234a5ebbae1ab4b8c23
BTC: 1NRsEQRg5EjmJHbPUX7YADVPcPzCQBkyU7
LTC: LQtFoidy5TmLrPP77MZzgMRffqPsmRfMXE
XRP: r3mZvvHVLPtRWAujzBsAoXqH11jhwQZvzY
BCHSV: 15mC7zKbLyErSKzGRHpy6gyqS7GyRpWjEi
XLM: GBM3PJWNB5VKNOFXCDTTNXPMUNBMYTLAAPYDIIKLHUGMKX7ZGN2FNGFU
USDT: 1NRsEQRg5EjmJHbPUX7YADVPcPzCQBkyU7
TRX: TB3j1gUXaLXXq2bstiSMfjQ9R7Yh9DdDgK
- Partners
Meanwhile, KuCoin has been in touch with our partners, thanks for their support!
At 12:30 (UTC+8) on September 26, 2020, KuCoin Global CEO Johnny Lyu hosted a livestream and announced more updates regarding the incident. Read the transcript here.
We sincerely appreciate your support!
The KuCoin Team
Source: https://www.kucoin.com/news/en-the-latest-updates-about-the-kucoin-security-incident (https://www.kucoin.com/news/en-the-latest-updates-about-the-kucoin-security-incident)
-
Judge overturns decision and finds woman defamed doctor in making sexual allegations, but says doctor has 'no moral victory'
Lydia Lam | 02 Oct 2020
SINGAPORE: A doctor who sued a woman for claiming he and another doctor colluded to take sexual advantage of patients won a legal victory on Friday (Oct 2) but had no moral victory, a judge said.
Justice See Kee Oon overturned a lower court decision, and found that the woman had defamed Dr Julian Ong Kian Peng in saying that he colluded with another doctor, Dr Chan Herng Nieng, to take advantage of "other vulnerable woman patients".
Dr Ong runs a private practice at Mount Elizabeth Novena Hospital, while Dr Chan is a former senior consultant of psychiatry at Singapore General Hospital.
Ms Serene Tiong, a business development manager at Thomson Medical Centre, had alleged that the two doctors exchanged with each other potential patients and colleagues who could be easily taken advantage of.
The judge on Friday allowed Dr Ong's appeal against a lower court's decision to exonerate Ms Tiong of defamation, and Dr Ong will now have a claim for libel and an injunction against Ms Tiong.
Ms Tiong was also ordered to pay Dr Ong costs of S$40,000 for court proceedings. Separate damages for defamation will be assessed at a later date in the lower court.
Justice See said Ms Tiong failed to prove her defence of justification, as she did not prove that the two doctors colluded to take sexual advantage of more than one "vulnerable woman patient".
For a defence of justification to stand in defamation, the person making the allegedly defamatory remarks must prove that what they said was true.
Even though the judge found that a woman named only as K was indeed a target and a vulnerable patient, no other such patients were named. The judge also rejected Ms Tiong's claim to be one of the vulnerable patients, as there was no proof of when she became Dr Chan's patient, and she had been having an affair with him years before taking any medicine from him.
Even if Ms Tiong was Dr Chan's patient all along, she had never complained at any time of being vulnerable or taken advantage of, until she found Dr Chan's "surreptitious" messages in April 2018 and realised she was not Dr Chan's exclusive lover.
There was no evidence that more than one woman, who was a vulnerable patient of either of the doctors, was targeted, said the judge.
"It is not open to the court to speculate that because one patient was targeted, there must be others in the past or that there will be others in the future."
NO MORAL VICTORY
However, despite granting Dr Ong his claim for defamation, Justice See stressed that he cannot say the doctors are fully vindicated.
"What they did with their sexual partners outside of their roles is entirely their choice," he said.
"But they do not have any reason to hold their heads high. For there is no moral victory that they ... can hold claim to."
He said that while he recognised that Dr Ong was forced to claim litigation to protect his reputation, he had to have his private sex life in full view of the courtroom.
Lewd messages exchanged between Dr Ong and Dr Chan, in which they discussed sexual conquests with women, using terms such as "sluts" to label them, were shown in court and reported about.
WhatsApp messages between the two doctors include texts where Dr Ong told Dr Chan to "feel free to play your game" and made a reference to anal sex with the patient. He also shared a patient's contact with Dr Chan and egged him on to meet her.
"No doubt, the messages (were) in exchange between friends ... but it is often only in private messages, when (one's) guard is down, that true colours reveal themselves," said the judge.
To protect his reputation, Dr Ong had "been forced to come clean" on repeatedly cheating on his spouse, he added, while Dr Chan admitted making inappropriate touches in the past.
The two doctors' "smug boasts" of their trysts with women speak to their true character, said Justice See.
"They may be competent doctors and their sex lives are of course private matters, but their blatant treatment of women as sex objects sullies whatever professional reputations they have built up for themselves."
The Singapore Medical Council said in June that a committee it appointed found that conditions had to be imposed on both doctors' medical practitioner licences, for public safety and in the public's interest.
For 18 months from Jun 18 or until disciplinary proceedings against them conclude, Dr Ong cannot contact female patients other than for medical purposes. If he has to, a clinic employee has to do so on his behalf unless there are certain conditions.
He is also not allowed to send personal data of his patients to others unless required by medical practice or by law.
Dr Chan was given the same conditions, with an additional condition: He must record his contact with any female patients in a separate log if he has to contact them for psychiatric care, or if he is taking a call from them or their family members relating to psychiatric care or treatment.
Ong was also suspended from practising at Gleneagles, Mount Elizabeth, Mount Elizabeth Novena and Parkway East Hospitals, said a filing on the Singapore Exchange in April.
However, he was still allowed to practise at heartland centres by medical service group HC Surgical Specialists.
Source: https://www.channelnewsasia.com/news/singapore/julian-ong-serene-tiong-defamed-doctor-judge-overturns-decision-13178276
-
A hacker is selling details of 142 million MGM hotel guests on the dark web
The MGM Resorts 2019 data breach is much larger than initially reported.
Catalin Cimpanu | July 14, 2020
The MGM Resorts 2019 data breach is much larger than initially reported, and is now believed to have impacted more than 142 million hotel guests, and not just the 10.6 million that ZDNet initially reported back in February 2020.
The new finding came to light over the weekend after a hacker put up for sale the hotel's data in an ad published on a dark web cybercrime marketplace.
According to the ad, the hacker is selling the details of 142,479,937 MGM hotel guests for a price just over $2,900.
(http://edusg.us/images/202010_mgm-empire_$2939.gif)
The hacker claims to have obtained the hotel's data after they breached DataViper, a data leak monitoring service operated by Night Lion Security.
Vinny Troia, founder of Night Lion Security, told ZDNet in a phone call that his company never owned a copy of the full MGM database and that the hackers are merely trying to ruin his company's reputation.
MGM says it notified all impacted users
Reached out for comment on Sunday, MGM Reports issued a statement claiming they were aware of the scope of the breach.
The MGM breach occurred in the summer of 2019 when a hacker gained access to one of the hotel's cloud servers and stole information on the hotel's past guests.
MGM learned of the incident last year, but never made the security breach public, but notified impacted customers, according to local data breach notification laws.
The security breach came to light in February 2020 after a batch of 10.6 million MGM hotel guests' data was offered as a free download on a hacking forum. At the time, MGM admitted to suffering a security breach, but the company didn't disclose the full breadth of the intrusion.
"MGM Resorts was aware of the scope of this previously reported incident from last summer and has already addressed the situation," an MGM spokesperson told ZDNet in an email today, referring to the company's efforts to notify impacted users.
An MGM spokesperson also pointed out that "the vast majority of data consisted of contact information like names, postal addresses, and email addresses."
Financial information, ID or Social Security numbers, and reservation (hotel stay) details were not included, MGM said in February, which ZDNet is able to confirm after reviewing two different batches of MGM data -- the 10.6 million user records leaked in February and a newer 20 million batch shared by the hackers on Sunday.
Dates of birth and phone numbers were also included, which is how we were able to confirm the breach in the first place, by contacting past hotel guests.
Bigger than 142 million?
However, the MGM data could be even bigger than the 142 million count we have today.
Irina Nesterovsky, Head of Research at threat intel firm KELA, told ZDNet back in February that the MGM data had been circulating and was being sold in private hacking circles since at least July 2019.
Posts on Russian-speaking hacking forums promoted the MGM data breach as containing details on more than 200 million hotel guests.
Source: https://www.zdnet.com/article/a-hacker-is-selling-details-of-142-million-mgm-hotel-guests-on-the-dark-web/ (https://www.zdnet.com/article/a-hacker-is-selling-details-of-142-million-mgm-hotel-guests-on-the-dark-web/)
-
Parliament: Proposed changes to PDPA include stiffer fines for data breaches, mandatory notification when they occur
Oct 5, 2020 | Lester Wong
SINGAPORE - A company found guilty of a data breach can be fined up to 10 per cent of its annual turnover in Singapore, under a change in the law that protects personal data,
The stiffer fine, however, will be imposed only on companies with an annual turnover that exceeds $10 million. Currently, the maximum a company can be fined for a data breach is $1 million.
The proposed amendment to the Personal Data Protection Act (PDPA) was introduced in Parliament on Monday (Oct 5) by Minister for Communications and Information S. Iswaran to strengthen data protection standards and enforcement.
Other prospective changes include making it mandatory for organisations to notify the Personal Data Protection Commission (PDPC) of data breaches that are likely to harm the affected individuals.
Also, it is mandatory that they notify those affected so that they can take steps to protect themselves where possible, like changing their passwords or cancelling their credit cards.
The Bill not only seeks to give consumers greater confidence and assurance about the way their personal data is safeguarded, but also how its use is being enabled in a responsible way in Singapore's economy, said Mr Iswaran.
"Key to this are the requirements in terms of the accountability... of enterprises or other entities who are collecting information for its use, and the enforcement measures and other tools available to regulators to ensure compliance," he added.
"We also want to give businesses greater certainty as to what they need to do to ensure that they are meeting their obligations... and in the event that an incident were to occur, what measures and steps they need to take."
The Personal Data Protection (Amendment) Bill, which was among four Bills introduced in Parliament on Monday, also allows organisations to collect, use or disclose personal data without the consent of individuals in circumstances classified as "legitimate interests".
Such situations include using the data from security cameras or other Internet of Things devices to help in investigations or legal proceedings, or to recover/pay a debt.
Under the Bill, consumers must also be allowed to opt out of having their personal data used by companies, such as e-commerce platforms Amazon and Shopee, to recommend specified items.
Such recommendation engines typically analyse customers' browsing habits or previous purchases, for example, to automatically suggest items the customers could be more likely to buy.
Source: https://www.straitstimes.com/politics/parliament-proposed-changes-in-law-include-stiffer-fines-for-data-breaches-mandatory
-
Samsung Pay’s new privacy policy reveals your data may have been sold
January 23rd, 2020
Earlier this year, Samsung was forced by the California Consumer Privacy Act (CCPA) to rethink its privacy policies and, as a result, a new toggle was added in Samsung Pay, as discovered by XDA-Developers. The toggle gives users the option of disabling the selling of personal data to Samsung Pay partners. It’s a most welcomed addition, but at the same time, it’s a worrying turn of events because it reveals that Samsung may have already sold your personal data before the CCPA came into effect.
Not only that but the company’s Customization Service, to which most Galaxy device owners have agreed, seems to contain similar, troubling caveats as the Samsung Pay policy.
What personal information may have been sold by Samsung?
According to Samsung’s updated Privacy Policy for Samsung Pay, the company may have sold the following categories of personal information over the 12-month period prior to the effective date of the CCPA. The categories Samsung refers to include cookies, beacons, mobile ad identifiers, pixel tags, internet protocol addresses and more.
Other categories include commercial information, Internet browsing history, search history, information regarding your interaction with websites and a whole lot more. You can hit this link and check Samsung’s official Privacy Policy for Samsung Pay for additional details.
The page also includes information on the disclosure of personal information for business purposes. Samsung doesn’t outright claim that it sold this kind of data, only that it may have disclosed it to vendors. The list includes identifiers ranging from real names to bank account numbers, credit card numbers, and other financial information, or audio, electronic, visual and similar information, whatever that may imply.
(http://edusg.us/images/SamsungPay_DoNotSell.jpg)
Samsung’s Customization Service may be doing similar things with your data
The aforementioned toggle in Samsung Pay was added after the CCPA was implemented, and it’s unclear whether the policy changes are valid for all Samsung Pay users around the world, or only for USA/California residents. Nevertheless, even if you live outside of the United States, Samsung may still share your personal data with third parties even if you don’t use the mobile payment platform.
Samsung’s Customization Service – to which most Galaxy users agree upon setting up a Samsung account – is designed to collect information about your use of Samsung’s services – and third-party websites and apps – across your devices in order to deliver customized services tailored to your interest.
The Customization Service policy sounds more benign than the updated privacy policy for Samsung Pay – especially for Android smartphone users who should be used to the idea that Google is collecting their information for its own ad-delivery purposes. However, unlike Google’s policy for Android, Samsung’s policy still claims that it shares information about your online activities.
It also states that where required by applicable law, we will obtain your consent for the processing of your personal information for direct marketing purposes. This may suggest that, in some countries with fewer/weaker privacy laws, Samsung may be processing your personal information without your consent.
You can opt out of Samsung’s Customization Service
Fortunately, if you’re not a fan of the idea that Samsung may be collecting your data, you can choose to disable Customization Services on your Samsung account, and there’s also a way to request the deletion of existing information that’s been previously collected and analyzed.
As mentioned above, Android smartphone users are generally aware that Google collects personal information for its own ad-delivery purposes. However, Samsung’s policies seem a bit more open for interpretation, as they reveal that personal data can and may have been shared with third parties. For some users, this might make a world of difference, while for others it may not mean much.
How do you feel about these recent events, or the issue of privacy, in general? Share your thoughts in the comment section.
Source: https://www.sammobile.com/news/samsung-pay-new-privacy-policy-your-data-sold/
-
Docsketch says an unauthorized third-party accessed a three-week old copy of its database.
Catalin Cimpanu | Catalin Cimpanu
Electronic document-signing service Docsketch is notifying customers about a security breach that took place over the past summer.
In an email sent to customers and seen by ZDNet, the company said that an unauthorized third-party gained access to a copy of its database in early August this year.
The database file contained a snapshot of the Docsketch service dated July 9, 2020, the company said.
"This database contained contact information and form fields related to documents filled out by users and users' recipients," said Docsketch founder Ruben Gamez.
Gamez said the intruder(s) didn't access the documents themselves, but they could read what information users filed inside the documents -- such as names, signatures, personal data, and even payment card details, where required.
In addition, the database also contained login information and user contacts (persons asked to fill in documents).
Passwords were also included, but Docsketch said the password strings were salted and hashed. However, Gamez didn't elaborate on the complexity and security of the salting and hashing mechanism, some of which can be cracked under certain conditions to reveal the original plaintext passwords.
Docsketch is now notifying customers who it believes were affected. In case users believe they entered personal or financial details inside Docsketch-hosted documents, the company has provided additional steps users can take to protect themselves.
Gamez said Docsketch has already secured its system and updated its infrastructure following the August intrusion.
"We're still working out the details but rest assured this is our top priority and we're going to continue making significant security and infrastructure updates," Gamez said.
Source: https://www.zdnet.com/article/document-signing-service-docsketch-discloses-security-breach/
-
Leaked camera footage from S'pore homes sold online: Change passwords to deter hacking
Change your passwords now.
Tanya Ong | Belmont Lay | October 12, 2020
(http://edusg.us/images/202010%20IP%20Camera.jpg)
If you use security cameras at home in Singapore, you might want to unplug them or at least change your passwords.
Security cameras footage hacked and leaked
Footage from security cameras used in homes in Singapore have reportedly been hacked and leaked online, with a massive stash put up for sale by hackers with future access also bundled in the package.
The footage appears to be from Internet Protocol (IP) cameras.
These cameras are frequently installed at home for security purposes and to remotely monitor family members, domestic workers and pets.
But hacked footage have since been uploaded onto pornographic sites, with some of the videos showing scenes that are recognisably from Singapore homes featuring people in compromising positions, such as having sex, changing, or using the bathroom, as well as lounging in the privacy of one's home.
Hackers teaching people how to access footage for a fee
The New Paper reported a group dedicated to hacking IP cameras was behind the hacks.
The group supposedly has almost 1,000 members across the globe and operate on social messaging platform Discord.
The group claims members can access more than 50,000 hacked cameras.
Footage supposedly stems from Singapore, Thailand, South Korea and Canada.
Members get lifetime access after paying a subscription fee of US$150 (S$203).
VIP members will be taught how to "explore, watch live and even record" hacked cameras through tutorials and personalised sessions, the group claimed.
Thousands of clips
As of Oct. 10, the group claimed to have shared more than 3TB of clips with over 70 members.
Some 4,000 videos and pictures from the hacked footage is provided free as a sampler.
But hacking is a very broad term that can sometimes be done using the most innocuous means.
This is so as hacking into such cameras can be as simple as logging into the devices using the default manufacturer password that users are advised to change upon installation at home, but failing to do so.
The usernames might have been retrieved using slightly more sophisticated means, such as retrieving the log from unsecured servers.
Not all footage appear real
Some of the footage supposedly from Internet Protocol (IP) cameras have been circulating on pornography sites after being uploaded by multiple users.
From the footage uploaded online, many are described to be "hacked" footage or footage from IP cameras.
However, it is not entirely obvious that all of the footage are real in the sense they feature people being exposed without their own knowledge.
A close inspection of seven videos do show interiors of homes that look like those found in Singapore.
Some of the videos explicitly claim that the people featured are "Singaporeans" or are tagged "Singapore".
But in one video that appears to be real, a HDB flat layout is instantly recognisable.
It showed the home's interior configuration where the bathroom is located within the kitchen.
One video accompanied by audio had people speaking in Singlish.
One woman said: "Close the door!"
The other replied: "Never mind lah."
In the videos, women of different ages can be seen with their faces exposed.
They are captured in their living rooms, using the bathroom, or changing in their bedrooms.
Some appear in their underwear, or half naked.
An O-level 10-year series book used by students preparing for the exam is seen in one video dated March 2020.
The authenticity of the clips cannot be verified as some of the videos might be posed or deliberate.
The date range of the footage, according to the time stamp, varies.
The most recent footage appears to be as recent as July 2020.
Some of the footage are old, with one from June 2019.
Change passwords
The Singapore police said the public should make a police report if they are aware of anyone engaging in activities, such as accessing the cameras of others or putting the footage online for sale or otherwise.
The public are advised to take precautions to secure their IP cameras:
- Use an IP camera from a trusted brand offering reliable security features
- Update the software for the IP camera as soon as it is available
- Use a strong password, and change it regularly
- Do not use the default password that came with the IP camera
Source: https://mothership.sg/2020/10/hacked-camera-footage-singapore-leaked (https://mothership.sg/2020/10/hacked-camera-footage-singapore-leaked)
Reference: https://www.tnp.sg/news/singapore/hackers-hawk-explicit-videos-taken-spore-home-cams (https://www.tnp.sg/news/singapore/hackers-hawk-explicit-videos-taken-spore-home-cams)
Reference (2014): https://www.asiaone.com/digital/over-700-webcam-feeds-singapore-leaked-online (https://www.asiaone.com/digital/over-700-webcam-feeds-singapore-leaked-online)
(http://edusg.us/images/202010%20IP%20Camera%20Porno%20Website.jpg)
Singapore home cams hacked and stolen footage sold on pornographic sites
Clips from the hacked footage were uploaded on pornographic sites, with several explicitly tagged as being from Singapore.
12 Oct 2020 | David Sun
SINGAPORE (THE NEW PAPER) - Security cameras in Singapore homes have been hacked, and the footage shared online.
Clips from the hacked footage were uploaded on pornographic sites recently, with several explicitly tagged as being from Singapore.
The videos, which can last from under a minute to more than 20 minutes, feature couples, breastfeeding mothers and even children.
Most of them were in various stages of undress or compromising positions.
Many faces could be clearly seen in different areas of the home such as the living room and bedroom. Some were seen using the toilet with the door ajar.
In one video, time-stamped March 2020, a teenage girl could be seen clad in a white T-shirt and her underwear, with school books around her. Among them was an
O-level 10-Year Series book used by students preparing for the exam.
In many of the videos, which were tagged as being from Singapore, the layout of the homes were typical of a Housing Board flat.
The footage appeared to be from Internet Protocol (IP) cameras common in homes in Singapore. They are installed for security purposes or to remotely monitor children, the elderly, domestic workers and pets.
On closer inspection of the videos, it is apparent that a a group dedicated to hacking IP cameras was behind the hacking. The group, which can be found on social messaging platform Discord, has almost 1,000 members across the globe.
As of Saturday, members of the Discord chat claim to have shared more than 3TB of clips with over 70 members, who paid a subscription fee of US$150 (S$203) for lifetime access to them.
The victims appear to be from various countries, including Thailand, South Korea and Canada. A 700MB "sample", containing about 4,000 videos and pictures from hacked footage, is provided free.
A significant portion of the clips seemed to be from IP cameras in Singapore.
The group claims to have a list of more than 50,000 hacked cameras that members can access. It also claims that VIP members will be taught how to "explore, watch live and even record" hacked cameras through tutorials and personalised sessions.
Mr Clement Lee, the solution architect for Asia-Pacific for Check Point Software Technologies, said many IP cameras are at risk, as they are typically installed to be accessed remotely via the Internet.
"Hacking of IP cameras is possible if they are accessible from a central cloud service or exposed to the Internet," he said.
"Usually, it is the result of poor password management."
He advises those with such cameras at home to ensure that their software is up to date and to avoid using simple passwords.
"Never assume your camera is secure," he said. "The best way to avoid falling victim to hackers is to avoid sharing personal details online."
Criminal lawyer James Ow Yong said that anyone who hacks such cameras will run afoul of the law even if they are outside Singapore.
"The Computer Misuse Act has extra-jurisdictional reach, and applies as long as either the accused was in Singapore, or the computer, program or data was in Singapore at the time of the offence," he said.
Those who share or watch such videos can be prosecuted for offences relating to voyeurism.
He added: "Where the victim is under the age of 16, the material may be considered child pornography, and such offences attract a higher range of sentences.
"We also know that international and regional outfits like Interpol are quite active in finding such offenders."
Mr Ow Yong said those who distribute or sell child pornography can be jailed for up to seven years, fined and or caned.
Those who advertise or seek such material can be jailed for up to five years, fined and or caned.
A police spokesman said the public should make a police report if they are aware of anyone engaging in such activities.
TAKE PRECAUTIONS
The public are advised to take these precautions to secure their IP cameras:
- Use an IP camera from a trusted brand offering reliable security features;
- Update the software for the IP camera as soon as it is available; and
- Use a strong password, and change it regularly. Do not use the default password that came with the IP camera.
Source: https://www.straitstimes.com/singapore/singapore-home-cams-hacked-and-stolen-footage-sold-on-pornographic-sites
-
Couple 'fooling around' in Lido cinema given warning, action taken against staff who leaked video: Shaw Theatres
Cherlynn Ngmail | Posted on 27 October 2020
This story was submitted via Web contribution form.
A couple was caught behaving inappropriately in a cinema at Shaw Theatres Lido and CCTV footage of the incident was sent to Stomp.
Stomper M, who identified herself as a friend of a Shaw Theatres employee, said the incident occurred on October 15, at around 8.15pm.
M said: "My friend saw this couple though the CCTV during one movie. The woman was straddling her partner and moving up and down.
"I feel disgusted that people will do this in public."
In a 17-second video that M shared with Stomp, a man can be seen seated with a woman on his lap. The woman is seen moving her hips.
No other cinema-goers are seen seated around the couple.
In response to a Stomp query, a spokesman for Shaw Theatres said: "Once aware of the incident taking place, the manager went into the hall and issued a warning to the couple to stop behaving inappropriately (they were fooling around and were fully clothed)."
According to the spokesman, the couple complied and exited without further incident at the end of the movie screening.
He added: "Shaw Theatres does not condone such behaviour and requests that our patrons respect our cinemas for their intended purpose of film appreciation and entertainment.
"Shaw Theatres has taken disciplinary actions against the staff who made and disseminated the unauthorised recording."
Stomp will not be uploading the video due to its inappropriate nature.
Source: https://stomp.straitstimes.com/singapore-seen/couple-fooling-around-in-lido-cinema-given-warning-action-taken-against-staff-who
-
Lazada suffers data breach; personal information from 1.1 million RedMart accounts for sale online
By Jeraldine Yap | 30 Oct 2020
SINGAPORE: Personal information from 1.1 million RedMart accounts was stolen from e-commerce platform Lazada and sold online in a data breach.
A Lazada spokesperson confirmed this to CNA on Friday (Oct 30).
CNA had earlier come across an online forum which was purportedly selling personal data from various e-commerce sites around the world, including Lazada.
The site claimed to have information like names, phone numbers and partial credit card numbers from about 1.1 million users.
(http://edusg.us/images/202010%20Lazada%20Raidforums.jpg)
Screengrab of the online forum which is purportedly selling personal data from various e-commerce sites around the world, including Lazada.
"Our cybersecurity team discovered an individual claiming to be in possession of a RedMart customer database taken from a legacy RedMart system no longer in use by the company," a spokesperson from Lazada said in a statement referring to the online supermarket platform it acquired in 2016.
Lazada added the information stolen was last updated in March 2019, and the affected RedMart-only database is not linked to any Lazada database.
"This RedMart-only information is more than 18 months out of date and not linked to any Lazada database. The user information that was illegally accessed include names, phone numbers, email and mailing addresses, encrypted passwords and partial credit card numbers. We have taken immediate action to block unauthorised access to the database."
(http://edusg.us/images/202010%20Lazada%200bin.net.jpg)
Lazada is currently investigating the data breach, and has informed the Personal Data Protection Commission of the breach.
"We have taken immediate action to block unauthorised access to the database," the Lazada spokesperson said.
A spokesperson for the Personal Data Protection Commission said it was aware of the incident and was looking into the matter.
Lazada said it was in the process of reaching out to all affected customers, and reminding them to change their log-in credentials as a safety precaution.
It added: “Protecting the data and privacy of our customers is a top priority, and we are working swiftly to resolve this."
Source: https://www.channelnewsasia.com/news/singapore/lazada-redmart-data-breach-personal-information-millions-account-13415688 (https://www.channelnewsasia.com/news/singapore/lazada-redmart-data-breach-personal-information-millions-account-13415688)
Reference 1: https://raidforums.com/Thread-SELLING-Exclusive-Private-Databases--113273 (https://raidforums.com/Thread-SELLING-Exclusive-Private-Databases--113273)
Cache 1: https://archive.vn/wip/rP2zN (https://archive.vn/wip/rP2zN)
Reference 2: https://0bin.net/paste/jcQeVMiZ#9lnfyRJREMoudRLqzlQAoRShVmvO2a1+1ajbmtVjun3 (https://0bin.net/paste/jcQeVMiZ#9lnfyRJREMoudRLqzlQAoRShVmvO2a1+1ajbmtVjun3)
Posted on Redmart website (in Oct 2020)
(http://edusg.us/images/202010%20redmart%20notice.jpg)
FAQ
INCIDENT RELATED
I heard that there was unauthorized access to your RedMart database. What happened?
On 29 October 2020, our cybersecurity team discovered a data security incident involving unauthorised access to a RedMart-only database hosted on a third-party service provider ("Database"). We immediately disabled such access to the Database, commenced investigations into the incident, and took steps to enhance our security measures.
How did Lazada discover the breach/cyberattack?
Our cybersecurity team discovered the data security incident on 29 October 2020, during the course of regular proactive monitoring.
What data is compromised by this incident?
The data security incident resulted in unauthorised access to the database which contained personal data of RedMart customers (which was last updated in March 2019), including names, phone numbers, email and mailing address, encrypted passwords and partial credit card numbers.
The data is more than 18 months out of date, and is not linked to any current Lazada database. Hence, none of Lazada's current customer data is affected by this data security incident.
Is my credit card safe?
Your credit card information is generally safe as we do not store your full 16-digit card number and CVV on any of our systems which are required for payment. Nonetheless, we recommend that you keep vigilant and monitor for any unusual activity or suspicious transactions on your credit cards.
How do I know if my account was affected?
If your account was affected, we will reach out to you directly via e-mail. As a precautionary measure, all affected customers have been logged out of their existing accounts and will be required to create a new password on their next login.
Is my Lazada account safe to use? Will it be affected?
Lazada's current customer data is not affected by this data security incident. Our operations are not affected and you may continue to access your Lazada account safely. For security tips to better protect yourself online, please see "What can I do to protect myself and my data?”.
Have you reported this to the authorities?
Yes, we have also voluntarily reported this incident to Singapore’s Personal Data Protection Commission. We are also in touch with other relevant authorities, including the Singapore Police Force, and will continue to work closely with them.
SECURITY & PRECAUTION
What is Lazada doing to protect its customers?
All existing passwords are protected by encryption. As a precautionary measure, all affected customers have been logged out of their existing accounts and will be required to create a new password on their next login.
Protecting the data and privacy of our users is of utmost importance to us. We are working closely with the relevant authorities on this incident and remain committed to providing the necessary support to all our users.
What can I do to protect myself and my data?
Your existing Lazada account password is protected by encryption. As a further security measure, we recommend that you change your password. Please click here for steps on how to change your password.
Please also continue to be on the alert for spam emails requesting personal or sensitive information, as well as any unusual activity. Lazada does not request customers to verify their personal information. If you receive any calls claiming to be from Lazada or RedMart asking for payment information, credit card numbers, or any other confidential information, you should hang up. Do not provide any information to the caller.
Some additional tips:
- Never share confidential information with anyone over the phone, email or text, even if they claim to be someone you know.
- Delete messages from numbers or names you do not recognise.
- Change your passwords frequently, and avoid using the same email and password combination across different services.
Can I trust Lazada/RedMart with my data going forward?
Lazada places great importance on protecting your personal information, and we value the trust you have placed in us. We want to be transparent about this incident with all of our customers and reassure you that we are taking it very seriously. We are fully committed to taking the necessary steps to minimize the risk of a similar incident occurring in the future.
How can I contact Lazada/RedMart if I have further questions/concerns?
If you have any further questions about the incident, you may also reach out to our Customer Service Agents via chat to assist you.
Source: https://pages.lazada.sg/wow/i/sg/redmart/redmartdatabasesecurityincident
-
Personal data from 2.8 million Eatigo accounts stolen, put up for sale online
Lester Wong | 31 Oct 2020
SINGAPORE - The personal information from 2.8 million Eatigo accounts belonging to users from Singapore, Hong Kong and Thailand has been stolen and put up for sale on an online forum.
In an e-mail to customers on Saturday (Oct 31) seen by The Straits Times, the online restaurant reservation platform said the information stolen was illegally accessed more than 18 months ago and included names, e-mail addresses and phone numbers.
"We were made aware on Oct 30th that along with several other e-commerce platforms, we were the subject of a data security incident," the company said.
"Your existing eatigo account password is protected by encryption and hence safe. We do not store credit card information on our system."
News of Eatigo's data breach comes just a day after e-commerce giant Lazada confirmed that personal information from 1.1 million RedMart user accounts had been stolen.
Both sets of information were put up for sale on the same website.
The stolen Lazada information was also more than 18 months old but it is not known if the two incidents are related.
In its e-mail, Eatigo said it will collaborate with the relevant authorities on this matter and has set up a support team that affected customers can reach out to with queries or concerns.
It also advised customers to log into their accounts and reset their passwords as a precautionary measure, and to be alert to any spam e-mails requesting personal or sensitive information.
Eatigo said the information stolen was illegally accessed more than 18 months ago.
Source: https://www.straitstimes.com/tech/personal-data-from-28-million-eatigo-accounts-stolen-put-up-for-sale-online
-
High Court overturns Filipino maid's conviction for theft from employer
Tham Yuen-C | Senior Political Correspondent
SINGAPORE - The High Court has acquitted a Filipino domestic worker who was jailed 12 months by a district judge for stealing her then 89-year-old employer's ATM cards and withdrawing a total of $8,000 from his bank accounts.
Ms Portela Vilma Jimenez, now 50, was found guilty of 10 charges of theft by District Judge Jasvender Kaur earlier this year, for stealing two ATM cards belonging to Mr Yong Choon Hiong and making eight unauthorised withdrawals of $1,000 each from his bank accounts.
The withdrawals, which were captured on CCTV footage, were made on six occasions between Jan 13, 2017 and Feb 8, 2017. Seven transactions involved Mr Yong's United Overseas Bank ATM card, and one was made with his POSB ATM card.
Both the prosecution and the defence did not dispute that the withdrawals were made.
But Deputy Public Prosecutor Sia Jiazheng said Ms Jimenez had done so without Mr Yong's knowledge after stealing the ATM cards.
Her lawyers, Suang Wijaya and Syazana Yahya, said she was allowed to make the withdrawals in exchange for sexual favours she gave to her elderly employer.
High Court Judge Chua Lee Ming, who heard the appeal and overturned the conviction, has not issued a written judgment.
But Ms Jimenez's lawyers said Justice Chua did not agree that the prosecution had proven beyond a reasonable doubt that Mr Yong did not hand the ATM cards to her.
Ms Jimenez, who had worked in Singapore and Kuwait for 20 years, was working for Mr Yong and his wife from December 2015 until April 2017.
As Mr Yong's wife suffers from dementia and was wheelchair-bound, Ms Jimenez had access to the couple's room so she could take care of the elderly woman at night.
The DPP said this was how she was able to remove Mr Yong's ATM card from his wallet, which he would leave in a drawer at night.
The DPP also said Ms Jimenez would have known Mr Yong's personal identification number, which was the same for both cards, as she often went grocery shopping with the elderly couple and would have seen him punching in the numbers when he made payments.
Mr Yong had said he first discovered the unauthorised withdrawals from his account when he received his January 2017 bank statements in February that year.
He said he had gone to UOB in early February to ask the bank about the matter and filed complaints on Feb 21 during a visit to open a joint account with his son.
He made a police report the next day, as he was told that he would not be able to view the CCTV footage without one.
However, Mr Wijaya and Ms Syazana disputed Mr Yong's version of events. They said he had passed his ATM card and written his PIN number on a piece of paper for Ms Jimenez, so that she could withdraw money in exchange for sexual favours.
They contended that Mr Yong had agreed to pay her $500 each time she allowed him to touch her breasts and crotch, and that she was paid on four occasions for this.
They also said Mr Yong had made a police report as he had lied to his family about the unauthorised withdrawals after they found out about it.
In court, Ms Jimenez said Mr Yong had also agreed to pay her twice for sexual intercourse, though it did not happen in the end as he was unable to penetrate her on one occasion and she did not agree to it on another.
She also said she did not know how to use the ATM and had thus just pressed a button, leading to $1,000 being dispensed each time. But she said she would give the money to Mr Yong, who would then keep $500 and give her $500.
District Judge Jasvender Kaur, who convicted Ms Jimenez, said the offences were committed against "a vulnerable victim" of advanced age, who was already 91 when he had to testify in court.
The judge also found that her evidence was riddled with inconsistencies. For instance, Ms Jimenez had said she only remembered withdrawing money on four occasions, though the CCTV footage showed that she had withdrawn money on eight occasions. Ms Jimenez had also said she did not know how to use the ATM machine, though she had a DBS account and an ATM card of her own.
According to Ms Jimenez' lawyers, Justice Chua had found that it was Mr Yong's evidence that was inconsistent, rather than Ms Jimenez's. A key factor was the fact that he had waited for three weeks before reporting the unauthorised withdrawals to the police.
The acquittal has gained traction among some netizens, with some drawing comparisons to the Parti Liyani case, which involved another maid who was acquitted by the High Court of stealing from her employer, Mr Liew Mun Leong.
Ms Parti's case has prompted internal reviews by the Home Affairs and Law Ministries, with Home Affairs and Law Minister K. Shanmugam due to deliver a ministerial statement on the matter in Parliament this week.
Source: https://www.straitstimes.com/singapore/courts-crime/high-court-overturns-filipino-maids-conviction-for-theft
Question (Q138). Without a police report, is it the right of an individual (under the Access and Correction Obligation) to obtain CCTV footage from an organisation?
Answer: Absolutely Yes!
Reference case summary 1: “Re The Fullerton Hotel, 18 Dec 2014”, “The Applicant brought an application for review under s 28(1) of the Personal Data Protection Act 20121 (“PDPA”) alleging that the Organisation had refused to provide access to closed-circuit television (“CCTV”) footage containing his personal data… The Applicant requested access to CCTV footage of an alleged fight that took place outside one of the Organisation’s premises. Access was denied because the Organisation’s policy was that CCTV footage was for their own use and would not be disclosed unless it was in connection with any investigation conducted by a government authority.
The right to make a request for access is not limited to cases where the individual has made a police report. Therefore, it was incorrect for the Organisation to take the position that an individual was only entitled to access to the individual’s personal data when an investigation was conducted by a government authority.
In this case, the Organisation was required to review its CCTV footage for identifiable images requested by the Applicant and provide access to the images. Even if the CCTV footage had contained identifiable images of other individuals, pursuant to s 21(5) of the PDPA and to the extent that it was possible to do so, the Organisation would have been required to mask the images of other individuals and to provide the individual access to the edited CCTV footage.
The Personal Data Protection Commission highlights that organisations should, as soon as reasonably possible after receiving an access request, ensure that the personal data requested is preserved in order to meet its obligation under s 21(1) of the PDPA. This may extend to such time until the Commission has concluded its review of the access request and any right of the individual to apply for reconsideration and appeal is exhausted.” [2017] PDP Digest, pp 243- 244.
Reference case summary 2: “Re RSH Kids Pte Ltd, 22 January 2016”, “The Applicant brought a review application pursuant to s 28(1) of the Personal Data Protection Act 20121 (“PDPA”) against the Organisation’s refusal to provide access to his two-year-old son’s personal data in accordance with s 21(1) of the PDPA... the Applicant requested for access to closed-circuit television (“CCTV”) footage of his child’s fall within the Organisation’s premises but the Organisation rejected the Applicant’s request on the grounds that the CCTV footage was purely for the Organisation’s internal use and was not open to any request for access unless legal action was required by enforcement agencies such as the police or the ECDA.
The PDPA does not limit the obligation to provide access to personal data to only those specific situations where legal enforcement is required by law enforcement agencies. The data subject’s access rights are independent of any legal enforcement action… The Commission highlights that organisations should, as soon as reasonably possible after receiving an access request, ensure that the personal data requested is preserved in order to meet its obligation under s 21(1) of the PDPA.” [2017] PDP Digest, pp 245-247.
Source: https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/resource-for-organisation/pdp-digest-2017---270717.pdf
-
Increase in number of data incidents reported within Government, majority due to human error: SNDGO
By Aqil Haziq Mahmud | 11 Nov 2020
SINGAPORE: More data incidents have been reported within Government, the Smart Nation and Digital Government Office (SNDGO) said in a release on Wednesday (Nov 11).
A total of 75 data incidents were reported in Financial Year (FY) 2019, a 47 per cent increase from the 51 incidents in FY 2018. Thirty-seven incidents were reported in the first half of FY 2020 up to Sep 30, similar to the same period in the previous financial year.
The majority of incidents reported were due to human error, SNDGO said, including inadvertently emailing sensitive data to the wrong recipients and misplacing IT equipment containing sensitive data.
Another main cause of the incidents was a failure to follow established processes to secure data, SNDGO said, including deploying software containing bugs to save time, which could have led to a breach.
"Most of the incidents were assessed to not have significant impact on the agency or individuals affected as protection measures had been put in place to mitigate the risk of data breach," it said.
"For example, the misplaced IT equipment were encrypted; the sensitive data contained therein would not be usable to unauthorised users who attempt to extract data from these devices."
This comes as SNDGO said it has implemented 18 out of 24 key initiatives recommended by the Public Sector Data Review Committee in findings released in November last year.
The committee, which inspected 336 systems across 94 public sector agencies, found that about three-quarters of agencies had at least one finding of non-compliance with a government manual on data policies and standards.
The initiatives implemented include improving audit and third-party management frameworks, enhancing processes to respond to data incidents in a timely manner, and strengthening data security accountability at every level.
"We are on track to implement the remaining technical measures as planned - 80 per cent of the systems will be covered by the end of 2021 and all systems by the end of 2023," SNDGO said.
These measures include tools that prevent the loss of sensitive data across government systems and devices, and automate user account management to ensure regular and timely reviews of access to IT systems containing sensitive data.
INCREASE IN REPORTED DATA INCIDENTS IN LINE WITH GLOBAL TRENDS
SNDGO said the increase in reported incidents was "in tandem" with the trends seen in the private sector and globally, which have seen a "general increase" in data incidents.
"The increase in the number of data incidents reported can be partly attributed to greater awareness, vigilance and an improved understanding among public officers of what constitutes a data incident," it added.
"Public officers are regularly engaged on data security measures to build a culture of learning and heightened awareness."
SNDGO said the Government will continue to invest in technical tools as a first line of defence against data compromises.
This includes a whole-of-government data loss prevention (DLP) programme, which will be integrated into the ICT systems and user devices, and be completed by the end of next year.
An ICT system comprises hardware, software, data and the people who use them.
The DLP programme will address common causes of data incidents in the public sector, such as the unintentional transfer of documents containing sensitive data during bulk data transfers.
It will use a combination of technical and process controls to detect risky user actions that might result in data loss and guide the users to take the appropriate actions.
For instance, when a public officer tries to extract sensitive data from his work laptop using authorised storage media, the DLP tool will highlight this risky activity and require the officer to affirm the action before proceeding.
MORE MUST BE DONE TO TACKLE HUMAN ERROR
Nevertheless, SNDGO said in its report update on the Government's personal data protection efforts this year that "more must also be done to tackle the root cause of human error".
"While the policies and processes on handling sensitive data are generally sound, many of the data incidents occurred because officers failed to follow these established procedures and protocols," it said.
"The officers found responsible for these data incidents had been duly disciplined, with punitive measures ranging from counselling and formal reprimands, to financial penalties."
In one unintentional data disclosure incident that took place from June to October 2019, officers and supervisors from the Singapore Accountancy Commission (SAC) were disciplined through formal warning letters or financial penalties of up to half a month's pay.
An SAC officer had unknowingly attached a file containing personal information of 6,541 individuals, including contact details and examination results, in emails that were sent to 41 people in 22 organisations, SNDGO said.
An email data protection tool implemented in October 2019 had alerted the sender that the email contained sensitive data.
"SAC immediately rectified the mistake and prevented further unauthorised disclosure of the data," the SNDGO report said.
"SAC also convened a committee to inquire into the incident and make recommendations to improve the organisation’s personal data protection practices."
DISCIPLINARY ACTIONS INSUFFICIENT
Despite that, SNDGO said in its report that disciplinary actions were not enough, adding that there was a need to ensure public officers better understand the importance of data security.
Next year, the Government will ramp up efforts to increase data security awareness and knowledge among public officers, including embarking on "more intensive" campaigns to engage officers on data security and sharing lessons learnt from past data incidents in newsletters and at workshop.
"Starting in 2021, the Government will conduct regular ICT and data incident management exercises for public agencies and public officers to practice and improve their incident management processes," SNDGO said.
"These are first steps towards inculcating a culture of excellence in sharing and using data securely, which will require sustained efforts across many years at all levels of the organisation."
Source: https://www.channelnewsasia.com/news/singapore/more-data-incidents-government-human-error-sndgo-13514546
-
HACKED OFF Female British athletes hacked as nude pictures and videos are leaked on same evening as Man Utd cyber attack
Joe Miles | 22 Nov 2020
FOUR female British athletes have had explicit pictures and videos stolen from their phones and leaked online.
The shocking incident occurred on the same night that Manchester United were hacked by 'organised criminals'.
The four unnamed female stars are considering their next move to get the intimate images and videos removed from the dark web.
They are among hundreds of female sports stars and celebs who have been targeted by hackers.
An agent of one of the victims told The Times: "It really is difficult to know what to do next.
"The people who do this are sick.
"We have seen some very unpleasant cases, even where people have been blackmailed over [stolen] material.
"But it's not easy to get a grip on the situation and go after them.
"It can take years to pursue, just to get it taken down from the internet.
"As a victim you have to decide if you want to go through it."
It has been described as an iCloud leak, but could have also occurred as a result of phishing.
One of the British athletes had nearly 100 images stolen while another had more than 30 pictures and videos leaked.
A spokesman for the National Cyber Security Centre described the attack as 'utterly reprehensible'.
They said: "Accessing and then leaked people's personal data is utterly reprehensible, and we would urge everyone to take steps to secure their online accounts.
"The NCSC recommends people turn on two-factor authentication where it's available.
"We also recommend a strong password made up of three random words to reduce the likelihood of being hacked, and important accounts should use a unique password.
"The NCSC's Cyber Aware website has actionable steps to stay secure."
Former golf professional Paige Spiranac has spoken out on the horrendous experience of having a nude photo leaked.
Stunning sports journalist Diletta Leotta also blasted hackers who posted nude pictures of her online which they nicked from her iCloud.
Manchester United have been hit by a cyber attack as hackers targeted the club's IT systems.
The Red Devils confirmed they were the victims of a "sophisticated operation by organised criminals".
Source: https://www.thesun.co.uk/sport/13259694/british-athletes-nude-pictures-hack/
-
Robot vacuum cleaners can be used by hackers to 'spy' on private conversations: NUS study
07 Dec 2020
Assistant Professor Jun Han and doctoral student Mr Sriram Sami from NUS Computing with a robot vacuum cleaner, a monitor showing recovered sound waves and common household items made from materials that can reflect sound.
SINGAPORE: Your robot vacuum cleaner could be picking up private conversations along with the dust and dirt in your home.
Computer scientists from the National University of Singapore (NUS) have demonstrated how a common robot vacuum cleaner and its built-in light detection and ranging (Lidar) sensor could be used to "spy" on private conversations, the university said on Monday (Dec 7).
The method, called LidarPhone, repurposes the Lidar sensor that a robot vacuum cleaner normally uses for navigating around a home into a laser-based microphone to eavesdrop on private conversations.
The research team, led by Assistant Professor Jun Han and his doctoral student Sriram Sami, managed to recover speech data with "high accuracy", said NUS.
“The proliferation of smart devices – including smart speakers and smart security cameras – has increased the avenues for hackers to snoop on our private moments," said Mr Sami.
"Our method shows it is now possible to gather sensitive data just by using something as innocuous as a household robot vacuum cleaner. Our work demonstrates the urgent need to find practical solutions to prevent such malicious attacks."
HACKERS CAN LEARN CREDIT CARD DETAILS, SENSITIVE INFORMATION
The core of the LidarPhone “attack method” is the Lidar sensor, a device which emits an invisible scanning laser in order to create a map of its surroundings.
By reflecting lasers off common objects, such as a dustbin or a takeaway bag, located near a person’s computer speaker or television soundbar, the research showed that hackers could obtain information about the original sound that made the objects’ surfaces vibrate.
“Using applied signal processing and deep learning algorithms, speech could be recovered from the audio data, and sensitive information could potentially be obtained,” said NUS.
COMMENTARY: The year hackers and scammers exploited our COVID-19 fears to cheat us
In their experiments, the researchers used a common robot vacuum cleaner with two sources of sound - the voice of a person reading out numbers played from a computer speaker and music clips from television shows played through a television soundbar.
The team collected more than 19 hours of recorded audio files and passed them through "deep learning algorithms" that were trained to either match human voices or identify musical sequences.
“The system was able to detect the digits being spoken aloud, which could constitute a victim’s credit card or bank account numbers. Music clips from television shows could potentially disclose the victim’s viewing preferences or political orientation,” said NUS.
The system achieved a classification accuracy rate of 91 per cent when recovering spoken digits and a 90 per cent accuracy rate when classifying music clips. These results are "significantly higher" than a random guess of 10 per cent, said NUS.
The NUS scientists also experimented with common household materials to test how well they reflected the Lidar laser beam and found that the accuracy of audio recovery varied between different materials - the best material for reflecting the laser beam was a glossy polypropylene bag, while the worst was glossy cardboard.
NUS students Dai Yimin and Sean Tan Rui Xiang, as well as Assistant Professor Nirupam Roy from the University of Maryland, contributed to the research. The research was presented at the Association for Computing Machinery's Conference on Embedded Networked Sensor Systems (SenSys 2020) on Nov 18, where the team clinched the Best Poster Runner Up Award.
INTERNET CONNECTED DEVICES POSE PRIVACY RISKS
To prevent Lidars from being misused, people with robot vacuum cleaners are advised to not connect them to the Internet.
The NUS team also recommends that Lidar sensor manufacturers incorporate a mechanism that cannot be overridden to prevent the internal laser from firing when the Lidar is not rotating.
“In the long term, we should consider whether our desire to have increasingly ‘smart’ homes is worth the potential privacy implications," said Asst Prof Han.
"We might have to accept that each new Internet-connected sensing device brought into our homes poses an additional risk to our privacy, and make our choices carefully.”
The team is working on applying these LidarPhone findings to autonomous vehicles, which also use Lidar sensors.
This technology could be used to eavesdrop on conversations happening in nearby cars through minute vibrations of the windows, said NUS.
The researchers are also looking into the vulnerability of active laser sensors found on the latest smartphones, which could reveal further privacy issues, the university added.
Source: CNA/zl
Source: https://www.channelnewsasia.com/news/singapore/robot-vacuum-cleaners-hackers-spy-private-conversations-nus-13717064
-
3 men charged with crimes related to obtaining personal details of telco customers
Jean Iau | 16 Dec 2020
SINGAPORE - Three Singaporean men accused of committing crimes related to obtaining personal details of Singtel and StarHub customers appeared before a district court on Wednesday (Dec 16).
Two of them, Foo Cheek Ann Kelvin, 32, and Zhang Jiazheng, 38, are said to have used computers at their workplaces to illicitly access the subscriber databases of Singtel and StarHub respectively.
The third man, Lim Zong Xian Philbert, 33, faces three charges of bribing another man, Lee Cheng Yan, 37, with a total of $1,000 to get customers' details from the telcos in 2017.
Foo faces 15 charges under the Computer Misuse and Cybersecurity Act including allegedly getting information related to the address of Lee's ex-girlfriend in 2014.
He faces an additional charge of allegedly accepting $180 from Lee in 2016 in return for retrieving confidential details of Singtel customers.
Zhang faces nine counts of allegedly using a computer at his work place to get information relating to various StarHub subscribers' details between 2015 and 2017.
Lee was charged in 2018 for various offences and his case is pending.
Lim, Zhang, and Foo are scheduled to be in court next on Jan 13 next year.
Those convicted of using a computer to secure access to data without authority can be jailed for up to two years, fined up to $5,000 or both. Repeat offenders can be jailed for up to three years, fined up to $10,000 or both.
For each offence of corruption, offenders can be jailed up to five years, or fined up to $100,000, or both.
Source: https://www.straitstimes.com/singapore/courts-crime/3-men-charged-with-crimes-related-to-obtaining-personal-details-of-telco
-
Police Arrest 21 WeLeakInfo Customers Who Bought Breached Personal Data
December 25, 2020 | Ravie Lakshmanan
21 people have been arrested across the UK as part of a nationwide cyber crackdown targeting customers of WeLeakInfo.com, a now-defunct online service that had been previously selling access to data hacked from other websites.
The suspects used stolen personal credentials to commit further cyber and fraud offences, the UK National Crime Agency (NCA) said.
Of the 21 arrested — all men aged between 18 and 38 — nine have been detained on suspicion of Computer Misuse Act offences, nine for Fraud offences, and three are under investigation for both. The NCA also seized over £41,000 in bitcoin from the arrested individuals.
Earlier this January, the US Federal Bureau of Investigation (FBI), the NCA, the Netherlands National Police Corps, the German Bundeskriminalamt, and the Police Service of Northern Ireland jointly seized the domain of WeLeakInfo.com.
Launched in 2017, the service provided its users a search engine to access the personal information illegally obtained from over 10,000 data breaches and containing over 12 billion indexed stolen credentials, including, for example, names, email addresses, usernames, phone numbers, and passwords for online accounts.
On top of that, WeLeakInfo offered subscription plans, allowing unlimited searches and access to the results of these data breaches during the subscription period that lasted anywhere from one day ($2), one week ($7), one month ($25), or three months ($70).
The cheap subscriptions made the website accessible to even entry-level, apprentice-type hackers, letting them get hold of a huge cache of data for as little as $2 a day, and in turn, use those stolen passwords to mount credential stuffing attacks.
Following the domain's seizure in January, two 22-year-old men, one in the Netherlands and another in Northern Ireland, were arrested in connection with running the site. WeLeakInfo's Twitter handle has since gone quiet.
The NCA said besides being customers of the website, some of the arrested men had also purchased other cybercrime tools such as remote access Trojans (RATs) and crypters, with three other subjects found to be in possession of indecent images of children.
"Cyber criminals rely on the fact that people duplicate passwords on multiple sites and data breaches create the opportunity for fraudsters to exploit that," NCA's Paul Creffield said. "Password hygiene is therefore extremely important."
Source: https://thehackernews.com/2020/12/police-arrest-21-weleakinfo-customers.html
-
Advisories on Collection of Personal Data for COVID-19 Contact Tracing and Use of SafeEntry
3 Feb 2021
i. Advisory on Collection of Personal Data for COVID-19 Contact Tracing
ii. Advisory for Premise Owners
iii. Advisory for Employers
i. Advisory on Collection of Personal Data for COVID-19 Contact Tracing
Organisations may collect personal data of visitors to premises for purposes of contact tracing and other response measures in the event of an emergency, such as during the outbreak of the coronavirus disease 2019 (COVID-19).
In the event of a COVID-19 case, relevant personal data can be collected, used and disclosed without consent during this period to carry out contact tracing and other response measures, as this is necessary to respond to an emergency that threatens the life, health or safety of other individuals.
As organisations may require national identification numbers to accurately identify individuals in the event of a COVID-19 case, organisations may collect visitors' NRIC, FIN or passport numbers for this purpose.
Organisations that collect such personal data must comply with the Data Protection Provisions of the PDPA, such as making reasonable security arrangements to protect the personal data in their possession from unauthorised access or disclosure, and ensuring that the personal data is not used for other purposes without consent or authorisation under the law.
The PDPC has developed a notice to inform visitors that personal data would be collected during the outbreak of COVID-19 for contact tracing purposes. Organisations that would like to make use of the notice may access to the following:
Notice for Collection of Personal Data for Contact Tracing- Tent card version
- A5 version
The PDPC would also like to highlight that there have been reports of scammers impersonating MOH contact tracing officers and requesting financial information from individuals. Members of the public are advised to verify the authenticity of the phone calls with the MOH hotline (6325 9220) if they have doubts about the caller's identity.
:
:
:
Source: https://www.pdpc.gov.sg/Help-and-Resources/2020/03/Advisory-on-Collection-of-Personal-Data-for-COVID-19-Contact-Tracing (https://www.pdpc.gov.sg/Help-and-Resources/2020/03/Advisory-on-Collection-of-Personal-Data-for-COVID-19-Contact-Tracing)
-
Singtel data breached through hack on third-party file sharing vendor
Ng Wei Kai | 11 Feb 2021
SINGAPORE - A third-party file sharing system used by Singtel has been hacked, and customer information may have been compromised, the company said in a statement on Thursday morning (Feb 11).
Singtel said that an impact assessment on the extent of the data breach is ongoing.
"Our priority is to work directly with customers and stakeholders whose information may have been compromised to keep them supported and help them manage any risks," it said.
"We will reach out to them at the earliest opportunity once we identify which files relevant to them were illegally accessed," it added.
The file sharing system which was hacked is called FTA and is provided by cloud-sharing company Accellion, which informed Singtel of the hack on Dec 23 last year (2020).
In its own statement, Accellion stated that FTA was a 20-year-old product near the end of its functionality which suffered a "sophisticated cyber-attack".
Singtel said that the breach was an isolated incident involving the third-party system, and that its core operations remain "unaffected and sound".
It added that the FTA system is used to share information internally within Singtel and externally to other stakeholders.
"We have since suspended all use of the system and activated investigations, working closely with cyber security experts and the relevant authorities, including the Cyber Security Agency of Singapore which is providing additional guidance," added the telco.
Source: https://www.straitstimes.com/singapore/singtel-data-breached-through-hack-on-third-party-file-sharing-vendor (https://www.straitstimes.com/singapore/singtel-data-breached-through-hack-on-third-party-file-sharing-vendor)
About 129,000 Singtel customers' personal information, including NRIC details, stolen in data breach
17 Feb 2021
SINGAPORE: Personal information of about 129,000 Singtel customers was stolen after a recent data breach of a third-party file sharing system, the local telco said on Wednesday (Feb 17).
Singtel has completed initial investigations into the breach and established which files on the Accellion file transfer appliance (FTA) were accessed illegally, the company said in a news release.
The personal information taken includes about 129,000 customers' NRIC numbers and a combination of names, dates of birth, mobile numbers and addresses, said Singtel.
In addition, bank account details of 28 former Singtel employees and credit card details of 45 staff members of a corporate customer with Singtel mobile lines were taken.
"Some information" from 23 enterprises, including suppliers, partners and corporate customers, was also stolen.
The company has started notifying all affected individuals and enterprises to help them and their staff manage the possible risks involved and take appropriate follow-up action, it said.
Singtel's Group CEO Yuen Kuan Moon said: "While this data theft was committed by unknown parties, I’m very sorry this has happened to our customers and apologise unreservedly to everyone impacted.
"Data privacy is paramount, we have disappointed our stakeholders and not met the standards we have set for ourselves.
"Given the complexity and sensitivity of our investigations, we are being as transparent as possible and providing information that is accurate to the best of our knowledge. We are doing our level best to keep our customers supported in mitigating the potential risks."
Singtel said a "large part" of the leaked data includes its "internal information that is non-sensitive", such as data logs, test data, reports and emails.
"SOPHISTICATED" CYBERATTACK ON ACCELLION
Accellion FTA, which Singtel used as a third-party file sharing system, was the target of a "sophisticated" cyberattack exploiting a "previously unknown vulnerability", said the telco.
When it was first alerted to exploits against the system in December last year, Singtel "promptly applied" a series of patches provided by Accellion to "plug the vulnerability", it said. The last patch was on Dec 27 last year.
On Jan 23, Accellion advised that a new vulnerability had emerged that rendered the earlier patches previously applied in December ineffective.
Singtel immediately took the system offline, and the FTA system has been kept offline since Jan 23, said the company.
"On Jan 30, Singtel's attempt to patch the new vulnerability in the FTA system triggered an anomaly alert. Accellion informed thereafter that the system could have been breached," said Singtel.
The telco's investigations later confirmed the breach and identified Jan 20 as the date it had occurred.
"On Feb 9, Singtel established that files were taken as a result of the breach and informed the public two days later on Feb 11," said the company.
Source: https://www.channelnewsasia.com/news/singapore/singtel-data-breach-customer-information-stolen-nric-14219268 (https://www.channelnewsasia.com/news/singapore/singtel-data-breach-customer-information-stolen-nric-14219268)
Singtel Data Breach FAQ
(http://edusg.us/images/202102_SingtelDataBreachFAQ.gif)
Source: https://www.singtel.com/personal/support/about-accellion-security-incident (https://www.singtel.com/personal/support/about-accellion-security-incident)
-
Two reporters from Hong Kong's Next Magazine prosecuted over disclosing birth records of Cecilia Cheung's youngest son
February 21, 2021
Hong Kong actress Cecilia Cheung and her three sons, with the face of her youngest child covered to protect his identity. Photo: Weibo
At least two reporters from media tycoon Jimmy Lai Chee-ying’s Next Magazine, who allegedly acquired and published birth certificate details of the son of Hong Kong actress Cecilia Cheung Pak-chi in 2019, have been prosecuted and will appear in court next Monday (Feb 22).
Police said on early Saturday (Feb 20) that they had sent summons to a 47-year-old man and two Hong Kong companies for disclosing personal data without user consent. Another summon was issued to a 40-year-old man for alleged conspiracy to disclose personal data obtained without user consent under the Personal Data (Privacy) Ordinance.
Police also said the suspects would appear in Kwun Tong Magistrates’ Courts on Monday, adding the case arose from a complaint from an organisation in January 2019.
Local media reported that the suspects were reporters from Next Magazine, who had gained access to the birth certificate of Cheung’s youngest son, Marcus Cheung, by searching records under the Immigration Department. They then published the details in January 2019.
Under the Personal Data (Privacy) Ordinance, it is an offence to disclose one’s personal data without consent if the individual behind the act has an intent to obtain gain or cause loss, including psychological harm, to the data subject.
The offence carries a penalty of five years’ imprisonment and a fine of HK$1 million ($171,000).
Cheung, an award-winning actress, gave birth to her third son in November 2018 but did not reveal the identity of the father. She was previously married to local pop singer Nicholas Tse Ting-fung between 2006 and 2011. Cheung has two sons with Tse.
In January 2019, Next Magazine published the birth certificate of Marcus Cheung, the actress’ third son. Details disclosed included the boy’s Chinese and English names, date of birth, the name of the mother and her address, while the father’s name was left blank.
The 40-year-old actress lodged a complaint to the Office of the Privacy Commissioner for Personal Data, which later passed the case to police for further investigation.
The Immigration Department has tightened searches for birth, death or marriage records in 2019 after the complaint. Applicants need to seek an authorisation from the data owner. In processing an applicant’s request, the department will also consider the purpose and intended use of the search result.
Source: https://www.asiaone.com/china/two-reporters-hong-kongs-next-magazine-prosecuted-over-disclosing-birth-records-cecilia
-
If you use this dating app, a big hack might’ve just exposed your private data
By Andy Meek @aemeek | April 16th, 2021
Today is a day of the week that ends in –y, so that means another data breach has been reported with clockwork-like regularity. This time, the target was a gay dating app called Manhunt, which purports to have a user base of more than 6 million people.
According to the company behind the app, a hacker executed this data breach that exposed user profiles back in February. The company provided a statement to the Washington State attorney general that reads, in part, that this data breach saw the hacker having “downloaded the usernames, email addresses and passwords for a subset of our users in early February 2021.” In total, at the moment, it’s thought that 11% of the company’s user base was affected by the hack.
That’s what an attorney representing Manhunt told TechCrunch about the hack. The company that launched the app in 2001, Online-Buddies Inc., also offered another gay dating app called Jack’d that was sold in 2019 — and which was hit by a similar security issue of its own right before the sale, in which users’ photos and location data were exposed. Last month, meanwhile, Manhunt tweeted the following: “At this time, all Manhunt users are required to update their password to ensure it meets the updated password requirements.”
Hacks and data breaches like these, it should go without saying, are especially unfortunate — with dating apps making particularly tempting targets for hackers — because of the extra-private nature of the data involved. The direct messages, user profiles, and photos that stand to be exposed in attacks like these are no doubt of a much more private and personal nature than what users share with, say, an app like LinkedIn. Recall, for example, that after the dating site Ashley Madison was hacked and exposed user information, some users went on to commit suicide.
“Manhunt takes the security of its users’ information very seriously,” reads the statement to the Washington State attorney general. “In accordance with state law, we are notifying affected residents regarding this incident via email and a message in our users’ inboxes on our platform.”
Check out our earlier coverage about email and password breaches for some tips on how you can stay safer online when using services like this and others. Here are some steps you can take to protect yourself:
- Use 2-factor authentication for your email account.
- Change your password right now, and do it regularly going forward.
- And use a solid password manager service to protect your accounts.
- It’s also a good idea to check online services like Have I Been Pwned? regularly. That particular site will search publicly available data to see if your email and/or phone number have been caught up in a reported data breach, which is something you’d certainly want to know as soon as possible.
Andy is a reporter in Memphis who also contributes to outlets like Fast Company and The Guardian. When he’s not writing about technology, he can be found hunched protectively over his burgeoning collection of vinyl, as well as nursing his Whovianism and bingeing on a variety of TV shows you probably don’t like.
Source: https://bgr.com/tech/data-breach-exposes-users-of-hacked-gay-dating-app-manhunt-5919912/
-
UOB staff discloses personal details of over 1,100 customers to scammers
UOB said the information lost comprised customer names, identification and mobile numbers and account balances.
Wong Shiying | 7 May 2021
SINGAPORE - A UOB employee who fell for a police impersonation scam disclosed the personal information of 1,166 of the bank's customers who are China nationals.
The data divulged comprised customer names, identification and mobile numbers and account balances, UOB noted on Friday (May 7).
"Their bank account numbers were not disclosed and our IT systems remain secure," it added.
The employee, who was working in Singapore, has been suspended and is assisting police investigations.
Preliminary findings show that the employee had been deceived into handing the information of these Chinese nationals with Singapore-based accounts to scammers who were impersonating police officers from China.
A UOB spokesman said the bank was not able to disclose any details about when the scam occurred and how the employee had been taken in, as the matter is under police investigation.
Similar cases in the past have involved swindlers claiming to be police officers in China telling victims that their credit or debit card details had been used for fraudulent transactions or that their bank accounts were involved in money-laundering activities.
They were then told to transfer their money for investigations. Some account holders then handed over either their banking credentials or cash to money mules.
UOB said it has written to all affected customers and taken safety precautions such as immediately disabling their Internet and mobile banking access and advising them to reset their digital banking access.
The bank has also stepped up monitoring of the affected accounts and set an SMS alert to notify customers of online fund transfers at $1 or more.
Other precautions include posting scam protection notices on the log-in pages of UOB websites.
"UOB is working closely with the Singapore Police Force on their investigations. We apologise to our customers that this has happened, as we have always made it a priority to keep their data secure," the bank said.
Source: https://www.straitstimes.com/singapore/uob-employee-discloses-personal-information-of-more-than-1100-customers-to-scammers (https://www.straitstimes.com/singapore/uob-employee-discloses-personal-information-of-more-than-1100-customers-to-scammers)
Ex-UOB employee in S’pore charged with leaking more than 1,100 customers’ details to scammers
Louisa Tang | August 20, 2021
SINGAPORE — A 26-year-old former employee of the United Overseas Bank (UOB) here was charged on Friday (Aug 20) with illegally accessing the bank’s electronic customer database and disclosing the information of 1,166 customers to scammers.
Between April 6 and 22 this year, Cao Wenqing allegedly used her work-issued laptop to access the information of more than 3,300 customers in the bank’s database and make queries on them.
Cao, a Singapore permanent resident from China, is then said to have given the details of more than 1,100 customers to a purported person representing the “Shanghai police”.
She later lodged a police report claiming she fell prey to a China officials impersonation scam, the police said on Thursday evening.
In May, UOB said the affected customers were Chinese nationals.
Court documents showed that the information released included their names, identification, mobile numbers, nationalities and bank account numbers. Cao purportedly sent these details to someone identified as “Lu” over WhatsApp.
The bank added that the employee was suspended after her actions were uncovered. It also wrote to all of the affected customers and took several precautionary measures to protect them as they may be targeted by scammers.
A Monetary Authority of Singapore spokesperson subsequently said the central bank took a serious view of the customer data breach, and would take action against UOB if its regulatory requirements had been breached or supervisory expectations had not been met.
In a statement on Friday, a UOB spokesperson apologised for the breach and said they had “zero tolerance for any behaviour that breaks the trust our customers place in us”.
Cao has since been fired from the bank.
The spokesperson added: “We acted promptly to protect our customers and to support the authorities in their investigations.
“Upon detection, we stepped up our monitoring of affected accounts and we were in regular contact with customers to ensure their accounts remained secure. Our multi-layer security measures kept the affected customers’ accounts safe from the people behind this scam.”
Cao now faces 16 charges of unauthorised access to computer material under the Computer Misuse Act, and 13 charges of unauthorised disclosure of customer information under the Banking Act.
Those convicted of the first offence can be jailed for up to two years or fined up to S$5,000, or both.
Illegally disclosing customer information can attract a jail term of up to three years or a fine of up to S$125,000, or both.
Cao told the court that she intends to plead guilty but wants to hire a lawyer. She will return to court on Sept 10 and remains out on bail of S$15,000.
The police have listed some precautions that people can take when receiving unsolicited calls such as from scammers.
These include talking to a trusted friend or relative before acting, ignoring such calls and the caller’s instructions, and refraining from giving out any personal information and details over the internet or the phone.
“No local government agency will demand payment through an undocumented medium like a telephone call or other social messaging platforms, demand that you surrender cash to unnamed persons, or ask you for personal banking information such as your internet banking passwords,” the police said.
Source: https://www.todayonline.com/singapore/uob-employee-spore-charged-leaking-more-1100-customers-details-scammers
-
Data on ticket buyers and volunteers for Olympics leaked
By TATSUYA SUDO/ Senior Staff Writer | July 22, 2021 at 17:35 JST
(http://edusg.us/images/Tokyo%20Olympic%20ticket%202.jpg)
Data believed to be IDs and passwords for ticket buyers and volunteers to log into official websites for the Tokyo Olympic and Paralympic Games have been leaked to the internet, according to a Singapore-based cybersecurity firm.
The firm, Dark Tracer, also said on July 21 what appeared to be classified documents associated with the Olympic Games were also posted online.
The Tokyo 2020 organizing committee said on the night of July 21 it is investigating if the breach occurred after data was provided to the Japanese government by the firm in mid-July.
Louis Hur, CEO of Dark Tracer, said the company has confirmed the leak of email addresses and passwords for people who created accounts to log into the official websites for the Games since September.
“The leak could total in the hundreds,” he said.
The email addresses and passwords were stolen when ticket purchasers and volunteers typed them in on phishing sites by mistake, and not in a cyberattack, according to Hur.
He also said classified documents purported to be released on the dark web by hackers could be related to the Olympics although they were encrypted.
The leak also includes what appeared to be a list of individuals who tested positive for COVID-19 among Olympic delegations and documents as to what extent information should be disclosed when athletes, organizing officials and members of the media are confirmed infected with the coronavirus.
Source: https://www.asahi.com/ajw/articles/14401064 (https://www.asahi.com/ajw/articles/14401064)
(http://edusg.us/images/Tokyo%20Olympic%20ticket%201.jpg)
Reference: https://english.kyodonews.net/news/2021/07/2ee279d7df2b-urgent-tokyo-olympic-ticket-purchaser-information-leaked-online.html (https://english.kyodonews.net/news/2021/07/2ee279d7df2b-urgent-tokyo-olympic-ticket-purchaser-information-leaked-online.html)
-
StarHub finds personal information of more than 57,000 customers on third-party data dump site
Lakeisha Leo | 06 Aug 2021
SINGAPORE: StarHub said on Friday (Aug 6) that personal information - including identity card numbers and mobile numbers - of more than 57,000 customers were found on a third-party data dump website last month.
The breach was discovered during online surveillance by StarHub's cybersecurity team on Jul 6, 2021.
Advertisement
The team found an illegally uploaded file containing "limited types of personal information related to certain individual customers", said StarHub in a statement.
Based on investigations to date, the data file contained identity card numbers, mobile numbers, as well as email addresses belonging to 57,191 customers, said StarHub. These customers had subscribed to StarHub services before 2007, the telco added.
"The personal data appears to be around 14 years old. No credit card or bank account information is at risk and no StarHub information systems or customer database are compromised," said the company.
There was also no indication so far that any data in the document had been "maliciously misused" it added.
"Data security and customer privacy are serious matters for StarHub, and I apologise for the concern this incident may be causing our affected customers," said StarHub CEO Nikhil Eapen.
"We will be transparent and will keep our customers updated. We will provide support to those affected,” said Mr Eapen.
StarHub said it put in place measures on Jul 6 to protect its customers' interests.
An incident management team was activated to access and contain the situation. The company also engaged a team of digital forensic and cybersecurity experts to launch an investigation.
Starhub said it also "attempted" to have the document from the data dump site and took "immediate and appropriate" actions to review existing security measures to protect "core infrastructure and systems".
The company is working closely with cybersecurity experts and the relevant authorities on this matter, it said.
Affected customers will be notified via email by Aug 20.
The company is also offering affected customers six months of complimentary credit monitoring service through the Credit Bureau Singapore.
Affected customers are encouraged to sign up for the service after they receive the email notification, even though there is "no evidence to-date that the said data has been used inappropriately", said StarHub.
Source: https://www.channelnewsasia.com/business/starhub-data-breach-customers-identity-card-phone-numbers-2097231
-
Singapore branch of Tokio Marine Insurance hit by ransomware attack
By Ken Wong - on 19 Aug 2021, 4:31pm
Tokio Marine Insurance Singapore (TMiS) said that they were targeted by a ransomware attack on 31 July 2021.
According to the company, their internal Windows servers were targeted by ransomware and their IT security systems were activated resulting in the affected servers being isolated and action taken to recover the servers.
We don’t know how successful they were at recovery, but TMiS said that none of their core insurance operating systems were affected.
They have appointed an external vendor to carry out the forensics investigations and testing that are still ongoing, but there is no indication of any loss of customer information or confidential information so far.
TMiS said that they took time to report the attack as they have been conducting analysis and investigation to confirm the whole picture of the case. “We have also been cooperating with local regulatory agencies and the police department and we decided to make the case public at this timing. We endeavour to adequately respond to the case and will further disclose more information if we deem it necessary,” a TMiS spokesperson said.
While they currently have no timeline for the investigation as they want to be as complete as possible, customers who are concerned about their data can contact the company through feedback channels.
Paying isn’t always the best option
We asked Ian Hall, Head of Client Services, APAC from Synopsys Software Integrity Group what SMBs and end-users could do to protect themselves when even enterprises were falling victim to ransomware attacks, and he said:
Corporations are obviously the bigger targets with potential multi-million-dollar ransoms being paid but end-users are also targets. They are targets not just for ransomware that encrypts data but also extortion-ware where attackers threaten to expose private details or photos. An end-user should pay attention to basic online hygiene such as ensuring that a strong password is used which is not duplicated on many sites, ensuring that the software on your own computer is up-to-date and of course being wary of phishing attacks.
For SMBs, he said that any organisation should begin the response to a ransomware attack long before the attack in the form of preventative measures, backups and an incident response plan.
In this case, the preventative measures have been bypassed so the incident response plan should be put into action where they will need to assess the two options – whether to recover the data and systems using backups or to pay the ransom. The assessment on which option to take has many different factors – the downtime needed to restore backups, the cost of the downtime, the cost of the ransom, and the trustworthiness of the attacker.
We also asked if paying the ransom was a good idea and Hall cautioned that while paying a ransom does sound like a quick fix but there are downsides even if the ransom is affordable. "The decryption software provided by attackers may not work leading to corrupted data, the attacker may simply not provide anything after the ransom has been paid," Hall said, "Finally, paying any ransom will simply encourage more attackers in future."
Source: https://www.hardwarezone.com.sg/tech-news-singapore-branch-tokio-marine-insurance-hit-ransomware-attack
-
Nearly 73,500 patients' data affected in ransomware attack on eye clinic in S'pore
Kenny Chee | Aug 26, 2021
SINGAPORE - A ransomware attack earlier this month has affected the personal data and clinical information of nearly 73,500 patients of a private eye clinic, the third such reported incident in a month.
The information included names, addresses, identity card numbers, contact details and clinical information such as patients’ clinical notes and eye scans, said Eye & Retina Surgeons (ERS) on Wednesday (Aug 25).
But the clinic said it has not paid any ransom, adding that no credit card or bank account information was accessed or compromised.
The Ministry of Health (MOH) said that the clinic’s compromised IT systems are not connected to the ministry’s IT systems, such as the National Electronic Health Record, and there have been no similar cyber attacks on MOH’s IT systems.
The ministry added that it has asked ERS to investigate the incident, carry out a thorough review of its systems and work with the Cyber Security Agency (CSA) to “take immediate mitigating actions to strengthen its cyber defences”.
The police, the Personal Data Protection Commission – which said it is seeking more information from ERS – and CSA have been informed of the incident.
ERS is also working with CSA and MOH to investigate the root causes of the attack and, together with security experts, is also trying to identify potential areas the company can better secure.
The clinic said in a statement that it uses “reputable and established external IT service providers to advise on and maintain its IT systems, and subscribes to appropriate anti-virus and other protective software, which is regularly updated”.
ERS added that its IT system has been restored securely, and its IT providers have completed a thorough check of the clinic’s system, reformatted servers and run anti-virus scans on all computer terminals.
Measures will be taken to prevent the breach from recurring, ERS said.
ERS had fallen prey to a sophisticated ransomware cyber attack by hackers on Aug 6. Such attacks usually involve locking up data until victims pay the hackers.
Servers and several computer terminals at the clinic’s Camden branch were affected, but its IT system at the Novena branch was not.
While no data has been leaked publicly for now, the clinic said that it will monitor the situation closely.
ERS said that for data security reasons, it maintains active medical records separately on a cloud-based system, so they were not accessed or compromised in the cyber attack. Clinical operations were not affected too.
The clinic said it is now in the process of informing patients of the cyber attack.
“ERS regrets this breach and wishes to assure its patients that it takes patient confidentiality very seriously,” the clinic said, adding that it will continue to do everything it can to protect and secure patient information.
The attack is the latest in a series of ransomware attacks reported in the past month.
On Aug 16, insurer Tokio Marine Insurance Singapore said it was hit by a ransomware attack.
It said at the time that there was no indication of a breach of customer information nor confidential information of the Tokio Marine Group.
On Aug 19, The Business Times reported that Singapore-based tech company Pine Labs fell victim to ransomware too. The firm is a Temasek-backed payments platform.
Hackers were said to have stolen confidential documents between Pine Labs and several Indian banks, and held the information hostage.
Cyber-security experts said that ransomware is a growing threat. CSA figures showed that ransomware cases in Singapore surged 154 per cent from 2019’s 35 cases to hit 89 last year.
The healthcare, government and banking industries have the biggest targets on their backs, said Mr Eric Nagel, cyber-security firm Cybereason’s general manager for the Asia-Pacific.
Mr Jeffrey Kok, cyber-security firm CyberArk’s vice-president of solution engineers for the Asia-Pacific and Japan, warned that hackers are increasingly targeting specific organisations.
Cyber crooks are pooling resources, conducting lengthy reconnaissance, and targeting people with direct access to critical assets and systems using social engineering tactics, he said.
There are steps organisations can take to protect themselves.
On Tuesday, CSA, PDPC and the police offered advice on guarding against hacking group Altdos, which has been known to use a “double extortion” technique on victims.
The group is said to steal data from a victim’s servers and might later lock the data up.
Altdos will then demand payment from the victim, threatening to publish the data if the ransom is not paid.
It will also sometimes ask a victim to pay a separate ransom to decrypt its locked files.
The hacking group operates mainly in South-east Asia and Bangladesh. In Singapore, it is known to have targeted furniture retailer Vhive and consumer electronics retailer Audio House.
If a ransomware attack occurs, the Singapore authorities advise organisations not to pay the ransom and instead report the incident to public agencies.
“Paying the ransom does not guarantee that the data will be decrypted or that your data will not be published by threat actors,” CSA, PDPC and the police said.
“It also encourages the threat actors to continue their criminal activities and target more victims. Threat actors may also see your organisation as a soft target and may strike again in the future.”
To reduce the risks of being attacked by Altdos, the Singapore authorities recommend the following to organisations:
- Regularly patch software;
- Review logs regularly, like those for server access, to check for malicious activities;
- Segregate networks to limit communications between Internet-facing services and internal servers such as those containing sensitive data;
- Routinely back up important files to external and offline storage devices;
- Deploy Web application firewalls to filter malicious network traffic;
- Seek external help, such as hiring a professional firm, when an attack has been confirmed, or to regularly test systems for security holes.
Source: https://www.straitstimes.com/tech/tech-news/nearly-73500-patients-data-affected-in-ransomware-attack-on-eye-clinic-in-spore (https://www.straitstimes.com/tech/tech-news/nearly-73500-patients-data-affected-in-ransomware-attack-on-eye-clinic-in-spore)
-
Hackers stole personal data of 79,400 MyRepublic customers including copies of NRICs
Kenny Chee | 10 Sep 2021
SINGAPORE - The personal data of nearly 79,400 mobile subscribers of MyRepublic here was accessed by hackers, the mobile operator and Internet service provider said on Friday (Sept 10).
This is the latest incident in a string of cyber attacks in recent months.
The details stolen were identity verification documents related to customer applications for mobile services.
For affected Singaporeans, permanent residents and employment and dependent pass holders, the data accessed included scanned copies of both sides of their NRICs.
Documents such as scanned copies of utility bills that confirm the residential address of foreigners who are MyRepublic subscribers were also accessed.
Customers who ported an existing mobile service had their names and mobile numbers accessed.
The Internet service provider said that there is currently no indication that other personal data, such as account or payment information, was affected.
No MyRepublic systems were compromised and there was no operational impact on MyRepublic's services, the company said.
It said that on Aug 29, it discovered the unauthorised data access on a third-party data storage platform used to store the personal data of the mobile customers.
The unauthorised access to the data storage facility has since been secured, said the mobile operator.
Its cyber incident response team has also been activated, including a team of external expert advisers such as KPMG, to work closely with MyRepublic's internal information technology and network teams to resolve the incident.
MyRepublic has notified the Infocomm Media Development Authority and the Personal Data Protection Commission of the issue.
"The privacy and security of our customers are extremely important to us at MyRepublic," said MyRepublic chief executive Malcolm Rodrigues in a statement.
"Like you, we are disappointed with what has happened, and I would like to personally apologise for any inconvenience caused.
"My team and I have worked closely with the relevant authorities and expert advisers to secure and contain the incident, and we will continue to support our affected customers every step of the way to help them navigate this issue."
Last month, a ransomware attack affected the personal data and clinical information of nearly 73,500 patients of a private eye clinic.
At the time, it was the third such reported incident in August.
The information included names, addresses, identity card numbers, contact details and clinical information such as patients' clinical notes and eye scans, said Eye & Retina Surgeons on Aug 25.
On Aug 16, insurer Tokio Marine Insurance Singapore said it was hit by a ransomware attack.
It said at the time that there was no indication of a breach of customer information nor confidential information of the Tokio Marine Group.
On Aug 19, The Business Times reported that Singapore-based tech company Pine Labs fell victim to ransomware too.
The firm is a Temasek-backed payments platform.
Hackers were said to have stolen confidential documents between Pine Labs and several Indian banks, and held the information hostage.
Source: https://www.straitstimes.com/tech/tech-news/hackers-stole-personal-data-of-79400-myrepublic-customers-including-copies-of-nrics (https://www.straitstimes.com/tech/tech-news/hackers-stole-personal-data-of-79400-myrepublic-customers-including-copies-of-nrics)
Reference 1: https://myrepublic.net/sg/press-release/myrepublic-singapore-reports-data-incident-moves-to-support-affected-customers/ (https://myrepublic.net/sg/press-release/myrepublic-singapore-reports-data-incident-moves-to-support-affected-customers/)
Reference 2: https://forums.hardwarezone.com.sg/threads/breaking-myrepublic-data-storage-hacked.6595632/ (https://forums.hardwarezone.com.sg/threads/breaking-myrepublic-data-storage-hacked.6595632/)
MyRepublic ordered to pay S$60,000 for failing to protect personal data of 80,000 customers
The access key to obtain MyRepublic's customer data could be found on a publicly accessible webpage.
Davina Tham | 16 Sep 2022
SINGAPORE: MyRepublic Singapore has been ordered to pay a financial penalty of S$60,000 for failing to protect the personal data of almost 80,000 customers in a cyber incident last year.
The Personal Data Protection Commission (PDPC) on Thursday (Sep 15) published its decision containing the findings of its investigation into the incident.
The data breach took place on Aug 29, 2021. Local telco provider MyRepublic received an email from an external actor threatening to publish the stolen customer data unless a ransom was paid.
MyRepublic informed PDPC of the attack on Sep 1, 2021, and announced it publicly on Sep 10, 2021.
Personal data belonging to more than 75,000 Singaporeans and permanent residents was stolen during the breach, in the form of scanned copies of both sides of their NRICs and work pass cards.
Scans of residential address documents belonging to more than 4,300 foreigners, and forms from more than 3,600 customers porting over mobile services, which contained their full names and mobile numbers, were also compromised.
At the time of the incident in August 2021, MyRepublic accepted customer orders for mobile services through its mobile order portal, according to PDPC's findings.
The portal stored customers' identity verification and mobile number porting documents in a "bucket" on cloud storage provided by Amazon Web Services (AWS).
The bucket was publicly accessible, but protected by an access key. Investigations found that the external actor used the access key to access the bucket.
"Fortunately, the compromised access key could not be used by the external actor to access (MyRepublic's) other AWS accounts, systems or buckets," said PDPC.
"However, an unusually large volume of data had been downloaded from the bucket before it was deleted."
PDPC noted that MyRepublic controlled a high volume of sensitive personal data and should have implemented stronger security measures to protect it. It identified multiple failures by the telco to protect the access key.
According to MyRepublic, the bucket's access key could be found on a publicly accessible webpage displaying technical information used by programmers, known as "PHP info".
"This was a significant vulnerability as anyone who knew or could guess the php-info URL could obtain the access key and use it to access the customer data in the bucket," said PDPC.
The commission noted that MyRepublic had determined this was the most likely way that the external actor had obtained the access key.
Instead of leaving the access key publicly accessible, MyRepublic should have disabled the "PHP info" function or moved the access key to files that were only available to authorised individuals, said PDPC.
According to MyRepublic, the access key was also embedded in the source code of the mobile order portal, which was available to all of the telco's developers.
The external actor could have obtained the access key in this way, or a developer could have inadvertently disclosed it, said PDPC.
The commission also said that the access key was "captured in the clear" in mobile order application log files made available to employees, including external developers and engineers, who did not require such information.
Furthermore, given the high volume and sensitivity of the customer data stored in the bucket, it should not have been publicly available, added PDPC.
In deciding on the penalty, the commission said that MyRepublic took prompt and effective remedial actions, cooperated with investigations and voluntarily accepted liability.
The remedial actions included replacing the access key, removing environment configuration files that exposed the access key and restricting access to buckets to specific IP addresses.
MyRepublic notified affected customers and recommended actions to minimise the risk of identity fraud and social engineering, said PDPC. It also offered affected customers six months of complimentary credit monitoring services.
The telco also conducted a month of dark web monitoring until Oct 3, 2021, to verify whether the stolen data was published.
CNA/dv(zl)
Source: https://www.channelnewsasia.com/singapore/myrepublic-data-breach-cyber-attack-fine-60000-2943016
Archive: https://archive.fo/oz3Z3
-
Details of some 100 million visitors to Thailand exposed online: research firm
20 Sep, 2021
More than 106 million travellers to Thailand had their personal details exposed online in August, a cybersecurity research firm that discovered the data said on Monday, but the leak was quickly plugged by authorities.
The Southeast Asian nation is a popular tourist destination, drawing nearly 40 million visitors in 2019 before the Covid-19 pandemic shut borders and seized up global travel.
Britain-based consumer security firm Comparitech said in a report that its head of cybersecurity research, Bob Diachenko, found a database in August containing the personal information of travellers to the kingdom.
He said “any foreigner who travelled to Thailand in the last decade might have had their information exposed in the incident”, including their name, passport number and residency status.
Comparitech said Diachenko also found his own name and details about his entries into Thailand on the database, which contained information dating back to 2011.
Thai authorities were informed on August 22 and secured the data the following day.
“However we do not know how long the data was exposed prior to being indexed,” said the report.
Thai authorities “maintain the data was not accessed by any unauthorised parties”, it added.
Thailand’s Cyber Crime Investigation Bureau said it was unaware of the incident but was looking into it.
While Thais are largely internet-savvy, their government is no stranger to data leaks and information breaches.
In June, a government website for foreigners to sign up for a coronavirus vaccine
was found to be revealing the names and passport numbers of prospective recipients. The site was taken down soon after.
Meanwhile in neighbouring Indonesia, authorities said they had found no evidence that the country’s main intelligence service’s computers were compromised, after a US-based private cybersecurity company alerted them of a suspected breach of its internal networks by a Chinese hacking group.
The Insikt Group, the threat research division of Massachusetts-based Recorded Future, said it discovered the hack in April when it detected malware servers operated by the “Mustang Panda” group communicating with hosts inside Indonesian government networks.
The activity targeted the intelligence agency Badan Intelijen Negara (BIN), as well as nine other Indonesian government organisations, Recorded Future said.
“We assess that this activity is very likely linked to the Chinese state-sponsored threat activity group Mustang Panda based on our continued tracking of Chinese state-sponsored cyberespionage activity,” the company said in an email to AP.
Chinese government offices were closed on Monday for the Mid-Autumn Festival and could not be reached, but authorities have consistently denied any form of state-sponsored hacking and said China itself is a major target of cyberattacks.
Recorded Future said its experts traced the hack back to as early as March, and the last observed date of the intrusion was August 20. “We have not seen additional activity targeting BIN since that date,” it said.
After being notified by Recorded Future, BIN investigated the suspected breach together with other agencies and related stakeholders, but found “our server is safe and under control, there is no indication that it was hacked by suspected Chinese hackers”, said Wawan Hari Purwanto, a deputy chief and spokesman for the agency.
BIN coordinates information sharing and operations for Indonesia’s other intelligence agencies, as well as conducting its own operations.
Thailand
Source: https://www.scmp.com/news/asia/southeast-asia/article/3149475/details-some-100-million-visitors-thailand-exposed-online
-
MoD data breach ‘put lives at risk’ for more than 250 Afghan interpreters
Robyn Vinter | Mon 20 Sep 2021
The Ministry of Defence has apologised and launched an investigation into a data breach that has “needlessly put lives at risk” by revealing the email addresses of more than 250 Afghan interpreters who worked for British forces.
An email sent by the MoD to interpreters who are seeking relocation to the UK asking for an update on their situation mistakenly copied in their email addresses, so they were visible to all other recipients.
The ministry says it has contacted the individuals affected by the data breach and is offering advice on how to manage the potential risks.
Many of the people who worked with western forces are in hiding from the Taliban, which seized power in August with surprising speed as the West withdrew in the run up to the 31 August deadline set by the US president, Joe Biden.
While more than 17,000 people were rescued by the UK – the largest refugee evacuation since the second world war – chaotic scenes at Kabul airport meant many of those who had assisted British troops were left behind.
The email came from the Afghan Relocations and Assistance Policy (Arap), which has been helping those still stuck in the country – as well as people who fled to neighbouring countries – after UK troops pulled out.
It advised those still stranded that Arap was doing everything possible to get them to safety and not to risk leaving their current location if it was not safe.
But one interpreter who received the email told the BBC: “This mistake could cost the life of interpreters, especially for those who are still in Afghanistan.
“Some of the interpreters didn’t notice the mistake and they replied to all the emails already and they explained their situation which is very dangerous. The email contains their profile pictures and contact details.”
Ben Wallace, the defence secretary, told the BBC that the error was an “unacceptable breach”. The former defence minister Johnny Mercer said the error was likely to mean Afghan translators would be “moving house again tonight”.
He tweeted: “The truth on how we have treated our Afghan interpreters will come out.
“All the back slapping over [Operation] Pitting masks a criminally negligent performance by the Ministry of Defence and the Home Office on doing our duty to these people.”
John Healey, the shadow defence secretary, said: “We told these Afghans interpreters we would keep them safe, instead this breach has needlessly put lives at risk.
“The priority now is to urgently step up efforts to get these Afghans safely to the UK.
“This is the second major data breach from the MoD this year, after sensitive documents were discovered at a bus stop in Kent in June. Clearly, the defence secretary needs to get his house in order.”
An MoD spokesperson said: “An investigation has been launched into a data breach of information from the Afghan Relocations Assistance Policy team. We apologise to everyone impacted by this breach and are working hard to ensure it does not happen again.
“The Ministry of Defence takes its information and data handling responsibilities very seriously.”
The spokesperson added that it would be inappropriate comment on the specifics of the case at this time but that the department is taking all necessary steps under UK GDPR.
Source: https://www.theguardian.com/uk-news/2021/sep/20/mod-data-breach-puts-lives-at-risk-for-more-than-250-afghan-interpreters
-
Offshore havens and hidden riches of world leaders and billionaires exposed in unprecedented leak
The Pandora Papers reveal the inner workings of a shadow economy that benefits the wealthy and well-connected at the expense of everyone else.
October 3, 2021
Millions of leaked documents and the biggest journalism partnership in history have uncovered financial secrets of 35 current and former world leaders, more than 330 politicians and public officials in 91 countries and territories, and a global lineup of fugitives, con artists and murderers.
The secret documents expose offshore dealings of the King of Jordan, the presidents of Ukraine, Kenya and Ecuador, the prime minister of the Czech Republic and former British Prime Minister Tony Blair. The files also detail financial activities of Russian President Vladimir Putin’s “unofficial minister of propaganda” and more than 130 billionaires from Russia, the United States, Turkey and other nations.
The leaked records reveal that many of the power players who could help bring an end to the offshore system instead benefit from it – stashing assets in covert companies and trusts while their governments do little to slow a global stream of illicit money that enriches criminals and impoverishes nations.
Among the hidden treasures revealed in the documents:
- A $22 million chateau in the French Riviera – replete with a cinema and two swimming pools – purchased through offshore companies by the Czech Republic’s populist prime minister, a billionaire who has railed against the corruption of economic and political elites.
- More than $13 million tucked in a secrecy-shaded trust in the Great Plains of the United States by a scion of one of Guatemala’s most powerful families, a dynasty that controls a soap and lipsticks conglomerate that’s been accused of harming workers and the earth.
- Three beachfront mansions in Malibu purchased through three offshore companies for $68 million by the King of Jordan in the years after Jordanians filled the streets during Arab Spring to protest joblessness and corruption.
The secret records are known as the Pandora Papers.
The International Consortium of Investigative Journalists obtained the trove of more than 11.9 million confidential files and led a team of more than 600 journalists from 150 news outlets that spent two years sifting through them, tracking down hard-to-find sources and digging into court records and other public documents from dozens of countries.
The leaked records come from 14 offshore services firms from around the world that set up shell companies and other offshore nooks for clients often seeking to keep their financial activities in the shadows. The records include information about the dealings of nearly three times as many current and former country leaders as any previous leak of documents from offshore havens.
In an era of widening authoritarianism and inequality, the Pandora Papers investigation provides an unequaled perspective on how money and power operate in the 21st century – and how the rule of law has been bent and broken around the world by a system of financial secrecy enabled by the U.S. and other wealthy nations.
The findings by ICIJ and its media partners spotlight how deeply secretive finance has infiltrated global politics – and offer insights into why governments and global organizations have made little headway in ending offshore financial abuses.
An ICIJ analysis of the secret documents identified 956 companies in offshore havens tied to 336 high-level politicians and public officials, including country leaders, cabinet ministers, ambassadors and others. More than two-thirds of those companies were set up in the British Virgin Islands, a jurisdiction long known as a key cog in the offshore system.
At least $11.3 trillion is held “offshore,” according to a 2020 study by the Paris-based Organization for Economic Cooperation and Development. Because of the complexity and secrecy of the offshore system, it’s not possible to know how much of that wealth is tied to tax evasion and other crimes and how much of it involves funds that come from legitimate sources and have been reported to proper authorities.
The Pandora Papers investigation unmasks the covert owners of offshore companies, incognito bank accounts, private jets, yachts, mansions, even artworks by Picasso, Banksy and other masters – providing more information than what’s usually available to law enforcement agencies and cash-strapped governments.
People linked by the secret documents to offshore assets include India’s cricket superstar Sachin Tendulkar, pop music diva Shakira, supermodel Claudia Schiffer and an Italian mobster known as “Lell the Fat One.”
The mobster, Raffaele Amato, has been tied to at least a dozen killings. The documents provide details about a shell company, registered in the United Kingdom, that Amato used to buy land in Spain, shortly before fleeing there from Italy to set up his own crime gang. Amato, whose history helped inspire the highly praised movie “Gomorrah,” is serving a 20-year prison sentence.
Amato’s attorney did not respond to ICIJ’s request for comment.
Tendulkar’s attorney said the cricket player’s investment is legitimate and has been declared to tax authorities. Shakira’s attorney said the singer declared her companies, which the attorney said do not provide tax advantages. Schiffer’s representatives said the supermodel correctly pays her taxes in the U.K., where she lives.
In most countries, it’s not illegal to have assets offshore or to use shell companies to do business across national borders. Businesspeople who operate internationally say they need offshore companies to conduct their financial affairs.
But these affairs often amount to shifting profits from high-tax countries, where they are earned, to companies that exist only on paper in low-tax jurisdictions. Using offshore shelters is especially controversial for political figures, because they can be used to keep politically unpopular or even illicit activities from public view.
In popular imagination, the offshore system is often seen as a far-flung cluster of palm-shaded islands. The Pandora Papers show that the offshore money machine operates in every corner of the planet, including the world’s largest democracies. The key players in the system include elite institutions – multinational banks, law firms and accounting practices – headquartered in the U.S. and Europe.
A document in the Pandora Papers shows that banks around the world helped their customers set up at least 3,926 offshore companies with the assistance of Alemán, Cordero, Galindo & Lee, a Panamanian law firm led by a former ambassador to the U.S. The document shows that the firm – also known as Alcogal – set up at least 312 companies in the British Virgin Islands for clients of the American financial services giant Morgan Stanley.
A Morgan Stanley spokesperson said: “We do not create offshore companies. . . . This process is independent of the firm and at the discretion and direction of the client.”
The Pandora Papers investigation also highlights how Baker McKenzie, the largest law firm in the U.S., helped create the modern offshore system and continues to be a mainstay of this shadow economy.
Baker McKenzie and its global affiliates have used their lobbying and legislation-drafting know-how to shape financial laws around the world. They have also profited from work done for people tied to fraud and corruption, reporting by ICIJ has found.
The people that the firm has done work for includes Ukrainian oligarch Ihor Kolomoisky, who U.S. authorities allege laundered $5.5 billion through a tangle of shell companies, purchasing factories and commercial properties across the U.S. heartland.
Baker McKenzie also did work for Jho Low, a now-fugitive financier accused by authorities in multiple countries of masterminding the embezzlement of more than $4.5 billion from a Malaysian economic development fund known as 1MDB. ICIJ’s reporting found that Low relied on Baker McKenzie and its affiliates to help him and his associates build a web of companies in Malaysia and Hong Kong. U.S. authorities allege they used some of those companies to shift money looted from 1MDB.
A spokesperson for Baker McKenzie said the firm seeks to provide the best advice to its clients and strives “to ensure that our clients adhere to both the law and best practice.”
The spokesperson didn’t directly address many questions about Baker McKenzie’s role in the offshore economy, citing client confidentiality and legal privilege. But he said the firm performs strict background checks on all potential clients.
‘You know who’
The Pandora Papers investigation is larger and more global than even ICIJ’s landmark Panama Papers investigation, which rocked the world in 2016, spawning police raids and new laws in dozens of countries and the fall of prime ministers in Iceland and Pakistan.
The Panama Papers came from the files of a single offshore services provider: the Panamanian law firm Mossack Fonseca. The Pandora Papers shine a light on a far wider cross-section of the lawyers and middlemen who are at the heart of the offshore industry.
The Pandora Papers provide more than twice as much information about the ownership of offshore companies. In all, the new leak of documents reveals the real owners of more than 29,000 offshore companies. The owners come from more than 200 countries and territories, with the largest contingents from Russia, the U.K., Argentina and China.
The 150 news outlets that joined the investigative partnership include The Washington Post, the BBC, The Guardian, Radio France, Oštro Croatia, the Indian Express, Zimbabwe’s The Standard, Morocco’s Le Desk and Ecuador’s Diario El Universo.
A global team was needed because the 14 offshore providers that are the sources of the leaked documents are headquartered around the globe, from the Caribbean to the Persian Gulf to the South China Sea.
Three of the providers are owned by former senior government officials: a former government minister and presidential adviser in Panama and a former attorney general of Belize, who controls two providers.
For a few hundred or a few thousand dollars, offshore providers can help clients set up a company whose real owners remain hidden. Or, for perhaps $2,000 to $25,000, they can set up a trust that, in some instances, allows its beneficiaries to control their money while embracing the legal fiction that they don’t control it – a bit of paper-shuffling creativity that helps shield assets from creditors, law enforcement and ex-spouses.
Offshore operatives don’t work in isolation. They partner with other secrecy providers around the globe to create interlocking layers of companies and trusts. The more complex the arrangements, the higher the fees – and the more secrecy and protection clients can expect.
The Pandora Papers show that an English accountant in Switzerland worked with lawyers in the British Virgin Islands to help Jordan’s monarch, King Abdullah II, secretly purchase 14 luxury homes, worth more than $106 million, in the U.S. and the U.K. The advisers helped him set up at least 36 shell companies from 1995 to 2017.
In 2017, the king bought a $23 million property overlooking a California surfing beach through a company in the BVI. The king paid extra to have another BVI company, owned by his Swiss wealth managers, act as the “nominee” director for the BVI company that bought the property.
In the offshore world, nominee directors are people or companies paid to front for whoever is really behind a company. Application forms sent to clients by Alcogal, the law firm working on the king’s behalf, say that the use of nominee directors helps “preserve privacy by avoiding the identity of the ultimate principal . . . being publicly accessible.”
In emails, offshore advisers used a code name for the king: “You know who.”
U.K. attorneys for the king said that he is not required to pay taxes under Jordanian law and that he has security and privacy reasons to hold property through offshore companies. They said the king has never misused public funds.
The attorneys also said that most of the companies and properties identified by ICIJ have no connection to the king or no longer exist, but declined to provide details.
Experts say that, as ruler of one of the Middle East’s poorest and most aid-dependent countries, the king has reasons to avoid flaunting his wealth.
“If the Jordanian monarch were to display his wealth more publicly, it wouldn’t only antagonize his people, it would piss off Western donors who have given him money,” Annelle Sheline, an expert on political authority in the Middle East, told ICIJ.
In neighboring Lebanon, where similar questions about wealth and poverty have been playing out, the Pandora Papers show top political and financial figures have also embraced offshore havens.
They include the current prime minister, Najib Mikati, and his predecessor, Hassan Diab, as well as Riad Salameh, the governor of Lebanon’s central bank, who is under investigation in France for alleged money laundering.
Marwan Kheireddine, Lebanon’s former minister of state and the chairman of Al Mawarid Bank, also appears in the secret files. In 2019, he scolded former parliamentary colleagues for inaction amid a dire economic crisis. Half the population was living in poverty, struggling to find food as grocers and bakeries closed.
“There is tax evasion and the government needs to address that,” Kheireddine said.
That same year, the Pandora Papers reveal, Kheireddine signed documents as owner of a BVI company that owns a $2 million yacht.
Al Mawarid Bank was one of many in the country that restricted customers’ U.S. dollar withdrawals to stem economic panic.
Wafaa Abou Hamdan, a 57-year-old widow, is among the regular Lebanese who remain angry at their country’s elites. Because of runaway inflation, her life savings plummeted from the equivalent of $60,000 to less than $5,000, she told Daraj, an ICIJ media partner.
“All my life’s efforts went in vain. I have been working continuously for the past three decades,” she said. “We are still struggling on a daily basis to maintain our living” while “the politicians and the bankers” have “all transferred and invested their money abroad.”
Kheireddine and Diab did not respond to requests for comment. In a written response, Salameh said he declares his assets and has complied with reporting obligations under Lebanese law. Mikati’s son, Maher, said it is common for people in Lebanon to use offshore companies “due to the easy process of incorporation” rather than a desire to evade taxes.
‘Coalition of the corrupt’
Imran Khan was elated when ICIJ’s Panama Papers investigation came out in April 2016.
“The leaks are God-sent,” the Pakistani politician and former cricket superstar said.
The Panama Papers revealed that the children of Pakistan’s prime minister at the time, Nawaz Sharif, had ties to offshore companies. This gave Khan an opening to hammer Sharif, his political rival, on what Khan described as the “coalition of the corrupt” ravaging Pakistan.
“It is disgusting the way money is plundered in the developing world from people who are already deprived of basic amenities: health, education, justice and employment,” Khan told ICIJ’s partner, The Guardian, in 2016. “This money is put into offshore accounts, or even western countries, western banks. The poor get poorer. Poor countries get poorer, and rich countries get richer. Offshore accounts protect these crooks.”
Ultimately, Pakistan’s top court removed Sharif from office as a result of an inquiry sparked by the Panama Papers. Khan swept in to replace him in the next national election.
ICIJ’s latest investigation, the Pandora Papers, brings renewed attention to the use of offshore companies by Pakistani political players. This time, the offshore holdings of people close to Khan are being disclosed, including his finance minister and a top financial backer.
The documents also show that Khan’s water resources minister, Chaudhry Moonis Elahi, contacted Asiaciti, an Singapore-based offshore services provider, in 2016 about setting up a trust to invest the profits from a family land deal that had been financed by what the lender later claimed was an illegal loan. The bank told Pakistani authorities that the loan had been approved due to the influence of Elahi’s father, a former deputy prime minister.
Asiaciti records say that Elahi backed off from putting money into a trust in Singapore after the provider told him it would report the details to Pakistani tax authorities.
Elahi did not respond to ICIJ’s requests for comment. Hours before the release of Pandora Papers stories, a family spokesman told ICIJ media partners that “misleading interpretations and data have been circulated in files for nefarious reasons.” The spokesman added that the family’s assets “are declared as per applicable law.”
Also today, a spokesperson for Khan told a press conference that if any of his ministers or advisors had offshore companies, “they will have to be held accountable.”
Other political figures have also spoken out against the offshore system while surrounded by appointees and other supporters who have assets stowed offshore. Some who have spoken out have used the system themselves.
“Every public servant’s assets must be declared publicly so that people can question and ask – what is legitimate?” Kenyan President Uhuru Kenyatta told the BBC in 2018. “If you can’t explain yourself, including myself, then I have a case to answer.”
The leaked records listed Kenyatta and his mother as beneficiaries of a secretive foundation in Panama. Other family members, including his brother and two sisters, own five offshore companies with assets worth more than $30 million, the records show.
Kenyatta and his family did not reply to requests for comment.
Czech Prime Minister Andrej Babis, one of his country’s richest men, rose to power promising to crack down on tax evasion and corruption. In 2011, as he became more involved in politics, Babis told voters that he wanted to create a country “where entrepreneurs will do business and will be happy to pay taxes.”
The leaked records show that, in 2009, Babis injected $22 million into a string of shell companies to buy a sprawling property, known as Chateau Bigaud, in a hilltop village in Mougins, France, near Cannes.
Babis has not disclosed the shell companies and the chateau in the asset declarations he’s required to file as a public official, according to documents obtained by ICIJ’s Czech partner, Investigace.cz. In 2018, a real estate conglomerate indirectly owned by Babis quietly bought the Monaco company that owned the chateau.
Babis didn’t respond to requests for comment.
A spokesman for the conglomerate told ICIJ that it complies with the law. He didn’t respond to questions about the acquisition of the chateau.
“Like any other business entity, we have the right to protect our trade secrets,” the spokesman wrote.
‘A haven of scams’
The secret files provide a layer of behind-the-curtain context to public pronouncements this year about wealth and offshore refuges — as governments around the world struggle with revenue crunches, a pandemic, climate change and public distrust.
In February, a commentary from the Tony Blair Institute for Global Change urged policymakers to seek, among other measures, higher taxes on land and homes. Blair, the institute’s founder and executive chairman, talked about how the rich and well-connected shirk paying their share of taxes as far back as 1994, when he campaigned to become the leader of the U.K.’s Labour Party.
“For those who can employ the right accountants, the tax system is a haven of scams, perks … and profits,” he said during a speech in England’s West Midlands. “We should not make our tax rules a playground for …. tax abusers who pay little or nothing while others pay more than their share.”
The Pandora Papers show that, in 2017, Blair and his wife, Cherie, became the owners of a $8.8 million Victorian building by acquiring the British Virgin Islands company that held the property. The London building now hosts Cherie Blair’s law firm.
The records indicate that Cherie Blair and her husband, who served as a diplomat in the Middle East after stepping down as prime minister in 2007, bought the offshore company that owned the building from the family of Bahrain’s industry and tourism minister, Zayed bin Rashid al-Zayani.
By purchasing the company shares instead of the building, the Blairs benefited from a legal arrangement that saved them from having to pay more than $400,000 in property taxes.
The Blairs and the al-Zayanis said they didn’t initially know about each other’s involvement in the deal.
Cherie Blair said that her husband was not involved in the transaction and that its purpose was “bringing the company and the building back into the U.K. tax and regulatory regime.”
She also said that she “did not want to be the owner of a BVI company” and that the “seller for their own purposes only wanted to sell the company.” The company is now closed.
Through their lawyer, the al-Zayanis said their companies “have complied with all U.K. laws past and present.”
“These are loopholes that are available to wealthy people but not available to others,” Robert Palmer, executive director of Tax Justice UK, told The Guardian. “Politicians need to fix the tax system so that everyone pays their fair share.”
In June, Brazil’s economics minister, Paulo Guedes, proposed a tax reform package that included a 30% tax on profits earned through offshore entities. Experts estimate that Brazil’s richest people hold almost $200 billion in untaxed funds outside the country.
“You cannot be ashamed of being rich,” Guedes said. “You have to be ashamed of not paying taxes.”
After bankers and business leaders objected to tax hikes in the legislation, Guedes, a millionaire former banker, agreed to remove the proposed tax on offshore profits. Negotiations over the legislation are continuing.
The Pandora Papers reveal that Guedes created Dreadnoughts International Group in 2014 in the British Virgin Islands.
In response to questions from an ICIJ partner in Brazil, Revista Piauí, a spokesperson for Guedes said the minister has disclosed the company to Brazilian authorities. The spokesperson did not answer a question about the removal of the offshore tax from the legislation.
‘Pandora’s box’
In December 2018, the Bahamas enacted legislation requiring companies and certain trusts to declare their real owners to a government registry. The island nation was under pressure from larger countries, including the U.S., to do more to block tax dodgers and criminals from the financial system.
Some Bahamian politicians opposed the move. They complained the register would discourage Latin American clients from doing business in the Caribbean. “The winners of these new double standards are the U.S. states of Delaware, Alaska and South Dakota,” one local attorney said.
Months later, a confidential document indicated that the family of the Dominican Republic’s former Vice President Carlos Morales Troncoso had abandoned the Bahamas as a go-to sanctuary for their wealth.
For their new refuge, they chose a place 1,600 miles away: Sioux Falls, South Dakota.
The family set up South Dakota trusts, leaked records show, to lay away various assets, including shares they’d held in a Dominican sugar company. The family did not respond to questions about the assets moved from the Bahamas to South Dakota.
The Pandora Papers provide details about tens of millions of dollars moved from offshore havens in the Caribbean and Europe into South Dakota, a sparsely populated American state that has become a major destination for foreign assets.
Over the past decade, South Dakota, Nevada and more than a dozen other U.S. states have transformed themselves into leaders in the business of peddling financial secrecy. Meanwhile, most of the policy and law enforcement efforts of the world’s most powerful nations have stayed focused on “traditional” offshore havens such as the Bahamas, the Caymans and other island paradises.
The U.S. is one of the biggest players in the offshore world. It is also the country best situated to bring an end to offshore financial abuses, thanks to the outsize role it plays in the international banking system. Because of the U.S. dollar’s status as the de facto global currency, most international transactions flow in and out of New York-based banking operations.
U.S. authorities have taken action over the past two decades to force banks in Switzerland and other countries to turn over information about Americans with overseas accounts.
But the U.S. is more interested in forcing other countries to share information about Americans banking offshore than in sharing information about money moving through U.S. bank accounts, companies and trusts.
The U.S. has refused to join a 2014 agreement supported by more than 100 jurisdictions, including the Cayman Islands and Luxembourg, that would require American financial institutions to share information they have about foreigners’ assets.
Year after year in South Dakota, state lawmakers have approved legislation drafted by trust industry insiders, providing more and more protections and other benefits for trust customers in the U.S. and abroad. Customer assets in South Dakota trusts have more than quadrupled over the past decade to $360 billion.
“As a citizen, I’m so sad that my state was the state that opened Pandora’s box,” Susan Wismer, a former lawmaker, told ICIJ.
By 2020, 17 of the world’s 20 least-restrictive jurisdictions for trusts were American states, according to a study by Israeli academic Adam Hofri-Winogradow. In many cases, he said, U.S. laws have made it more difficult for creditors to put their hands on what they are owed, including child support payments from absent parents.
Using documents from the Pandora Papers, ICIJ and The Washington Post identified nearly 30 U.S.-based trusts linked to foreigners personally accused of misconduct or whose companies were accused of wrongdoing.
Among them is Federico Kong Vielman, whose family is one of Guatemala’s economic powerhouses.
In 2016, Kong Vielman moved $13.5 million into a trust in Sioux Falls. Some of the money came from his family’s company, which makes floor waxes and other products.
Guatemalan media reported for decades on the family’s ties to politics. In the 1970s, the family was identified as a key ally of Gen. Carlos Manuel Arana Osorio, the former Guatemalan dictator known as the “Jackal of Zacapa.” In 2016, the family’s luxury hotel in Guatemala City made a gift of 100 free nights to then-President Jimmy Morales. Guatemalan media outlets reported that a possible payment for “political favors” was suspected.
In 2014, U.S. labor officials filed a complaint against Guatemala’s government that included allegations that the family’s palm oil company underpaid workers and exposed them to toxic chemicals. Company records show Kong Vielman was previously the company’s treasurer.
A year later, U.S. environmental authorities, providing technical assistance to Guatemala, found that the company released pollutants into the Pasion River. The family company, Nacional Agro Industrial SA, known as Naisa, was not charged.
Naisa told ICIJ that it followed the law and did not pollute the river. The labor complaint was resolved by an arbitration panel, the company said.
Kong Vielman declined to respond to questions about the South Dakota trust.
Another wealthy Latin American who set up trusts in South Dakota is Guillermo Lasso, a banker who was elected as Ecuador’s president in April. Leaked records show that Lasso moved assets into two trusts in South Dakota in December 2017, three months after Ecuador’s parliament passed a law prohibiting public officials from holding assets in tax havens. The records show that Lasso moved two offshore companies to the South Dakota trusts from two secretive foundations in Panama.
Lasso said that his past use of offshore entities was “legal and legitimate.” Lasso said he complies with Ecuadorian law.
Trusts set up in South Dakota and many other U.S. states remain cloaked in secrecy, despite enactment this year of the federal Corporate Transparency Act, which makes it harder for owners of certain types of companies to hide their identities.
The law is not expected to apply to trusts popular with non-U.S. citizens. Another glaring exemption, financial crime experts say, is that many lawyers who set up trusts and shell companies have no obligations to examine the sources of their clients’ wealth.
“Clearly the U.S. is a big, big loophole in the world,” said Yehuda Shaffer, former head of the Israeli financial intelligence unit. “The U.S. is criticizing all the rest of the world, but in their own backyard, this is a very, very serious issue.”
‘Extraordinary expenses’
Billionaire Erman Ilicak’s construction empire had a big year in 2014.
The Turkish mogul’s company, Rönesans Holding, finished building a 1,150-room presidential palace for his country’s pugnacious leader, Recep Tayyip Erdoğan, amid media rumblings about cost overruns and corruption and a court order attempting to stop the project.
Another notable event involving the Ilicak family took place in 2014, this time out of the public glare. The corporate titan’s 74-year-old mother, Ayse Ilicak, became the owner of two offshore companies in the British Virgin Islands, according to the Pandora Papers.
Both companies were fronted by nominee directors and nominee shareholders. One of the companies, Covar Trading Ltd., held assets from the family’s construction conglomerate, the records say. During its first full year in operation, Covar Trading earned $105.5 million in income from dividends, according to confidential financial statements. The money was stashed in a Swiss account.
It didn’t stay long.
That same year, the statements show, the company paid almost the entire $105.5 million as a “donation” listed under “extraordinary expenses.” The statements do not describe who or what received the money.
Illiack did not reply to questions for this story.
Ilicak and the other billionaires in the Pandora Papers come from 45 countries, with the largest number from Russia (52), Brazil (15), the U.K. (13) and Israel (10).
The American billionaires mentioned in the secret documents include two tech moguls, Robert F. Smith and Robert T. Brockman, whose trusts have been the targets of investigations by U.S. authorities. Both were clients of CILTrust, an offshore provider in Belize operated by Glenn Godfrey, a former attorney general of Belize.
Sign up to receive all the Pandora Papers news, delivered straight to your inbox.
Smith agreed last year to pay U.S. authorities $139 million to settle a tax probe and is cooperating with prosecutors. A U.S. grand jury indicted Brockman, Smith’s mentor and financial backer, in what prosecutors called the biggest tax fraud in U.S. history.
Smith declined to comment. Brockman has pleaded not guilty.
Neither CILTrust nor Godfrey have been accused of wrongdoing. Godfrey did not respond to requests for comment.
A law firm in Cyprus, Nicos Chr. Anastasiades and Partners, appears in the Pandora Papers as a key offshore go-between for wealthy Russians. The firm retains the name of its founder, Cyprus President Nicos Anastasiades, and the president’s two daughters are partners there.
The records show that, in 2015, a compliance manager at the Panama law firm Alcogal found that the Cypriot law firm helped a Russian billionaire and former senator, Leonid Lebedev, conceal ownership of four companies by listing law firm employees as owners of Lebedev’s entities.
Lebedev – an oil tycoon and movie producer with Hollywood connections – fled Russia in 2016 after authorities accused him of embezzling $220 million from an energy company. Lebedev did not respond to requests for comment. The status of the Russian case is unclear.
The Cypriot law firm also prepared reference letters for Russian steel magnate Alexander Abramov, including one drafted days after the U.S. added the billionaire’s name to the list of oligarchs close to President Putin. Abramov didn’t respond to requests for comment.
Theophanis Philippou, the law firm’s managing director, told the BBC, an ICIJ partner, that it has never misled authorities or concealed the identity of a company owner. He declined to comment on clients, citing attorney-client confidentiality.
Another Russian in the Pandora Papers who has ties to Putin is Konstantin Ernst, a television executive and Oscar-nominated producer. He has been called Putin’s top image-maker, a creative talent who sold the nation on the idea that the president is “Russia’s strong-willed savior.”
The Pandora Papers reveal that Ernst was given a chance to participate in a lucrative opportunity soon after producing the opening and closing ceremonies of the 2014 Winter Olympics at Sochi, creating a spectacle that boosted Putin’s reputation inside and outside the country.
Ernst became a silent partner, hidden behind layers of offshore companies, in a state-funded privatization contract – a deal to buy dozens of movie theaters and other property from the city of Moscow.
The leaked records show that, by 2019, the value of Ernst’s personal stake in the property holdings topped $140 million.
Ernst told ICIJ that he has “never made a secret” of his involvement in the privatization deal, and that the deal was not compensation for his work during the 2014 Olympics.
“I haven’t committed any illegal actions,” he said. “Nor am I committing any now or about to. This is how my parents raised me.”
‘Our way of life’
As a human rights and anti-poverty activist, Mae Buenaventura joined the fight to secure the return of billions of dollars the late Philippine dictator Ferdinand Marcos, his family and cronies concealed in Swiss accounts and other hard-to-trace locations.
Many in her home country, Buenaventura said, “know that the wealthy have ways and means to accumulate riches and also hide them in a way that ordinary people cannot get their hands on.”
The Marcos scandal also educated the world, encouraging stepped-up efforts to discover illicit money and punish the people who hide it.
Over the last 20 years, political leaders have vowed to “eradicate” tax havens. They’ve called shell companies and money laundering “threats to our security, our democracy and our way of life.” They’ve passed new laws and inked international agreements.
But the offshore system is nothing if not adaptable, and cross-border financial crime and tax dodging continue to thrive.
When an offshore provider or jurisdiction is exposed by a leak or comes under pressure from authorities, others use its misfortune as a marketing opportunity, snapping up clients fleeing for safer havens.
An ICIJ analysis identified hundreds of offshore companies that ended relationships with the scandal-tarred law firm Mossack Fonseca after the release of the Panama Papers investigation. Other providers took over as the companies’ offshore agents.
Do you have a story about corruption, fraud, or abuse of power?
ICIJ accepts information about wrongdoing by corporate, government or public services around the world. We do our utmost to guarantee the confidentiality of our sources.
One of those companies was controlled by an offshore trust whose beneficiaries included the wife of Jacob Rees-Mogg, a member of the British Conservative Party and current leader of the House of Commons.
The Pandora Papers indicate that a holding company and a trust benefiting his spouse, Helena de Chair, owned “pictures and paintings” worth $3.5 million.
Another company that moved away from Mossack Fonseca was a BVI entity controlled by the widow and two sons of Indian underworld figure Iqbal Memon. Memon has been identified in news reports as a major drug dealer with links to terrorists. His widow and sons are accused of laundering drug money and have been wanted since 2019 by authorities in New Delhi.
In the Philippines, money being moved around in the shadows continues to be a problem, despite the attention given to Marcos’ offshore loot. In recent years, the U.S. has labeled the Philippines as a “major money laundering jurisdiction.”
Philippine political figures in the Pandora Papers include Juan Andres Donato Bautista. He served from 2010 to 2015 as the chairman of the Presidential Commission on Good Government – the panel established to track down Marcos’ billions.
A month after he was appointed to lead the commission, Bautista created a shell company in the British Virgin Island that held a bank account in Singapore, secret records show.
Bautista was later tapped to head the country’s election agency, but lawmakers impeached him in 2017 after his wife claimed he’d hoarded millions of dollars in undeclared domestic and foreign accounts.
In a phone call and emails to ICIJ, Bautista said he created his BVI company on the advice of bankers. The bank account was opened before he joined the government, he said, adding that it never received significant deposits and that he disclosed his interests to authorities. He denied wrongdoing and said there are no formal charges against him.
Despite failures by the Philippines and other nations to curb the flow of covert money, Buenaventura and other reform advocates say there are reasons for hope.
Street protesters helped topple top leaders in Iceland and Pakistan after the Panama Papers. The Philippines has joined dozens of countries that now require companies to disclose their real owners. Philippine authorities have recovered roughly $4 billion stolen by Marcos and his circle, using it to buy land for landless farmers and to compensate families of people targeted for murder or “enforced disappearance” by the Marcos regime.
Many obstacles remain. Big banks, law firms and other powerful groups often oppose stronger transparency rules and tougher enforcement against offshore abuses. And in the Philippines and many other countries, anti-corruption activists endure legal threats, arrests and violence.
Last month police fired water cannons at protesters who marked the 49th anniversary of Marcos’ declaration of martial law by drawing attention to similarities with current President Rodrigo Duterte’s rule.
Buenaventura said she and other grass-roots activists will keep working to expose wealth that’s “deeply hidden.”
“Our slogan is: The truth will come out.”
Contributors: Michael W. Hudson, Scilla Alecci, Will Fitzgibbon, Agustin Armendariz, Sydney P. Freedberg, Margot Gibbs, Malia Politzer, Delphine Reuter, Emilia Díaz-Struck, Gerard Ryle, Ben Hallman, Dean Starkman, Fergus Shiel, Serdar Vardar and Pelin Ünker (DW Turkey), Elyssa Christine Lopez and Karol Ilagan (Philippine Center of Investigative Journalism), Pavla Holcová (Investigace, Czech Republic), Hala Nassredine (Daraj, Lebanon), Allan de Abreu (Revista Piauí, Brazil), Leo Sisti and Paolo Biondani (L’Espresso, Italy), Simon Goodley (The Guardian, U.K.), Ritu Sarin (The Indian Express), Nassos Stylianou (BBC, U.K.), Francisco Rodriguez and Enrique Naveda (Plaza Pública, Guatemala), Debra Cenziper (Washington Post, U.S.), Jelena Cosic, Spencer Woodman, Brenda Medina, Maggie Michael, Richard H.P. Sia, Kathleen Cahill, Joe Hillhouse, Mia Zuckerkandel, Asraa Mustufa, Hamish Boland-Rudder, Miguel Fiandor Gutiérrez, Pierre Romera, Madeline O’Leary, Tom Stites, Kathryn Kranhold, Margot Williams, Antonio Cucho Gamboa, Soline Ledésert, Bruno Thomas, Anne L’Hôte, Madeline O’Leary, Maxime Vanza Lutaonda, Denise Hassanzade Ajiri, Jesús Escudero, Marcos García Rey, Mago Torres, Karrie Kehoe, Sean McGoey, Anisha Kohli, Fakhar Durrani, Carlos Monteiro, Douglas Dalby and Laura Bullard.
Correction: Alexander Abramov was named in a U.S. congressional report submitted under the Countering America’s Adversaries Through Sanctions Act of 2017. An earlier version of this story erroneously stated that Abramov was sanctioned.
Source: https://www.icij.org/investigations/pandora-papers/global-investigation-tax-havens-offshore (https://www.icij.org/investigations/pandora-papers/global-investigation-tax-havens-offshore)
Reference 1: https://www.icij.org (https://www.icij.org)
Reference 2 (Database): https://offshoreleaks.icij.org (https://offshoreleaks.icij.org)
Reference 3a (Singapore - Officers): https://offshoreleaks.icij.org/search?c=SGP&cat=1&e=&j=&q=&utf8=%E2%9C%93 (https://offshoreleaks.icij.org/search?c=SGP&cat=1&e=&j=&q=&utf8=%E2%9C%93)
Reference 3b (Singapore - Companies): https://offshoreleaks.icij.org/search?c=SGP&cat=2&e=&j=&q=&utf8=%E2%9C%93 (https://offshoreleaks.icij.org/search?c=SGP&cat=2&e=&j=&q=&utf8=%E2%9C%93)
Reference 3c (Singapore - Addresses): https://offshoreleaks.icij.org/search?c=SGP&cat=3&e=&j=&q=&utf8=%E2%9C%93 (https://offshoreleaks.icij.org/search?c=SGP&cat=3&e=&j=&q=&utf8=%E2%9C%93)
Reference 4 (Indonesia - Officers): https://offshoreleaks.icij.org/search?c=IDN&cat=1&e=&q=&utf8=%E2%9C%93
-
Twitch confirms it was hacked after its source code and secrets leak out
By Tom Warren@tomwarren Oct 6, 2021
Twitch has confirmed that it has suffered a major data breach, and that a hacker accessed the company’s servers thanks to a misconfiguration change. “We can confirm a breach has taken place,” says a Twitch spokesperson on Twitter. “Our teams are working with urgency to understand the extent of this. We will update the community as soon as additional information is available.”
Twitch admits a hacker was able to access data that was mistakenly exposed to the internet “due to an error in a Twitch server configuration change that was subsequently accessed by a malicious third party.” The company says it has “no indication that login credentials have been exposed,” and that “full credit card numbers were not exposed.”
Hackers have so far leaked data that includes source code for the company’s streaming service, an unreleased Steam competitor from Amazon Game Studios, and details of creator payouts. An anonymous poster on the 4chan messaging board released a 125GB torrent earlier today, which they claim includes the entirety of Twitch and its commit history.
The leak has been labeled as “part one,” suggesting that there could be more to come. While personal information like creator payments is included, this initial leak doesn’t appear to include passwords, addresses, or email accounts of Twitch users. Instead, the leaker appears to have focused on sharing Twitch’s own company tools and information, rather than code that would include personal accounts.
It’s not clear how much data has been accessed, though. Twitch says it’s still working to understand its security breach, and it appears that some users are being asked to change their passwords. Twitch has also reset all stream keys on its service. “Out of an abundance of caution, we have reset all stream keys,” says an email to all Twitch streamers.
While Twitch is still investigating and says there’s no indication login details were exposed, we’d still recommend changing your Twitch password and enabling two-factor authentication if you haven’t already done so.
The Twitch leak will be damaging for the game streaming service either way and particularly for creators who rely on Twitch to keep their earnings and information secure. The hack follows weeks of protest for Twitch to improve its service under the #DoBetterTwitch movement. Twitch streamers also took a day off in August to protest against the company’s lack of action against hate raids.
Source: https://www.theverge.com/2021/10/6/22712365/twitch-data-leak-breach-security-confirmation-comments
-
Singapore employment agency hacked, IC scans and salaries of 40,000 job seekers uploaded online
Thu, Oct 21, 2021 - 8:43 PM
[SINGAPORE] The personal details of some 40,000 job applicants have been leaked online, following a cyber attack on an employment agency here.
Protemps Employment Services, which has an office at Paya Lebar Square, had its entire server swiped and deleted earlier this month.
The personal details of about 40,000 people who submitted job applications to the company have since been uploaded online.
The details include scans of their identity cards or passports, their phone numbers, salaries, jobs and home addresses.
Most of the job seekers appeared to be Singaporean.
The hackers, known as Desorden Group, said they were behind the attack on Oct 4, boasting about their heist on hacking forums on Oct 7.
They made a video showing the stolen files and databases, and a message to Protemps, saying they had stolen all the files from the server and had wiped it clean.
It also came with a warning for Protemps to "think carefully".
The video is believed to have been sent to Protemps along with a ransom note.
On Oct 14, Desorden Group uploaded the entire database online, making it accessible for the price of 2.10 euros (S$3.30).
It has been accessed by at least 60 different entities since.
A spokesman for the Personal Data Protection Commission (PDPC), which is part of the Infocomm Media Development Authority (IMDA), said Protemps has notified them and it is investigating the incident.
Protemps' website, which was taken offline following the attack, appears to have been partially restored as of Thursday (Oct 21).
Desorden Group is known to target organisations relating to supply chains.
Its name is Spanish, and translates to disorder and chaos. Its modus operandi is to pilfer data from their targets and demand ransom. When victims fail to pay, the group then sells the data on the black market.
Source: https://www.singaporelawwatch.sg/Headlines/spore-employment-agency-hacked-ic-scans-and-salaries-of-40000-job-seekers-uploaded-online (http://edusg.us/forumsmf/index.php/topic,338.150.html)
Employment agency that suffered data breach says most stolen data is from fake profiles
Protemps Employment Services had its data stolen and deleted on Oct 4 and the stolen data was uploaded online three days later
David Sun | Oct 27, 2021
SINGAPORE - An employment agency that suffered a data breach earlier this month has issued a statement acknowledging the incident, but said it never received any ransom demand to recover the data.
In its first comments on the attack, Protemps Employment Services said on Wednesday (Oct 27) that most of the stolen data was from fake profiles.
Protemps' entire server had its data stolen and deleted on Oct 4, and the stolen data was uploaded online three days later.
The hackers claiming the attack called themselves Desorden Group.
The data purportedly contained the personal details of about 40,000 people who had submitted job applications to the company.
However, Ms Dorothy Neo, the managing director of Protemps, told The Straits Times on Wednesday that the actual number of people affected was less than that claimed by the hackers.
She said most of the purported details were from fake resumes sent to the company through spam accounts, and that only 2,500 real applicants were affected.
Of these, she said only 300 profiles contained "full details", including education background, salaries, contact numbers and addresses.
Desorden Group had made a video showing the stolen files and databases and which carried a warning to Protemps to "think carefully".
However, Ms Neo said Protemps neither received nor paid any ransom demand, which is usually the reason for such data theft.
"There was no ransom note sent to our vendor or Protemps to pay any amount to secure the release of data on our website," she said.
"Protemps is committed to support our customers as we resolve this incident."
She added that Protemps, which has an office at Paya Lebar Square, has contacted those affected to notify them of the breach.
The hackers, known as Desorden Group, said they were behind the attack on Oct 4, 2021. PHOTO: DESORDEN GROUP
The Personal Data Protection Commission was alerted to the incident, which was reported by The Straits Times on Oct 21, and investigations are ongoing.
Ms Neo had initially declined to comment, but said she was choosing to do so now as the company's working relationship with clients had been affected.
Desorden Group is known to target organisations related to supply chains.
Its name is Spanish and translates into "disorder and chaos".
The data stolen from Protemps had been accessed by more than 60 entities when the breach was reported last week.
It has since been accessed by about 120 entities.
Source: https://www.straitstimes.com/singapore/courts-crime/employment-agency-that-suffered-data-breach-said-most-stolen-data-was-from
-
3 Million CoinMarketCap Email Addresses Have Leaked
by Mike Dalton | 23 Oct 2021
Email addresses belonging to 3.1 million CoinMarketCap users were leaked last week, according to Have I Been Pwned.
Leak Took Place Last Week
Have I Been Pwned says that the website’s database was breached on Oct. 12, 2021. Exactly 3,117,548 email addresses, not including passwords, were stolen in the security breach.
CoinMarketCap reportedly admitted that “batches of data have shown up online purporting to be a list of user accounts” and that it has “found a correlation with [its] subscriber base.”
However, the way in which the data was leaked is still unknown. “We have not found any evidence of a data leak from our own servers,” CoinMarketCap noted, adding that it will provide future updates.
The fact that the leaked data does not include passwords, combined with the fact that CoinMarketCap does not act as an exchange, means the attack is unlikely to cause a large-scale theft.
Data Leaks Are Common
Despite the lack of immediate risks, this leak nevertheless damages user privacy. It could also give attackers the resources to carry out further attacks, especially given that CoinMarketCap has acknowledged phishing campaigns in the past.
Several other crypto companies including Celsius, Ledger, and BitMEX have experienced similar leaks concerning email addresses and user information. Each of those leaks took place over the last two years.
Crypto exchange Binance, which owns CoinMarketCap, was targeted by an unrelated attack in 2019. That attack succeeded in stealing 2% of the company’s Bitcoin holdings.
Disclaimer: At the time of writing this author held less than $75 of Bitcoin, Ethereum, and altcoins.
Source: https://cryptobriefing.com/3-million-coinmarketcap-email-addresses-have-leaked
-
Third-party data breach in Singapore hits healthcare provider
Fullerton Health says its third-party vendor, which platform facilitates appointment booking, had suffered a security breach first detected on October 19 that compromised patients' personal data, including name and contact details as well as bank account information.By Eileen Yu for By The Way | October 26, 2021 | Topic: Security
Another third-party security breach has been reported in Singapore, this time, affecting patients of Fullerton Health and compromising personal data that included bank account details in "a few cases". The affected vendor Agape Connecting People, which platform facilitates appointment booking, first detected the breach on October 19 and appeared to affect only Fullerton Health.
The healthcare services provider said none of its own IT systems, network, and databases were impacted by the breach. It filed reports with both the police and Personal Data Protection Commission, which oversees Singapore's Personal Data Protection Act.
Agape first detected the intrusion on October 19 and "acted immediately" to isolate and suspend use of the system, the vendor said in a statement Monday.
"None of our core infrastructure has been compromised," it said, adding that the breach "appears" to be limited to Fullerton Health. However, it noted that it still was in the process of confirming that no other clients were affected.
Lulled into complacency, businesses face risks of supply chain attacks even after they have done their due diligence in assessing their third-party suppliers' security posture before establishing a partnership.
Describing itself as a social enterprise, Agape operates a contact centre to provide employment for the disadvantage, including inmates, physically disabled, ex-offenders, and single mothers. It has a capacity of more than 250 seats and aims to support 1,000 disadvantaged individuals by 2022.
Agape said it was working with cybersecurity experts to implement "mitigating action" to minimise further impact from the breach.
Fullerton Health said on October 21 it was alerted "a few days ago" that its customer personal data could have been exposed and initiated an investigation. It found that an unauthorised party had gained access to a server used by Agape, compromising personal data of patients with whom Agape had assisted in making appointments.
Such details included names, identification numbers, and contact details, as well as bank account details in "a few cases" and "certain limited health-related information". No credit card information or passwords were leaked, Fullerton Health said. The company services corporate clients and their employees, one of whom at least had been confirmed to have their personal data potentially exposed.
Fullerton Health said it still was working to ascertain the number and identity of individuals affected by the breach. Digital forensic and cybersecurity professionals had been roped in to help with its investigations, the healthcare provider said, adding that they also were trying to determine the root cause and full extent of the breach.
"We are conducting a thorough review of our processes and protocols relating to data security and the use of third-party service providers to further strengthen our information security," Fullerton Health said.
It said data relating to COVID-19 vaccinations carried out at its vaccination centres were not compromised, since the information had been stored separately on a system not shared with Agape.
Singapore has seen a spate of supply chain attacks this past year that compromised personal data of, amongst others, 580,000 Singapore Airlines (SIA) frequent flyers, 129,000 Singtel customers, and 30,000 individuals in an incident involving job-matching organisation e2i.
The Singapore Computer Emergency Response Team (SingCERT) last year handled 9,080 cases, up from 8,491 the year before and 4,977 in 2018, with marked increases in ransomware, online scams, ad COVID-19 phishing activities, revealed a July 2021 report released by Cyber Security Agency of Singapore (CSA).
The number of reported ransomware attacks saw a significant spike of 154% in 2020, with 89 incidents, compared to 35 in 2019. These mostly affected small and midsize businesses (SMBs) in various sectors including manufacturing, retail, and healthcare.
Source: https://www.zdnet.com/article/third-party-data-breach-in-singapore-hits-healthcare-provider
Reference: https://www.fullertonhealth.com/sg/third-party-information-breach-incident
-
Singapore Airlines frequent flyer members hit in third-party data security breach
Data belonging to 580,000 Krisflyer and PPS members have been compromised in a cybersecurity attack that hit air transport IT company SITA, making Singapore Airlines the second carrier in the week to report a data breach.
By Eileen Yu for By The Way | March 5, 2021 | Topic: Security
Data belonging to 580,000 Singapore Airlines' frequent flyer members have been compromised in a cybersecurity attack that originally hit air transport communications and IT vendor, SITA. The incident marks the second time in a week that an airline has reported a data breach, which appears also to be the result of the attack targeting SITA.
While not a customer of SITA, Singapore Airlines (SIA) had shared a "restricted" set of data as a member of the Star Alliance group, the airline said in a statement late-Thursday. This was necessary to facilitate verification of membership tier status and provide customers of other member airlines the relevant benefits while they travelled.
Such data would reside on the passenger service systems of member airlines, SIA said. The national carrier did not specify when it was informed by SITA about the breach, which impacted the latter's passenger service system servers.
Caught by the sudden onslaught of COVID-19, most businesses lacked or had inadequate security systems in place to support remote work and now have to deal with a new reality that includes a much wider attack surface and less secured user devices.
One member of Star Alliance had used this SITA system. The international airline alliance has 26 members, including Air Canada, United Airlines, and Lufthansa.
Affected SIA customers were members of its KrisFlyer as well as higher tier PPS frequent flyer programme, the airline said, adding that compromised data was limited to the membership number and tier status, though, there were some instances in which membership name also was illegally accessed.
The data leakage was relatively contained because these were the only details shared with the Star Alliance group.
"Specifically, this data breach does not involve KrisFlyer and PPS member passwords, credit card information, and other customer data such as itineraries, reservations, ticketing, passport numbers, and email addresses," the Singapore carrier said. "We would also like to reassure all customers that none of SIA's IT systems have been affected by this incident."
On its part, SITA released a statement on its website confirming the security breach was the result of "a highly sophisticated attack".
It said it ascertained the "seriousness" of the incident on February 24, after which it took "immediate action" to inform all affected customers. Adding that it deployed "targeted" containment measures, SITA said its security incident response team was investigating the breach alongside external cybersecurity experts.
In an email response to ZDNet's questions, a SITA spokesperson declined to say when the breach was first discovered internally prior to the February 24 notification, citing "tactical and security reasons". She reiterated that investigations and forensic work were ongoing, and was unable to confirm how compromised systems were infiltrated.
She also would not reveal which other organisations were impacted by the breach or the types of data that was compromised, as it still was in the process of informing all affected parties.
She did, however, point to several airlines that already had reached out to their customers and made public statements confirming they were affected by the data breach. These included Jeju Air, Finnair, and Malaysia Airlines, she said.
This indicated that SITA was involved in a breach reported earlier this week that affected Malaysia Airlines' Enrich frequent flyer members. While it had yet to make a public statement on the security incident, the airline told Enrich members it was the result of an attack that targeted a third-party IT service provider, which it did not name.
In its note, which offered scant details of the breach, Malaysia Airlines said compromised information had included date of birth and contact information between the period of March 2010 and June 2019.
In her response to ZDNet, the SITA spokesperson clarified that this timeframe referred to the date during which the compromised data was registered. It did not refer to the length of the window of compromise, which she revealed to be less than a month.
According to SITA, the vendor has 2,800 customers including airlines, airports, and government agencies. Pre-pandemic, 146 million passengers used its in-flight mobile service, it said.
Source: https://www.zdnet.com/article/singapore-airlines-frequent-flyer-members-hit-in-third-party-data-security-breach/
Reference 1: https://www.singaporeair.com/en_UK/sg/media-centre/news-alert
Reference 2: https://www.sita.aero/pressroom/news-releases/sita-statement-about-security-incident/
-
1,355 NUS Society members' personal data stolen, possibly put on sale on Dark Web
Nov 02, 2021
SINGAPORE - The personal data of 1,355 National University of Singapore Society (NUSS) members has been stolen after the society's website was hacked early last month, NUSS said on Monday (Nov 1).
Asked if the names of members were also stolen, NUSS would only say that NRIC numbers which match the names of 1,355 members had been accessed.
Other information potentially stolen included food and beverage orders, restaurant and event registrations, and feedback sent through the NUSS website.
The data was taken from NUSS' website, which was hosted by a third party Web hosting provider.
Investigations found that the hacker had carried out a sophisticated attack on the society's website on Oct 6 and 7, and downloaded some data stored on the NUSS Web server.
NUSS added that it is actively reviewing its security measures and processes to ensure an incident like this cannot happen again. The matter has been reported to the Personal Data Protection Commission and the police.
The maximum fine for a data breach is $1 million. But organisations can soon be fined more - up to 10 per cent of their annual turnover in Singapore, or $1 million, whichever is higher. The higher fine is slated to take effect at least 12 months from Feb 1 this year.
Members should notify sellers or service providers immediately if they receive goods or services they did not order, or get notifications for them. This is because cyber criminals could try to trick victims into giving up more information, said NUSS.
Crooks could attempt to contact members through e mail and SMS messages, or through phone calls by posing as representatives from a government authority or business.
Source: https://tnp.straitstimes.com/news/singapore/1355-nus-society-members-personal-data-stolen-possibly-put-sale-dark-web
-
3.8 Billion Users’ Combined Clubhouse, Facebook Data Up for Sale
Becky Bracken | September 27, 2021
Combined cache of data likely to fuel rash of account takeover, smishing attacks, experts warn.
On its own, the database of 3.8 billion phone numbers leaked from social-media platform Clubhouse didn’t have much value on the underground market. In fact, they were eventually dumped in a hacker forum for free.
But an enterprising threat actor has reportedly combined those phone numbers with 533 million Facebook profiles leaked last April and is selling that enhanced trove of personal identifiable information (PII) to the highest bidder on the underground market.
According to CyberNews, the combined Clubhouse-Facebook database includes names, phone numbers and other data, and is listed on an underground forum for $100,000 for all 3.8 billion entries, with smaller chunks of data available for less. Reportedly, the seller is still looking for buyers.
Data Likely to Fuel ATO Attacks
These credentials could quickly be leveraged for basic account takeover (ATO) attacks, according to Brian Uffelman, who is a security analyst for PerimeterX.
“These stolen credentials are then used for credential-stuffing and ATO attacks, which can steal value, whether that is in the form of gift cards, credit-card numbers, loyalty points or making false purchases,” Uffelman told Threatpost. “ATO attacks are a major threat to any business and all of this just creates more fuel to feed the ATO attack fire.”
He added that it’s much easier for cybercriminals to use stolen credentials than to do the work of trying to find holes in an organization’s cybersecurity defenses. In fact, Uffelman pointed out PerimeterX research showed out of all login attempts measured in the second-half of 2020, up to 85 percent were ATO attempts.
“Organizations need to be aware of signs that they’ve been attacked,” Uffelman warned. “These can include surges in help-desk calls, spikes in password resets and inhuman user behaviors, such as thousands of login attempts on an account in a short time period and then take the appropriate action to block these attacks.”
Users need to be aware of signs of breach, too, he added.
“Consumers need to ensure they are using varied and robust passwords across different websites and applications and lock down their credit reports as well.”
Facebook-Clubhouse Data Will Fuel Smishing Attacks
Smishing, or socially engineered phishing attempts conducted through SMS text messages, is a likely way cybercriminals will try to turn this database into profit, Jake Williams, from BreachQuest told Threatpost.
“With this information, threat actors can send SMS phishes while spoofing the sender’s number of a known friend,” Williams said. “A threat actor could go even further by using an SMS phishing pretext tailored to the victim based on their recent Facebook posts. Users are advised to be extremely careful in acting on unexpected SMS messages, even from senders they believe they know.”
Williams added that Clubhouse users need to be on the lookout for suspicious texts, particularly those asking to transfer funds or confirm requests with a phone call, which are both common smishing tactics.
And even if petty thieves don’t see the value in the information, John Bambenek from Netenrich told Threatpost that he suspects intelligence agencies will take notice.
“Breaches like these often get sold at a discount because the ones who stole the data don’t know what to do with it. In some cases, intelligence agencies will buy them if they have targets of interest on those platforms,” Bambenek said. “Likely the biggest use will go into the secondary consumer data market for those who want to build profiles for specific ad targeting.”
Beyond immediate ramifications of the enhanced data falling into the wrong hands, Archie Agarwal from ThreatModeler pointed out that as these leaks continue, it will enable threat actors to create incredibly rich profiles of targets.
“Aside from using data like this for more targeted scamming, there is a much larger concern,” Agarwal told Threatpost. “As we share more and more personal information across an ever-growing list of social-media platforms, combining data gleaned from this type of scraping, together with leaked breach information and leveraging big-data analytics to mine it, could potentially reveal previously hidden information and behaviors on users.”
Users Have Accepted Risks
While the infosec community is alarmed by the prospect of all that data floating around, Roger Grimes from KnowBe4 doesn’t expect the seller of the combined Clubhouse-Facebook data to get much finanical gain out of the deal.
“My bet is the seller doesn’t get anywhere close to their $100,000 asking price. It’s not a scarce resource,” Grimes said in an email to Threatpost.
He also noted that while he agrees the data could fuel future smishing and other socially engineered attacks, he doesn’t suspect much pushback from users.
“I think most people simply see this as a cost of using free internet services, Clubhouse or any other service,” he said.
Source: https://threatpost.com/clubhouse-facebook-data-sale/175023/ (https://threatpost.com/clubhouse-facebook-data-sale/175023/)
Reference 1: https://raidforums.com/Thread-SELLING-Clubhouse-Secret-Database-3-8B-Phone-Numbers (https://raidforums.com/Thread-SELLING-Clubhouse-Secret-Database-3-8B-Phone-Numbers)
Reference 2: https://raidforums.com/Thread-CSV-Sale-Sample-EXCLU-FRESH-2021-83-5M-Phone-numbers-JAPAN-Clubhouse-New-Social-Media-Database (https://raidforums.com/Thread-CSV-Sale-Sample-EXCLU-FRESH-2021-83-5M-Phone-numbers-JAPAN-Clubhouse-New-Social-Media-Database)
(http://edusg.us/images/202109_Clubhouse_RAIDforum.jpg)
-
Data breach at RedDoorz hit 6m customers; hospitality platform fined S$74,000
Nov 12, 2021 | Claudia Chong
HOSPITALITY platform RedDoorz was found to have compromised the security of 5.9 million customer records in the largest data breach incident since Singapore's Personal Data Protection Act came into force.
RedDoorz, a loss-making startup fuelled by venture capital, was fined S$74,000 in September for failing to prevent the external access and exfiltration of the data. The decision was published by the Personal Data Protection Commission (PDPC) on Thursday (Nov 11).
Millions of user records appeared to be advertised for sale on underground forums in September and October 2020 following the breach, The Business Times reported last December. The posts were later removed and the database was no longer available for purchase.
Formal investigations showed compromised records include the customer's name, contact number, email address, date of birth, a hashed password and their booking information. Masked credit card numbers were not accessed or downloaded.
The records were hosted in an Amazon cloud database. One or more threat actors likely obtained an access key embedded within an Android application package (APK), created by RedDoorz in 2015, that anyone could download from the Google Play Store.
An APK is a file format used by the Android operating system for the distribution and installation of mobile apps.
The APK and Amazon Web Services (AWS) access key were left out of RedDoorz's security reviews after the company wrongly labelled the APK as "defunct" and the access key as a "test" key.
RedDoorz blamed its failure to manage its inventory of infrastructure access keys on its high turnover of employees over the past few years. PDPC's deputy commissioner Yeong Zee Kin called the explanation unacceptable.
"The organisation's responsibility to protect personal data in its control or possession commences ought not to have been subjected to staff movement or appointment," he said.
AWS also cautioned users not to "embed access keys directly into code", which was what RedDoorz had done.
Yeong said a lengthy period of 2 years and 9 months passed from the time RedDoorz made its last update to the APK in January 2018 to when the company found out about the data breach last September.
In deliberating the financial penalty to be meted out, the Commission took into account several mitigating factors including RedDoorz's cooperation in investigations. It noted the company had conducted periodic security reviews, though efforts were ultimately futile as the reviews did not include the affected APK.
The Commission also considered the pandemic's severe impact on the hospitality industry that RedDoorz operates in.
Following the incident, RedDoorz amended its credential policy to clearly prohibit developers from embedding access codes in any code base. It upgraded its infrastructure to a private space to isolate the customer database from the Internet.
Among other remedial measures, the startup also separated the accounts for production and staging environments for all AWS services. It enabled two-factor authentication for all tools and accounts used by developers.
RedDoorz operates a hotel booking platform and budget hotel chains in South-east Asia. It entered the midscale hotel and economy lifestyle segments during the pandemic.
The startup has raised US$130.8 million in equity funding to date, data platform VentureCap Insights showed. Its revenue was S$11.6 million for the year ended Dec 2019, before the effects of the pandemic.
Singapore in November 2020 passed amendments to its data protection law that allow the PDPC to impose harsher fines and hold organisations accountable through mandatory reporting.
Under a key change to the Bill that has yet to take effect, a company that infringes the PDPA can be fined up to 10 per cent of its annual turnover in Singapore or S$1 million, whichever is higher. The current cap for financial penalties is S$1 million.
Source: https://www.businesstimes.com.sg/garage/data-breach-at-reddoorz-hit-6m-customers-hospitality-platform-fined-s74000
Reference 1: https://www.pdpc.gov.sg/all-commissions-decisions/2021/11/breach-of-the-protection-obligation-by-commeasure
Reference 1 (archive): https://archive.fo/OhQFU
-
GoDaddy data breach impacts 1.2 million WordPress site owners
Catalin Cimpanu | November 22, 2021
Internet infrastructure company GoDaddy said on Monday that a hacker gained access to the personal information of more than 1.2 million customers of its WordPress hosting service.
In documents filed with the US Securities and Exchange Commission earlier today, GoDaddy said it discovered the breach last week, on November 17, after noticing “suspicious activity” on its Managed WordPress hosting environment.
The subsequent investigation found that a hacker had access to its servers for more than two months, since at least September 6.
Based on current evidence, GoDaddy said the hacker gained access to the following information:
- Up to 1.2 million active and inactive Managed WordPress customers had their email addresses and customer numbers exposed.
- The original WordPress Admin password that GoDaddy issued to customers when a site was created.
- For active customers, sFTP and database usernames and passwords were exposed.
- For a subset of active customers, the SSL private key was exposed.
GoDaddy said it already reset sFTP and database passwords exposed in the hack. It also reset the admin account password for customers who were still using the default one that GoDaddy issued when their sites were created.
The company said it’s still in the process of issuing and installing new SSL certificates for affected customers, a process that is a little bit more complicated than resetting passwords.
GoDaddy said it notified law enforcement and is working with an IT forensics firm to investigate the incident further. Customer notifications have also been sent out today, The Record has learned from two site owners.
“We are sincerely sorry for this incident and the concern it causes for our customers,” said Demetrius Comes, Chief Information Security Officer at GoDaddy.
This is the company’s second breach in the past two years, after a hacker accessed SSH accounts for some customers in early 2020, according to a letter [PDF] filed with state officials in May 2020.
Source: https://therecord.media/godaddy-data-breach-impacts-1-2-million-wordpress-site-owners/ (https://therecord.media/godaddy-data-breach-impacts-1-2-million-wordpress-site-owners/)
Reference: https://www.sec.gov/Archives/edgar/data/1609711/000160971121000122/gddyblogpostnov222021.htm
-
Personal details of OG department store customers leaked in data breach
OG said that no financial information, such as credit card numbers, had been leaked. PHOTO: ST FILE
Rosalind Ang | 7 Jan 2022
SINGAPORE - There has been a leak of OG department store customers' personal data such as names, mobile numbers and dates of birth, said the retailer on Thursday (Jan 6).
In a statement to OG members, the department store said it was notified on Tuesday about the data breach, which affected members who are in either the basic or gold tiers.
In response to queries from The Straits Times, OG said it has asked its service provider to take immediate action to manage and remediate the breach and ensure that the database is secure.
A spokesman for OG said: “The management of OG is working closely with cyber security consultants and the authorities to strengthen our safeguards, systems and process. Our priority is to make sure customer data is safe.”
In the statement to its members, OG said its preliminary investigations indicated that the database, which had been stored and managed by an external third-party membership portal service provider, had been compromised.
“We are informing you (OG members) now so that you can take appropriate steps expeditiously to protect your online credentials,” the department store said.
The spokesman and the statement did not say how many members were affected.
Data that may have potentially been compromised includes the names of OG members, their mailing addresses, e-mail addresses, mobile numbers, genders, dates of birth, as well as encrypted NRIC data and passwords.
It added that no financial information, such as credit card numbers, had been leaked.
In its statement, OG said it has reported the matter to the police and other relevant authorities, including the Personal Data Protection Commission (PDPC) and the Cyber Security Agency of Singapore (CSA).
The retailer said that affected people should be wary of phishing or impersonation attempts. It urged members who have reused their OG membership password across different websites or platforms to change their passwords immediately to avoid any possible compromise of their other accounts.
Those affected by the incident can also enable additional security measures, such as multi-factor authentication if supported, said the retailer.
Those with questions and concerns can contact OG at pdp@og.com.sg
ST has contacted CSA and PDPC for comment.
Source: https://www.straitstimes.com/singapore/consumer/personal-data-of-og-department-store-customers-leaked
-
Credit Suisse data leak reveals decades of shady clients and activity
21 Feb 2022
Leaked data shows that until recently, Swiss bank Credit Suisse held accounts valued at more than $100 billion for sanctioned individuals and heads of state reportedly accused of money laundering.
The New York Times reported on Sunday that the data leak included more than 18,000 bank accounts. The data goes back to accounts that were open from the 1940s until into the 2010s, but not current operations.
Among the account holders holding “millions of dollars in Credit Suisse” were King Abdullah II of Jordan and Venezuela’s former vice-minister of energy, Nervis Villalobos.
King Abdullah II has been accused of misappropriating financial aid for his own personal benefit, while Villalobos pleaded guilty to money laundering in 2018. Other sanctioned individuals also held accounts at Credit Suisse, as the New York Times wrote:
“Other account holders included sons of a Pakistani intelligence chief who helped funnel billions of dollars from the United States and other countries to the (Mujahideen) in Afghanistan in the 1980s.”
Banteg, the lead developer at Yearn.finance, leading decentralized finance yield farming platform, tweeted on Sunday, “Credit Suisse AML happily hosted human traffickers, murderers, and corrupt officials.” Commenters took note of HSBC, another huge international bank that has paid hefty fines for aiding serious international criminals.
Although there are laws in place that prohibit Swiss banks from accepting deposits from known criminals, the country’s famous bank secrecy laws make it easy to evade, if they are enforced at all. This has seemingly made Switzerland an inviting place for criminals to do their international banking. The New York Times wrote:
“The leak shows that Credit Suisse opened accounts for and continued to serve not only the ultrawealthy but also people whose problematic backgrounds would have been obvious to anyone who ran their names through a search engine.”
The irony of a major traditional financial institution aiding high criminals was not lost on the cryptocurrency community, which has battled against accusations of abetting criminals for years. The $100 billion in deposits outlined by the data leak dwarfs the $25 billion estimated by Chainalysis to be held by criminal crypto whales as of 2021.
The bank has denied any wrongdoing, but the centralized clandestine way in which Credit Suisse has operated contrasts with fully transparent blockchain technology. Such transparency may also mean that investigators and law enforcement can keep tabs on individuals and governments that are trying to evade economic sanctions in real-time.
Source: https://cointelegraph.com/news/credit-suisse-data-leak-reveals-decades-of-shady-clients-and-activity
-
Data of 22.5 million Malaysians born 1940-2004 allegedly being sold for US$10k
In both incidents, it was claimed that the data was syphoned from the NRD through the My Identity API.
18 May 2022
PETALING JAYA (THE STAR/ASIA NEWS NETWORK) - An alleged data leak containing the information of 22.5 million Malaysians born between 1940 and 2004, purportedly stolen from the National Registration Department (NRD), has once again put the country's data security measures in the spotlight.
Local tech portal Amanz reported that the database, 160GB in size, is being sold for US$10,000 (S$13,846) on the dark web.
In the screenshot shared by the portal, the seller claimed that this is an expanded database compared to the one he sold in September last year, which was only up to 1998.
In both incidents, it was claimed that the data was siphoned from the NRD through the MyIdentity API (application programming interface). MyIdentity is a centralised data-sharing platform that is used by various government agencies.
Malaysia's Home Minister Hamzah Zainudin on Wednesday said the alleged data leak did not come from the NRD, but from "several agencies which we have given some leeway for them to obtain information from us".
He did not name those agencies, or how many agencies had access to MyIdentity data.
Hamzah told reporters after attending an event that there was a mechanism in place which could prove that the leaked information did not come from the NRD.
By signing up, you agree to our Privacy Policy and Terms and Conditions.
“Previously, there was a similar allegation but we have managed to prove that the leak was not from the NRD.
“It was from several agencies which we have given some leeway for them to obtain information from us,” he said.
When the first data leak occurred was discovered in September, it allegedly involved the NRD database of people born between 1979 and 1998, and was being sold for 0.2 BTC (RM35,350, or S$11,160).
But Datuk Seri Hamzah said then: "Don't worry about data held by NRD. Our firewall is quite strong."
He said then that all government agencies using the MyIdentity system had been instructed to implement stricter safety measures.
On Wednesday, lawyer Foong Cheng Leong said the lack of transparency on investigations related to data leaks in Malaysia has been frustrating.
"There needs to be an account of how the matter is being investigated and what steps are being taken to ensure that the data is secure.
"The information could serve as a deterrent to others and show that there will be consequences for those leaking private information," he said in a phone interview.
Mr Foong urged fresh investigations to be conducted by the relevant agencies, including the Department of Personal Data Protection (JPDP) to discover if the leak was genuine.
When contacted, JPDP declined to comment at this point.
Mr Foong said the data from the alleged leak could be used by scammers to dupe victims.
"For example, they could pose as an authority figure and present information such as your MyKad number or address to gain your trust.
"They will use this to convince you to give out more details or perform financial transactions," he said.
When contacted, CyberSecurity Malaysia declined to comment, stating that the matter is under the jurisdiction of JPDP.
And the NRD has yet to respond to requests for information.
Source: https://www.straitstimes.com/asia/se-asia/data-of-225-million-malaysians-born-1940-2004-allegedly-being-sold-for-us10k
Archive: https://archive.ph/Krjqi
-
S'pore man shows how this pre-departure travel photo can reveal personal details & allow someone to cancel your flight
Ho showed how an influencer had unwittingly revealed her full name and e-ticket number in a video.
Andrew Koay | May 30, 2022
Now that international travel is truly up and running, chances are your social media feeds have been flooded with images of people flaunting their holidays.
After all, if you haven't posted an image of a boarding pass sticking out of your passport like an oversized bookmark, how will everyone know you've left the country?
Yep, this image was taken by a colleague to remind the rest of us that she was on leave. Image by Mothership
Well, according to a TikTok user named Jason Ho, here's why you shouldn't do it.
"This is damn dangerous for your privacy," said Ho.
According to the motivational speaker, by posting such a photo you could be giving away the following bits of personal information:
- Full name
- Passport number
- Passport expiry date
- Last four digits of your credit card
- Date of birth
- Email
- Mobile phone number
In addition, using just the information on your boarding pass, Ho said that malicious actors can make adjustments to your in-flight preferences or worst, cancel your flight altogether.
Managed to access personal details on Singapore Airlines page
"I'm going to show you what an influencer did when she went to SEA Games," continued Ho, with a disclaimer — the video was purely for educational purposes.
He then presented a censored screenshot from a video posted by an unnamed influencer on social media.
Jason Ho demonstrates how much information you're revealing by posting a photo of your boarding pass Image from @CoachJasonHo's TikTok account
Ho pointed out that in that screenshot, the influencer had unwittingly revealed her full name and e-ticket number to viewers of the video.
With this information, Ho showed that he could then access the "manage booking" function on Singapore Airlines' website.
He then proceeded to demonstrate how he was able to find the influencer's personal information.
"Sharing the joy"
Ho said that the video was no longer available online and that he had personally messaged the influencer to warn her.
Some commenters on Ho's video were less charitable towards the influencer, with one, in particular, describing her as a show-off.
However, Ho replied that he felt the act of posting about your holiday for most people was "more like sharing the joy".
"So guys I hope you share with all your friends about this," he said, concluding his video.
"Never ever do this. If you want to do this, please cover with your thumb or something the e-ticket number."
Source: https://mothership.sg/2022/05/travel-photo-personal-details/
Archive: https://archive.ph/mK9wj
Video explanation (by Coach Jason Ho)
-
Hackers Claim Theft of Police Info in China’s Largest Data Leak
4 July 2022 | Sarah Zheng, Bloomberg News
(Bloomberg) -- Unknown hackers claimed to have stolen data on as many as a billion Chinese residents after breaching a Shanghai police database, in what industry experts are calling the largest cybersecurity breach in the country’s history.
The person or group claiming the attack has offered to sell more than 23 terabytes of stolen data from the database, including names, addresses, birthplaces, national IDs, phone numbers and criminal case information, according to an anonymous post on an online cybercrime forum last week. The unidentified hacker was asking for 10 bitcoin, worth around $200,000.
The scale of the alleged leak has sent shockwaves through the Chinese security community, triggering speculation about the credibility of the claim and how it could have taken place. Zhao Changpeng, founder and Chief Executive Officer of cryptocurrency exchange Binance, tweeted on Monday the company had detected the breach of a billion resident records “from one Asian country,” without specifying which, and had since increased verification procedures for potentially affected users.
Shanghai authorities have not publicly responded to the purported hack. Representatives for the city’s police and Cyberspace Administration of China, the country’s internet overseer, did not immediately respond to faxed requests for comment.
The US and other nations have repeatedly identified China as one of the world’s biggest sources of cybercriminals, which they say infiltrate systems on behalf of domestic agencies in search of valuable data or intellectual property.
Domestic breaches are however rarely disclosed because of a lack of transparent reporting mechanisms. In 2016, personal information on dozens of Communist Party officials and industry figures from Jack Ma to Wang Jianlin was said to have been exposed on Twitter, in one of the country’s biggest online leaks of sensitive information at the time. In 2020, the Twitter-like service Weibo Corp. said hackers claimed to have stolen account information for more than 538 million of its users, though sensitive data such as passwords was not leaked. And this year, tens of thousands of seemingly hacked files from China’s remote Xinjiang region provided fresh evidence of the abuse of mostly Muslim ethnic Uyghurs, according to a rights group.
The latest alleged incident again underscored the challenges facing Beijing as it collects data on hundreds of millions of people while tightening policing of sensitive online content. Under Chinese law, the exposure of personal information can result in jail terms.
It’s unclear how the alleged cyberattackers in this month’s breach gained access to Shanghai police servers. One popular theory circulated online among cybersecurity experts was that the breach involved a third-party cloud infrastructure partner. Alibaba Group Holding Ltd., Tencent Holdings Ltd. and Huawei Technologies Co. are among the country’s biggest external cloud services.
Source: https://www.bnnbloomberg.ca/hackers-claim-theft-of-police-info-in-china-s-largest-data-leak-1.1787409 (https://www.bnnbloomberg.ca/hackers-claim-theft-of-police-info-in-china-s-largest-data-leak-1.1787409)
Reference: https://twitter.com/ZeyiYang/status/1543409345815355399 (https://twitter.com/ZeyiYang/status/1543409345815355399)
-
Neopets data breach exposes personal data of 69 million members
By Lawrence Abrams | July 20, 2022
Virtual pet website Neopets has suffered a data breach leading to the theft of source code and a database containing the personal information of over 69 million members.
Neopets is a popular website where members can own, raise, and play games with their virtual pets. Neopets recently launched NFTs that will be used as part of an online Metaverse game.
On Tuesday, a hacker known as 'TarTarX' began selling the source code and database for the Neopets.com website for four bitcoins, worth approximately $94,000 at today's prices.
In a conversation with BleepingComputer, TarTarX says that they stole the database and approximately 460MB (compressed) of source code for the neopets.com website.
The seller claims that this database contains the account information of over 69 million members, and in a screenshot shared with BleepingComputer, you can see the data includes members' usernames, names, email addresses, zip code, date of birth, gender, country, an initial registration email, and other site/game-related information.
While the hacker would not reveal how they gained access to the website, they told us that they did not ransom the data to Jumpstart, the owners of Neopets, but have received interest from potential buyers.
At this time, BleepingComputer has not been able to independently verify the authenticity of the database. However, pompompurin, the owner of the Breached.co hacking forum, verified the hacker's claims by registering an account on Neopets.com and being sent their newly created record from the database.
"Vouch, I registered an account on the website and he sent the full entry," pompompurin posted to the Breached.co forums.
Furthermore, this verification showed that TarTarX continued to have access to the neopets.com site even as they began selling the data.
Breach is confirmed
After the news of the breach spread online, the Neopets team, designated by the TNT abbreviation, has confirmed on the unofficial Neopets Discord server that they are aware of the security incident and working on resolving it.
Volunteer Discord moderators are warning that changing passwords on Neopets may not help secure your account if the attackers still have access to their servers.
"We should note that the effectiveness of changing your Neopets password is currently debatable as long as hackers have live access to the database, as they can simply check what your new password is," reads an announcement on the Neopets Discord server.
"We cannot therefore strictly advise you on the best course of action given the circumstances."
However, if you use the same Neopets password on other sites, you are strongly advised to change your password on those sites to a different one.
Neopets members can monitor a topic on the Neopets Help Site Jelleyneo or the Jelleyneo Twitter account, where other members are keeping track of any official updates from the Neopets staff.
This is not the first data breach for Neopets, with member data previously circulating online in 2016 from a breach that occurred in 2012.
BleepingComputer has contacted Jumpstart about the breach but has not received a reply at this time.
However, late last night, the Neopets Twitter account shared a statement that we have reproduced in full below.
"Neopets recently became aware that customer data may have been stolen. We immediately launched an investigation assisted by a leading forensics firm. We are also engaging law enforcement and enhancing the protections for our systems and our user data.
It appears that email addresses and passwords used to access Neopets accounts may have been affected. We strongly recommend that you change your Neopets password. If you use the same password on other websites, we recommend that you also change those passwords.
As our investigation continues, we will update you as appropriate. We truly appreciate your patience and understanding at this time. Thank you." - Neopets.
Others already had access
While this breach appears to be new, Neopets has a history of unauthorized access to their systems.
A Reddit user named neo_truths told BleepingComputer that they have had "read" access to the database for at least a year after finding exploits in the site's leaked source code.
neo_truths told us that they use this access to analyze and share information about the game mechanics on Reddit.
However, neo_truths said that they used someone else's exploit to inject code into a PHP eval() function to modify the game as an April Fools joke.
Unfortunately, neo_truths says that the code is huge and spread out over many servers, with only a few developers to manage it. This lack of staff has led to numerous breaches by multiple people in the past, with one actively used exploit reported to the devs who ultimately fixed it.
"Neo is full of breaches and multiple people had (and maybe still have) access for years. The only difference is they use it privately (mostly for genning and selling offsite) and I try to address some known issues with actual data," explains neo_truths in a comment on Reddit.
"I have already reported 2 exploits that allowed db access that other people had used (one of them for months/years hard to tell). I could have not found them if I didn't have access myself.
"I could always choose to reveal my own method thus losing access which would be the correct thing, but at the same time that would let the others run free. But yes I understand that from a user perspective its very worrying someone can arbitrarily access their data."
While neo_truths has had access to the Neopets database for some time, they told BleepingComputer that they were not involved in this recent breach and believes the threat actors gained access using a flaw unrelated to Neopets code.
"The exploit this time is unrelated to neo code, just a general exploit many websites have," neo_truths told BleepingComputer.
Source: https://www.bleepingcomputer.com/news/security/neopets-data-breach-exposes-personal-data-of-69-million-members/
Archive: https://archive.ph/UHm0P
-
330,000 S'pore Starbucks customers' data leaked, info sold online for $3,500
Aqil Hamzah | 16 Sep 2022
SINGAPORE - Some 330,000 Singaporean Starbucks customers' data were found by The Straits Times to have been breached and put up for sale on an online forum since Sept 10.
The affected customers received an e-mail from the coffee chain on Friday notifying them of a data breach that compromised their personal information, including their names, home and e-mail addresses.
When asked if its database was hacked, a spokesman for Starbucks Singapore said the coffee chain was made aware of the data breach only on Sept 13, adding that the customers affected were those who had accounts and had previously made a transaction via its app or online store.
In the e-mail seen by ST, customers were informed that their credit card data has not been compromised as Starbucks does not store that data.
Other details related to its customer loyalty programme, including stored values, rewards and credits, remain intact as well, it said.
"We have immediately taken reasonable steps to protect customer information. We are also fully cooperating with the authorities in the investigation," said the spokesman.
Responding to ST queries, a spokesman for the Personal Data Protection Commission said it has been notified about the incident.
“We are investigating and have reached out to Starbucks for more information,” he said.
At press time, one copy of the database containing users' data has already been sold, with the price listed at $3,500.
(http://edusg.us/images/202209_StarbucksSG.jpg)
Another four copies are being listed on offer.
Mr Kevin Reed, the chief information security officer of cyber-security firm Acronis, cautioned individuals affected to be on the lookout for phishing or scam attempts in the coming weeks.
"My advice to those who received the e-mail from Starbucks is that they should scrutinise any correspondence they receive from strangers or organisations.
"They may use your personal information to appear trustworthy, and in some cases may even ask you to access one-time passwords," he said.
Citing the SMS phishing scams last year that affected almost 470 OCBC Bank customers who lost at least $8.5 million, Mr Reed said he expects scammers to make use of the stolen information in the same manner.
He said: "In many of the situations, people were addressed by their names, which made the messages seem credible."
He added that there was a possibility of the information being used to access other services as well.
And although Starbucks Singapore did not reveal how the breach happened, he said it could have been carried out in two ways.
The first involves data scraping, whereby scripts and tools are used to collect data.
Alternatively, he said the data may not have been secured properly.
"But now that the data is out, it's a little too late."
Source: https://www.straitstimes.com/singapore/330000-starbucks-customers-data-leaked-sold-online-for-3500 (https://www.straitstimes.com/singapore/330000-starbucks-customers-data-leaked-sold-online-for-3500)
Archive (Source): https://archive.ph/qBPlq (https://archive.ph/qBPlq)
Reference: https://breached.to/Thread-VERIFIED-STAR-UCKS-DATABASE (https://breached.to/Thread-VERIFIED-STAR-UCKS-DATABASE)
Archive (Reference): https://archive.fo/fdSmU (https://archive.fo/fdSmU)
-
Shangri-La says data breach at hotels, guests' info potentially leaked
October 01, 2022 | Deepanraj Ganesan
SINGAPORE - A database breach has occurred at luxury hotel chain Shangri-La Group, potentially exposing the personal information of guests who had stayed at its hotels in Singapore, Hong Kong, Chiang Mai, Taipei and Tokyo.
In an email informing affected guests, the group's senior vice president for operations and process transformation Brian Yu, said: "A sophisticated threat actor managed to bypass Shangri-La's IT security monitoring systems undetected, and illegally accessed the guest databases."
Its investigation revealed that the breach took place between May and July 2022.
It was around that time that Asia's top security summit Shangri-La Dialogue returned to Singapore after a two-year pandemic hiatus. The event was held at the eponymous Shangri-La hotel in downtown Orchard Road from June 10-12.
In the email, Mr Yu confirmed that certain data files had been exfiltrated from the breached databases.
" Although we were not able to confirm the content of the exfiltrated data files, it is likely that they contained guest data," he added.
The following properties are affected:
• Shangri-La Apartments, Singapore
• Shangri-La Singapore
• Island Shangri-La, Hong Kong
• Kerry Hotel, Hong Kong
• Kowloon Shangri-La, Hong Kong
• Shangri-La Chiang Mai
• Shangri-La Far Eastern, Taipei
• Shangri-La Tokyo
The hotel group said it engaged cyber forensic experts to investigate the anomalies following the discovery of unauthorised activities on its network.
It added that the databases of the hotels affected by this incident contained a combination of the following data sets: guest names, e-mail addresses, phone numbers, postal addresses, Shangri-La Circle membership numbers, reservation dates, and company names.
The hotel group assured guests that there is currently no evidence that guests' personal data has been released by third parties or misused.
As a precaution, however, it is offering affected guests a one-year complimentary identity monitoring service provided by Experian, a third-party cyber security service provider, in destination where local regulation permits.
"We deeply regret this has occurred and wish to assure you that all necessary steps have been taken to investigate and contain this incident. This notice provides information about what happened and how we can assist you," wrote Mr Yu in the email.
He assured guests that information such as passport numbers, ID numbers, dates of birth, and credit card numbers with expiry dates are encrypted.
"Protecting our guests' information is very important to us and we wish to assure you that all necessary steps have been taken to further strengthen the security of our networks, systems, and databases. Once again, we deeply regret for any inconvenience or concerns this incident may cause," he added.
Source: https://www.asiaone.com/singapore/shangri-la-says-data-breach-hotels-guests-info-potentially-leaked
https://archive.ph/4bMQ1
-
The biggest hack in history: Australians scramble to change passports and driver licences after Optus telco data debacle
Government says telecommunications giant ‘left the window open’ for unsophisticated attack that could lead to European-style privacy laws
Tory Shepherd | 30 Sep 2022
When Amy Hunting* first heard about one of the biggest cyber attacks in Australian history, she immediately checked to see if her personal details had been compromised.
She realised that, as a customer of the country’s second largest telecommunications provider, Optus, there was a fair chance she was one of about 10 million people whose information had been hacked – but at first, there was no communication. Eventually she got an email saying she had been caught up in the breach, which exposed one in three Australians to the risk of identity theft or financial fraud.
With millions of others, she went about trying to change her driver’s licence. She even had a bar put on her own credit report, to stop anyone from trying to open a new account in her name.
“We’re really careful about our data,” she says.
“I was really frustrated. They’re a big tech company. It’s frustrating and surprising that they’re so laissez faire with their data. Also, that they took their time in informing us.”
The alleged hacker – who threatened to sell the data unless a ransom was paid – took names, birth dates, phone numbers, addresses, and passport, healthcare and drivers’ license details from Optus, the country’s second-largest telecommunications company.
Of the 10 million people whose data was exposed, almost 3 million had crucial identity documents accessed.
Across the country, current and former customers have been rushing to change their official documents as the US Federal Bureau of Investigation joined Australia’s police, cybersecurity, and spy agencies to investigate the breach.
The Australian government is looking at overhauling privacy laws after it emerged that Optus – a subsidiary of global telecommunications firm Singtel – had kept private information for years, even after customers had cancelled their contracts.
It is also considering a European Union-style system of financial penalties for companies that fail to protect their customers.
An error-riddled message from someone claiming to be the culprit and calling themselves “Optusdata” demanded a relatively modest US$1m ransom for the data.
“We are businessmen,” Optusdata wrote in an online forum. “1.000.000$US is a lot of money and will keep to our word.”
That demand was followed by a threat to release the records of 10,000 peopleper day until the money was paid. A batch of 10,000 files was later published online.
As Optus and the federal government dealt with the fallout, the alleged hacker had a change of mind and offered their “deepest apology”.
“Too many eyes,” they said. “We will not sale data to anyone. We cant if we even want to: personally deleted data.”
Optus chief Kelly Bayer Rosmarin initially claimed the company had fallen prey to a sophisticated attack and said the associated IP address was “out of Europe”. She said police were “all over” the apparent release of information and told ABC radio that the security breach was “not as being portrayed”.’
Experts have said Optus had an application programming interface (API) online that did not need authorisation or authentication to access customer data. “Any user could have requested any other user’s information,” Corey J Ball, senior manager of cyber security consulting for Moss Adams, said.
Rachael Falk, chief executive of the Cyber Security Cooperative Research Centre, said while much was still unknown about the attack “sometimes even amateurs get lucky”.
“There are outstanding hackers, often nation states who are really, really good at this and, invariably, it doesn’t take much to find a weakness, a vulnerability, a soft spot,” she said.
“[Or] they can literally be a person in a basement, a person who likes to tinker on the side.”
Optus ‘left the window open’
The cyber security minister, Clare O’Neill, has questioned why Optus had held on to that much personal information for so long.
She also scoffed at the idea the hack was sophisticated.
“What is of concern for us is how what is quite a basic hack was undertaken on Optus,” she told the ABC. “We should not have a telecommunications provider in this country which has effectively left the window open for data of this nature to be stolen.”
Asked about Rosmarin’s comments that the attack was sophisticated, O’Neill said: “Well, it wasn’t.”
On Friday, prime minister Anthony Albanese said what had happened was “unacceptable”. He said Optus had agreed to pay for replacement passports for those affected.
“Australian companies should do everything they can to protect your data,” Albanese said.
“That’s why we’re also reviewing the Privacy Act – and we’re committed to making privacy laws stronger.”
The Australian Information Commissioner is also investigating. Commissioner Angelene Falk said companies “must take reasonable steps to destroy or de-identify the personal information they hold”.
“Collecting and storing unnecessary information breaches privacy and creates risk,” she said.
Australia currently has a $2.2m limit on corporate penalties, and there are calls for harsher penalties to encourage companies to do everything they can to protect consumers.
In the EU, the General Data Protection Regulation means companies are liable for up to 4% of the company’s revenue. Optus’s revenue last financial year was more than $7bn.
On Friday, the Australian federal police announced a special operation to protect the identity of the 10,000 victims whose details were already published online.
AFP assistant commissioner Justine Gough said the operation would “supercharge” their protection against identity crime and financial fraud.
In its recently published annual report, Optus’s parent company, Singtel, touted its ability to protect against data theft and cyber attacks.
“We value the privacy of our customer data stored within our networks and systems as they may be harmed if their data is compromised or misused,” Singtel said.
“We have in place appropriate safeguards and controls to ensure the security and protection of our customer data.”
Source: https://www.theguardian.com/business/2022/oct/01/optus-data-hack-australians-scramble-to-change-passports-and-driver-licences-after-telco-data-debacle (https://www.theguardian.com/business/2022/oct/01/optus-data-hack-australians-scramble-to-change-passports-and-driver-licences-after-telco-data-debacle)
Archive: https://archive.ph/RIBlI (https://archive.ph/RIBlI)
Urgent warning issued to Australians over Optus-related scams spreading at an alarming rate - here's how to make sure you don't get caught out
Oct 12th 2022 | Poppy Johnston
Australians are being warned to be vigilant about scammers after the consumer watchdog confirmed it is being flooded with hundreds of Optus-related complaints per day in the wake of the biggest data breach in the country's history.
The head of the Australian Competition and Consumer Commission said the regulator's scam team had received about 600 complaints a day related to the breach.
ACCC chair Gina Cass-Gottlieb said many scammers were taking advantage of the large-scale data breach and posing as the telecommunications giant or Equifax Protect, the credit reporting agency tasked with supporting victims of the breach, to swindle consumers.
She told a parliamentary committee people were confused about the legitimacy of the communications.
So far, Ms Cass-Gottlieb said there had only been a few instances of fraudsters successfully scamming victims out of money by pretending to be from Optus.
'What we can see is it's only a small number of people who have become a victim to a scam, but many are alert to it and are most of all confused and anxious,' she said.
She said it was positive to see more people alert to scam risks.
The head of the regulator also told the economics committee she was yet to spot any evidence of abnormally high petrol prices in the wake of the reinstated fuel excise tax.
The ACCC was tasked with watching retailers carefully for signs of unnecessarily large price hikes when the halved tax was returned to its full 44.2 cents-a-litre level last month.
The heads of the Australian Prudential Regulation Authority and the Australian Securities and Investments Commission will also front the economics committee on Tuesday.
The financial regulators will be grilled about anti-competitive behaviour, corporate greenwashing and the rise of social media 'finfluencers'.
The economics committee hearing follows a probe of the Reserve Bank of Australia three weeks ago.
In the lead-up to the hearings, One Nation senator Malcolm Roberts questioned ASIC's ability to investigate and prosecute white-collar crime.
He pointed to the collapse of the property investment scheme Sterling First, which cost many Australians their life savings.
'The effectiveness of the Australian Securities and Investments Commission has already been questioned following the failure to prevent the Sterling First managed investment fund scandal in Western Australia,' Senator Roberts said.
'ASIC provided incorrect guidance on the security of Sterling First to potential investors.'
Several investigations have been launched into the massive Optus data breach, which compromised the personal details of millions of Australians.
The Office of the Australian Information Commissioner commenced an inquiry on Tuesday.
The federal agency will examine the personal information handling practices of Optus and its parent company.
Its investigation will focus on whether Optus took reasonable steps to protect the personal information of customers, and whether the information collected and retained was necessary to their business.
The inquiry will be coordinated with one conducted by the Australian Communications and Media Authority, which will investigate Optus' obligations regarding customer information as a telecommunications provider.
If the investigation reveals serious or repeated privacy breaches, the commissioner has the power to seek civil penalties through the Federal Court of up to $2.2 million for each contravention.
Information and Privacy Commissioner Angelene Falk urged all organisations to review their handling of personal information and data breach response plans.
'Collecting and storing personal information that is not reasonably necessary to your business breaches privacy and creates risk. Only collect what is reasonably necessary,' she said.
The consumer watchdog has been being flooded with Optus-related scam complaints following the data breach.
Australian Competition and Consumer Commission chairwoman Gina Cass-Gottlieb said scammers were taking advantage of the large-scale data breach and posing as the telecommunications giant or Equifax Protect, the credit reporting agency tasked with supporting victims of the breach.
She told a parliamentary committee people were confused about the legitimacy of the communications.
So far, Ms Cass-Gottlieb said there had only been a few instances of fraudsters successfully scamming victims out of money by pretending to be from Optus.
Source: https://www.dailymail.co.uk/news/article-11301317/Urgent-warning-issued-Australians-Optus-related-scams-spreading.html
Archive: https://archive.ph/wip/HwMra
-
Dropbox discloses breach after hacker stole 130 GitHub repositories
By Sergiu Gatlan | November 1, 2022
Dropbox disclosed a security breach after threat actors stole 130 code repositories after gaining access to one of its GitHub accounts using employee credentials stolen in a phishing attack.
The company discovered the attackers breached the account on October 14 when GitHub notified it of suspicious activity that started one day before the alert was sent.
"To date, our investigation has found that the code accessed by this threat actor contained some credentials—primarily, API keys—used by Dropbox developers," Dropbox revealed on Tuesday.
"The code and the data around it also included a few thousand names and email addresses belonging to Dropbox employees, current and past customers, sales leads, and vendors (for context, Dropbox has more than 700 million registered users)."
The successful breach resulted from a phishing attack that targeted multiple Dropbox employees using emails impersonating the CircleCI continuous integration and delivery platform and redirecting them to a phishing landing page where they were asked to enter their GitHub username and password.
On the same phishing page, the employees were also asked to "use their hardware authentication key to pass a One Time Password (OTP)."
130 code repositories were stolen during the breach
After stealing the Dropboxers' credentials, the attackers gained access to one of Dropbox's GitHub organizations and stole 130 of its code repositories.
"These repositories included our own copies of third-party libraries slightly modified for use by Dropbox, internal prototypes, and some tools and configuration files used by the security team," the company added.
"Importantly, they did not include code for our core apps or infrastructure. Access to those repositories is even more limited and strictly controlled."
Dropbox added that the attackers never had access to customers' accounts, passwords, or payment information, and its core apps and infrastructure were not affected as a result of this breach.
In response to the incident, Dropbox is working on securing its entire environment using WebAuthn and hardware tokens or biometric factors.
In September, other GitHub users were also targeted in a similar attack impersonating the CircleCI platform and asking them to sign into their GitHub accounts to accept user terms and privacy policy updates to keep using the service.
"While GitHub itself was not affected, the campaign has impacted many victim organizations," GitHub said in an advisory at the time.
GitHub said it detected content exfiltration from private repositories almost immediately after the compromise, with the threat actors using VPN or proxy services to make tracing them more difficult.
Source: https://www.bleepingcomputer.com/news/security/dropbox-discloses-breach-after-hacker-stole-130-github-repositories
Archive: https://archive.ph/1fd1x
-
Ouch! Ransomware gang says it won’t attack AirAsia again due to the “chaotic organisation” and sloppy security of hacked company’s network
Graham Cluley | November 22, 2022
What’s worse?
Being hit by ransomware attack that sees criminals steal information about your staff and passengers…
or…
Being hit by ransomware attack that sees criminals steal information about your staff and passengers, AND then have the gang tell the world that your firm’s IT infrastructure is so chaotic, poorly-secured, and downright irritating that it refuses to repeat the attack.
EmailSign up to our newsletter
Security news, advice, and tips.
That’s the humiliating slap in the face given by the Daixin Team ransomware gang to Air Asia which lost the personal data of five million passengers and all employees earlier this month.
Passenger data
As DataBreaches.net reports, the incompetence of AirAsia may actually have spared the airline from further attacks:
“The chaotic organization of the network, the absence of any standards, caused the irritation of the group and a complete unwillingness to repeat the attack,” the spokesperson for Daixin Team said. “The group refused to pick through the garbage for a long time. As our pentester said, ‘Let the newcomers sort this trash, they have a lot of time.’”
“The internal network was configured without any rules and as a result worked very poorly. It seemed that every new system administrator ‘built his shed next to the old building.’ At the same time, the network protection was very, very weak.”
Ouch.
AirAsia declined to comment on the DataBreaches.net report. Frankly you can’t blame them for ducking that one.
Source: https://grahamcluley.com/ouch-ransomware-gang-says-it-wont-attack-airasia-again-due-to-the-chaotic-organisation-and-sloppy-security-of-hacked-companys-network/
Archive: https://archive.ph/x6SPG
Reference: http://www.databreaches.com
-
Major Canadian Crypto Exchange Coinsquare Says Client Data Breached
The exchange claimed the breached personal data wasn't likely seen "by the bad actor” and customers' assets are “secure in cold storage and are not at risk.”
Frederick Munawa | Nov 27, 2022
Coinsquare, one of Canada’s largest cryptocurrency exchanges, may have been breached, but the company claims customer assets are “secure in cold storage and are not at risk.”
The exchange, which touts itself as “Canada's trusted platform to securely buy, sell and trade Bitcoin, Ethereum, and more,” emailed customers yesterday to report a “data incident” in which an unauthorized third party accessed a customer database containing personal information.
According to the email, the breach exposed “customer names, email addresses, residential addresses, phone numbers, dates of birth, device IDs, public wallet addresses, transaction history, and account balances.” Although the email was sent yesterday, Coinsquare discovered the breach last week and notified customers via Twitter.
“No passwords were exposed. We have no evidence any of this information was viewed by the bad actor,” the email stated.
Coinsquare suspended activities on its platform after detecting the vulnerability last week, triggering speculation of possible liquidity issues, given the momentous implosion of multi-billion-dollar crypto exchange, FTX, earlier this month. Full service was restored on Friday, according to a tweet.
“We want to reiterate that 100% of client funds are safely held in cold storage and are not used for business activities,” the company tweeted.
CoinDesk reached out to Coinsquare for further comments and the exchange is yet to respond.
Source: https://www.coindesk.com/tech/2022/11/26/major-canadian-crypto-exchange-coinsquare-says-client-data-breached/
Archive: https://archive.ph/UCa7a
-
More than 5,000 phishing e-mails impersonating Case officers sent after cyber attack
11 Oct 2022
SINGAPORE - Cyber attackers hacked the mail server for Singapore's watchdog and impersonated its officers, sending out phishing e-mails to more than 5,000 consumers to tell them they had to make payment transactions to get monetary compensation.
The Consumer Association of Singapore (Case) said it started receiving reports of these phishing e-mails last Saturday.
Two mailboxes, "online-submission@case.org.sg" and "mediator1@case.org.sg" were affected. The first is used by the association to communicate with consumers who lodge complaints on Case's website, and the second is used for those whose complaints are escalated to mediation.
A total of 5,095 phishing e-mails were sent from both mailboxes.
In those e-mails, consumers were asked to participate in a live chat, and approach bank partners to perform payment transactions relating to their complaints to receive monetary compensation. No other details were available.
"While these e-mails were sent from e-mail addresses that Case may have used to communicate with consumers, the latest notifications they received did not originate from Case," said the consumer watchdog.
"Case will not direct consumers through e-mail or live chat to visit another website to key in their bank details."
Investigations confirmed that the unauthorised access was limited to consumers' e-mail addresses and all other personal information remained secure, said Case.
It said that once it learnt its mail server had been hacked, it worked with its IT vendors to suspend the affected mailboxes and reconfigure its e-mail accounts to stop more phishing e-mails from being sent. It said it would also work with the vendors to strengthen its cyber security systems to avoid a further recurrence.
Case said it is carrying out further investigations, and has reported the incident to the police and the Personal Data Protection Commission (PDPC) to resolve it.
It advised consumers who have received those e-mail notifications not to click on the links and disclose personal and bank details. Those who have performed the payment transactions should lodge a report with the police, and the anti-scam hotline at 1800-722-6688 as soon as possible.
Source: https://www.straitstimes.com/singapore/more-than-5000-phishing-emails-impersonating-case-officers-sent-after-cyber-attack
Archive: https://archive.ph/uhkCl
----------------------
How man lost $149,000 in minutes after clicking email claiming to be from Case
4 December 2022 | Nadine Chua
A man who filed a dispute over a faulty computer with the Consumers Association of Singapore (Case) lost $149,000 in a matter of minutes after he clicked on a live chat icon in an e-mail purportedly from the consumer watchdog.
Mike (not his real name), who is in his early 50s and works in the education industry, was one of at least 10 victims who fell prey to the phishing e-mails in October.
The police told The Straits Times the total losses amounted to at least $225,000. Case said in October that 5,095 phishing e-mails were sent to consumers after cyber attackers hacked its mail server.
Mike received an e-mail on Oct 9 stating that he had been assessed by “Case” to be “eligible for compensation” after filing a dispute.
“I thought the e-mail was real because I had approached Case for mediation in June 2021 after buying a Dell computer that was faulty. I dropped the complaint that same month when I got a refund from Dell,” he recalled.
When asked why he had believed the content in the e-mail despite the issue being resolved more than a year ago, Mike said: “It did raise some suspicion that the e-mail was not real, but it said ‘payment is guaranteed’. So I was just curious to see what the compensation was.”
When Mike clicked on the live chat icon included in the e-mail, he was led to “what looked like a legitimate DBS website”.
“Everything happened quickly after that. When the site disappeared after I clicked it, I tried again. I later pressed ‘authorise’ on a notification that popped up on my mobile phone, which I was told would allow Case to look into the matter. And just like that, my money was gone,” he said.
Mike, who lost most of his life savings, filed a police report that night. The police confirmed the report and said investigations are ongoing.
Case executive director Lee Siow Hwee, who confirmed the watchdog had received feedback from Mike, said: “As the matter is currently under investigation, we are unable to comment further.”
When asked how Case was addressing the issue, Ms Lee declined to comment.
A DBS Bank spokesman told ST its systems remain secure and said: “The data leak at Case was used by criminals to successfully convince the victim to give up his banking credentials and transfer funds by carrying out multiple authorisations through a spoofed website.
“This is why data breaches require quick and clear communication to victims in accordance with data protection laws and best practice, so that impacted persons can take proactive steps to prevent further harm.”
DBS said the bank has processes in place to prevent its intellectual property from being abused, including resources to take down fraudulent websites as soon as possible.
“Our customers are reminded to be mindful of the URLs of websites they are using and, if in doubt, to verify via the bank’s official channels,” said the spokesman.
Mike, who is single, said: “It feels terrible. The money was a huge chunk of my life savings. I need it as my parents are in their late 80s and depend on me – there are medical fees and medicine to think about. I’m very concerned that I’ll be unable to support them.
“I’m not earning a lot and it is a large sum of money. I’m just desperate to somehow get my money back.”
He recently sought help from the Financial Industry Disputes Resolution Centre (Fidrec), which specialises in the resolution of consumer financial disputes.
It was reported last month that fraud and scams accounted for nearly a third of claims handled by Fidrec for the financial year spanning July 1, 2021, to June 30, 2022.
Case previously said it began receiving reports of the phishing e-mails on Oct 8. It advises those who have performed similar payment transactions to lodge a report with the police, and contact the Anti-Scam Hotline on 1800-722-6688.
Source: https://stomp.straitstimes.com/singapore-seen/how-man-lost-149000-in-minutes-after-clicking-email-claiming-to-be-from-case
Archive: https://archive.ph/sVWxi
-
Twitter hacked, 200 million user email addresses leaked, researcher says
By Raphael Satter | 5 Jan 2023
LONDON, Jan 5 (Reuters) - Hackers stole the email addresses of more than 200 million Twitter users and posted them on an online hacking forum, a security researcher said Wednesday.
The breach “will unfortunately lead to a lot of hacking, targeted phishing and doxxing,” Alon Gal, co-founder of Israeli cybersecurity-monitoring firm Hudson Rock, wrote on LinkedIn. He called it “one of the most significant leaks I've seen.”
Twitter has not commented on the report, which Gal first posted about on social media on Dec. 24, nor responded to inquiries about the breach since that date. It was not clear what action, if any, Twitter has taken to investigate or remediate the issue.
Reuters could not independently verify the data on the forum was authentic and came from Twitter. Screenshots of the hacker forum, where the data appeared on Wednesday, have circulated online.
Troy Hunt, creator of breach-notification site Have I Been Pwned, viewed the leaked data and said on Twitter that it seemed “pretty much what it’s been described as.”
There were no clues to the identity or location of the hacker or hackers behind the breach. It may have taken place as early as 2021, which was before Elon Musk took over ownership of the company last year.
Claims about the size and scope of the breach initially varied with early accounts in December saying 400 million email addresses and phone numbers were stolen.
A major breach at Twitter may interest regulators on both sides of the Atlantic. The Data Protection Commission in Ireland, where Twitter has its European headquarters, and the U.S. Federal Trade Commission have been monitoring the Elon Musk-owned company for compliance with European data protection rules and a U.S. consent order respectively.
Messages left with the two regulators were not immediately returned on Thursday.
Source: https://www.reuters.com/technology/twitter-hacked-200-million-user-email-addresses-leaked-researcher-says-2023-01-05
Archive: https://archive.fo/zFBK7
-
Meta fined over $400 million by top EU regulator for forcing users to accept targeted ads
4 Jan 2023 | Ryan Browne
Facebook parent company Meta on Wednesday was slapped with a pair of fines totaling more than $400 million as the Irish privacy regulator concluded the company’s advertising and data handling practices were in breach of EU privacy laws.
The Irish Data Protection Commission said that Meta should be ordered to pay two fines — one, a 210 million euro ($222.5 million) fine over violations of the European Union’s General Data Protection Regulation, or GDPR, and the second, a 180 million euro fine related to breaches of the same law by Instagram.
Combined, the penalties amount to 390 million euros ($414 million).
The fines mark the conclusion of two lengthy investigations into Meta by the Irish regulator, which had been criticized over delays in the process. The DPC began investigating the company on May 25, 2018, the day the EU’s GDPR came into effect.
GDPR places strict requirements on firms with regard to the processing of people’s information. Firms that run afoul of the rules risk facing penalties as high as 4% of global annual revenues.
In the ruling Wednesday, the DPC said that Meta must bring its data processing operations into compliance within three months. The watchdog is the lead regulatory authority for Meta and several other U.S. tech giants, which hold their headquarters in Ireland.
Meta, which changed its name from Facebook in 2021, said in a statement Wednesday that it planned to appeal the ruling. The decision does not amount to a ban on personalized advertising and businesses can continue using Meta’s platforms to target users with ads, it added.
“The suggestion that personalised ads can no longer be offered by Meta across Europe unless each user’s agreement has first been sought is incorrect,” a Meta spokesperson told CNBC via email.
“There has been a lack of regulatory clarity on this issue, and the debate among regulators and policymakers around which legal basis is most appropriate in a given situation has been ongoing for some time,” the spokesperson added.
“That’s why we strongly disagree with the DPC’s final decision, and believe we fully comply with GDPR by relying on Contractual Necessity for behavioural ads given the nature of our services. As a result, we will appeal the substance of the decision.”
A ‘huge blow’ to Meta’s EU profits
Previously, Meta relied on a user’s consent to process their information for the purposes of behavioral ads. However, after the entry into force of the GDPR, the company changed the terms of service for Facebook and Instagram, and switched the legal basis upon which it processes that information to something called “contractual necessity.”
That same year, Max Schrems, an Austrian privacy activist, submitted a complaint alleging this change forced users to accept the processing of their information for ad targeting in exchange for use of the platforms.
Schrems, in a statement Wednesday, said the DPC’s decision Wednesday meant that Meta would have to develop a version of its apps that doesn’t use personal data for advertising within three months.
He added Meta would still be allowed to ask users for consent to ads with a “yes/no” option, however.
“This is a huge blow to Meta’s profits in the EU,” Schrems said. “People now need to be asked if they want their data to be used for ads or not. They must have a ‘yes or no’ option and can change their mind at any time. The decision also ensures a level playing field with other advertisers that also need to get opt-in consent.”
In December, the European Data Protection Board, which coordinates regulatory action on data privacy across the bloc, said that Meta wasn’t entitled to rely on contracts as a legal basis for processing user data for targeted ads, effectively deeming the company’s advertising practices illegal.
Subsequent to that move, the DPC said it found Meta was “not entitled to rely on the ‘contract’ legal basis in connection with the delivery of behavioural advertising as part of its Facebook and Instagram services, and that its processing of users’ data to date, in purported reliance on the ‘contract’ legal basis, amounts to a contravention of Article 6 of the GDPR.”
The fines imposed by the DPC were raised substantially from those proposed in a draft decision in October, in which the regulator suggested a levy of between 28 million and 36 million euros.
Source: https://www.cnbc.com/2023/01/04/meta-fined-more-than-400-million-in-ireland-over-eu-privacy-breaches.html
Archive: https://archive.fo/W3OjF
-
Meta hit with record 1.2-billion-euro fine over EU data rules
Callum PATON | 22 May 2023
It is the 3rd fine imposed on Meta in the EU this year
Facebook owner Meta has been fined a record 1.2 billion euros (USD1.3 billion) for transferring EU user data to the United States in breach of a previous court ruling, Ireland's regulator announced on Monday.
The Irish Data Protection Commission (DPC), which acts on behalf of the European Union, said the European Data Protection Board (EDPB) had ordered it to collect "an administrative fine in the amount of 1.2 billion euros".
The DPC has been investigating Meta Ireland's transfer of personal data from the EU to the United States since 2020.
It found that Meta, which has its European headquarters in Dublin, failed to "address the risks to the fundamental rights and freedoms of data subjects" that were identified in a previous ruling by the Court of Justice of the European Union (CJEU).
The CJEU interprets EU law to make sure it is applied in the same way in all member states.
In response, Meta said it was "disappointed to have been singled out" and the ruling was "flawed, unjustified and sets a dangerous precedent for the countless other companies".
"We intend to appeal both the decision's substance and its orders including the fine, and will seek a stay through the courts to pause the implementation deadlines," Meta president of global affairs Nick Clegg and chief legal officer Jennifer Newstead said in a blog post.
"There is no immediate disruption to Facebook in Europe," they added.
Meta said it hopes to see the US and EU adopt a new legal framework for the use of personal data in the coming months, following an agreement in principle last year, which could allow it to continue its data transfer practices.
- Fourth fine -
EU regulators have hit Meta with four fines in six months -- and three this year -- over data breaches by its Instagram, WhatsApp and Facebook services.
In January, the DPC fined the social media giant 390 million euros for breaking data rules in its use of targeted advertising on its apps.
In March, Meta was made to pay 5.5 million euros for breaching the GDPR with its WhatsApp messaging service.
Online trader Amazon was fined 746 million euros in Luxembourg in 2021 for infringing the EU's General Data Protection Regulation (GDPR).
In the latest case, the DPC had initially wanted to force Meta to suspend the offending data transfers, saying that a fine "would exceed the extent of powers that could be described as being 'appropriate, proportionate and necessary'".
But its peer regulators in the EU, known as Concerned Supervisory Authorities (CSAs), disagreed and said it should be "subject to an administrative fine", the DPC said.
With no hope of consensus, the Irish body referred the objections to the EDPB, which ruled that Meta Ireland must suspend future transfer of personal data to the United States and pay a fine.
- 'Strong signal' -
Clegg and Newstead said the EDPB decision to overrule the DPC "raises serious questions".
"No country has done more than the US to align with European rules via their latest reforms, while transfers continue largely unchallenged to countries such as China," they added.
But EDPB chair Andrea Jelinek characterised Meta's infringement as "very serious" and called its data transfers "systematic, repetitive and continuous".
"The unprecedented fine is a strong signal to organisations that serious infringements have far-reaching consequences," she added.
Privacy activist Max Schrems, who set off a decade of legal battles with his challenge against Meta over the movement of EU data to the United States, welcomed the decision.
"Ever since Edward Snowden's revelations on US big tech aiding the (National Security Agency) mass surveillance apparatus, Facebook (now Meta) was subject to litigation in Ireland," said his organisation, the European Centre for Digital Rights.
But Schrems said far harsher sanctions could have been used as Meta had "knowingly broken the law to make a profit".
"It took us 10 years of litigation against the Irish DPC to get to this result... and risked millions of procedural costs," he added.
"The Irish regulator has done everything to avoid this decision," he added.
Source: https://sg.news.yahoo.com/meta-hit-record-1-2-093131046.html
Archive: https://archive.fo/k0fdK
-
ShopBack fined over data leak that affected over 1.4 million users
ShopBack's customer database was stolen by a hacker and put up for sale on an online forum in November 2020.
August 18, 2023 | By Wong Shiying
SINGAPORE - E-commerce cashback platform ShopBack has been fined $74,400 by Singapore's data privacy watchdog for a data breach that affected over 1.4 million of its customers.
ShopBack's customer database was stolen by a hacker and put up for sale on an online forum in November 2020, the Personal Data Protection Commission (PDPC) said on Wednesday (Aug 16).
The leaked database contained personal information such as bank account numbers, partial credit card details, mobile numbers and e-mail addresses.
PDPC found that the hacker had likely found the key to the database after a ShopBack employee accidentally saved the key's software code in an online repository.
At the time of the incident, ShopBack hosted its customer database on virtual servers in an Amazon Web Services (AWS) cloud environment. It employed 12 people whose responsibilities included making sure that the keys to the servers were secure.
On June 4, 2019, a senior member of the team accidentally saved a key's software code in a private repository on GitHub, a platform that allows developers to store and manage their code. The key in question had full administrative privileges.
The error was discovered by a team member two days later and the key's code was removed from GitHub.
"However, it remained viewable in GitHub's 'commit history', which records all changes and previous versions of code uploaded on GitHub," said PDPC in its report.
On June 21 of that year, the key was to be deleted and replaced by a new key as part of routine security measures.
The same employee, however, failed to fully disable and remove the old key after creating a new one. As a result, the compromised key could still be used to access ShopBack's servers until about 15 months later.
On Sept 9, 2020, a hacker used the key to steal data from ShopBack's customer storage servers.
These included the e-mail addresses of about 1.4 million users, 840,000 names, 450,000 mobile numbers, 300,000 bank account numbers, and the partial credit card information of about 380,000 users.
During a routine security review about a week later, ShopBack discovered that its servers had been breached and hired a private forensic expert to investigate.
In its report, PDPC found that ShopBack had failed to ensure that its processes to manage the keys to its servers were sufficiently robust. It said: "(ShopBack) claimed that the compromise of the AWS key arose from human error, and not because of any systemic issue with its security practices.
"This position is not accepted... Organisations cannot place sole reliance on their employees to perform their duties properly as a security arrangement to protect personal data. There must be some process to ensure that the step required from the employee is taken, such as independent verification by another checker."
PDPC added that ShopBack also failed to conduct periodic security reviews, which could have detected whether the AWS keys had been properly rotated or deleted.
PDPC noted, however, that ShopBack took immediate steps to contain the data breach, such as by reversing all the changes made by the hacker and triggering a forced logout and password reset of all customer accounts.
To prevent the incident from happening again, ShopBack stepped up the monitoring of logs to ensure any unauthorised access would be detected.
In determining what financial penalty to impose, PDPC said it considered the "long period" of 15 months the key was exposed, but took into account that ShopBack had taken prompt remedial actions and acknowledged its failure.
From October 2022, the maximum amount that a company can be fined for a data breach is 10 per cent of its annual turnover in Singapore, or $1 million, whichever is higher.
Previously, organisations that violated the Personal Data Protection Act would face a financial penalty of up to $1 million.
A ShopBack spokesman said in response to queries from The Straits Times that the company fully respects PDPC's decision, and that the security of its systems and users' data "remains of utmost importance to us".
The spokesman added: "Over the past three years, ShopBack has made significant enhancements to our security protocols and systems and has been recognised by the Cyber Security Agency of Singapore for our good security practices since October 2022."
Source: https://www.asiaone.com/singapore/shopback-fined-over-data-leak-affected-over-14-million-users
Archive: https://archive.fo/uEkst
-
23andMe user data breached in credential-stuffing attack
Malak Saleh | Oct 8, 2023, 3:15
Biotech company 23andMe, known for its DNA testing kits, confirmed to BleepingComputer that its user data is circulating on hacker forums. The company said the leak occurred through a credential-stuffing attack.
A credential-stuffing attack involves user information that has already been compromised (usernames and passwords, for example) from one organization, which a hacker obtains and attempts to reuse with a second organization — in this case, 23andMe. Because of the nature of credential-stuffing, it does not appear this was a breach of the company's internal systems. Rather, accounts were broken into piecemeal. The perpetrators of this attack appear to have obtained quite sensitive information from the compromised accounts (photos, full names and geographical location, among other things). "Thus far, our investigation has found that no genetic testing results have been leaked," a 23andMe spokesperson said in an email. In an official public statement, the company said that after becoming aware of suspicious activity, it immediately began an investigation.
The initial leak comprised “1 million lines of data for Ashkenazi people,” according to BleepingComputer. By October 4, data was being offered for sale in bulk, in increments of 100, 1,000, 10,000 or 100,000 profiles. The scale of the attack is as yet unknown, but the scope of its impact has likely been exacerbated by 23andMe's 'DNA Relatives' feature. "Relatives are identified by comparing your DNA with the DNA of other 23andMe members who are participating in the DNA Relatives feature," the company states. After accessing an unknown number of profiles via credential-stuffing, the threat actor behind this breach apparently scraped the 'DNA Relatives' results for those profiles, netting much more sensitive data. According to the same FAQ page, "The number of relatives listed [..] grows over time as more people join 23andMe." For the fiscal year 2023, the company reported it “genotyped” around 14 million customers.
Ever since 23andMe went public in 2021, the company has faced extra scrutiny for its data protection practices — rightly so, since it deals with sensitive medical data derived from saliva sampling, including predispositions for diseases like Alzheimer's, Type 2 diabetes and even cancer. On its website, the company claims it "exceeds" data protection standards for its industry.
Update, October 7 2023, 3:15 PM ET: This story has been updated to correct a statement about the type of sensitive information that was compromised in the leak. The company said that so far, no genetic testing results have been leaked.
Source: https://www.engadget.com/23andme-user-data-breached-in-credential-stuffing-attack-231757254.html
Archive: https://archive.ph/HH89c
-
Deepfake video of Taylor Swift speaking Mandarin sparks discussion over AI in China
Gabrielle Chan | 29 Oct 2023
American pop star Taylor Swift got the attention of her Chinese fans this week when clips of her speaking fluent Mandarin went viral on Chinese social media.
In a video posted on Chinese social media platform Weibo, the 33-year-old singer can be seen flaunting her Mandarin-speaking skills in what looks to be a talk show.
“Recently, I’ve been to many places, like Italy, France and Japan,” Swift said in Mandarin with a slight American twang. The video was shared on Oct 21 and has since gained over six million views.
In another video, Swift talked about songs that are “left behind”, and how she wished people could hear these tracks.
The twist? Swift owes her Mandarin-speaking prowess to artificial intelligence (AI).
The deepfake videos were generated by an AI tool from HeyGen, a Chinese start-up, reported news outlet The China Project.
The lip movements were synced to make it look like she was speaking in Mandarin, and it sounded like Swift’s voice, making the videos so realistic that it led Chinese netizens to express their amazement at the technology, with comments like: “This is awesome!”
Others asked for Mandarin versions of their favourite shows.
But it also triggered discussion over the potential pitfalls that will come as AI gets more advanced, like scams and the loss of jobs.
“The scariest thing is that if someone uses his technology to make fake news, because the AI is able to manipulate the voice and movement of the mouth, people will easily believe it,” said one netizen.
Another Weibo user wrote that it would be “terrible if (this AI technology) is used for fraud”, as criminals can use it to dupe victims for money.
HeyGen, the company behind the tool that made the videos, was co-founded in November 2020 by Mr Joshua Xu and Mr Wayne Liang.
The firm’s AI-powered video generator allows users to create text-to-speech videos in over 300 voices in more than 40 languages, using over 100 AI avatars with different ethnicities, ages, poses and clothes.
Technology like this has sparked concern over the criminal applications of AI. Earlier in 2023, a scammer in northern China used deepfake technology to convince a man to transfer money to a supposed friend.
The scammer used AI-powered face-swopping technology to impersonate a friend of the victim during a video call. The man ended up transferring him some 4.3 million yuan (S$823,000).
In January, China put in force new rules that require businesses offering deepfake services to obtain the real identities of their users.
It also requires deepfake content to be appropriately tagged to avoid confusion.
Source: https://www.straitstimes.com/asia/east-asia/deepfake-video-of-taylor-swift-speaking-mandarin-sparks-discussion-over-ai-in-china
Archive: https://archive.ph/DmFGk
-
Personal data of 665,000 Marina Bay Sands shoppers accessed by 'unknown third party' in October
Loraine Lee | November 7, 2023
SINGAPORE — About 665,000 Marina Bay Sands (MBS) shoppers had their data accessed by an "unknown third party" last month, the integrated resort operator revealed on Tuesday (Nov 7).
In an email to customers seen by TODAY, MBS' chief operating officer Paul Town said that the breach on Oct 19 and 20 affected the Sands LifeStyle rewards programme.
Mr Town added that MBS "does not believe membership data from our casino rewards programme, Sands Rewards Club, was affected".
MBS was first aware of the incident on Oct 20, and "immediately took action to resolve it", Mr Town said.
Responding to TODAY's queries, MBS said that the personal data accessed included customers' names, email addresses, mobile numbers, countries of residence and their membership numbers and tiers.
"Based on our investigation, we do not have evidence to date that the unauthorised third party has misused the data to cause harm to customers," Mr Town said in the email.
"After learning of the issue, we quickly launched an investigation, have been working with a leading external cybersecurity firm, and have taken action to further strengthen our systems and protect data," he added.
The integrated resort has also reported the incident to the relevant authorities in Singapore and other countries where customer data is affected, and is working with them.
“It is best practice to monitor your account for suspicious activity and change your log-in pin regularly, and to be extra vigilant against phishing attempts, particularly against clicking on links that may direct you to malicious websites where your password or other personal information may be requested,” added Mr Town.
Read also
Source: https://www.todayonline.com/singapore/personal-data-665000-marina-bay-sands-shoppers-accessed-unknown-third-party-october-2299116
Archive: https://archive.ph/cQfAR
-
Deepfake videos in Singapore jump 500% in 2023 from year ago
"Deep fakes here in Singapore have jumped five times in the last year alone now
that is according to a report by fraud prevention firm suub authorities have
been warning that Deep fakes could be misused to commit cyber crimes
tells us how accessible the technology has become where you want me put this
anyway I'm used to speaking in front of the camera hi my name is Nadir and I'm
actually here to learn more about generative AI but I was not prepared for
what happened next the AI software quickly learned my speech patterns to
generate this hey Nadir your instant Avatar is ready feel free to create
videos with it also click the feedback button to share what you think hope you
enjoy with this I can put words in my mouth quite literally so I'm writing the
AI a script pretending to be a marketing professional looking to hire people for
my company it takes just another click of a button for my deep fake Avatar to
speak a language I don't oh my God okay too easy to use and
misuse the scammers can also use it to their advantage and um if you think
about the fact that we are not talking about old crimes but new techniques so
if I was a scammer I would use geni to create a fake job post and then I take
someone else's LinkedIn information and I do fishing so I will Target the person
and I can use the technology to create a fake looking HR manager so that the the
victim would think that he or she is communicating with a real person I love
from Kevin that these tools are also getting more sophisticated making it
easier than ever to create Deep fakes which makes me think that perhaps seeing
is no longer believing and joining us tonight with more insights is Professor Mohan Kankanhalli
he's Dean of NUS School of Computing and Deputy Executive Chairman of AI
Singapore now we just heard that quick explanation of what can happen uh if you
use AI for impersonation and scamming now we we are continually looking at
regulations to check the various ways in which AI can be used and abused in the
instance of impersonation and scamming can we fine-tune regulations so that
they're better able to address this particular problem I think that's a
great question and uh in fact what we saw just now is just I think beginning
of an epidemic uh what generative AI has done is really democra ized uh creation
of Deep fakes and we are only going to see uh increasing volume and increasing
speed of Deep fakes and uh definitely the regulation has to keep up with that
now there are effectively two approaches to doing the regulation one is uh
minimizing harm uh and the other is a risk-based approach so in a risk-based
approach uh I think this is what many of the European countries are trying to do
is trying to uh understand what are the risk posed by different types of deep
fakes and then regulate at two levels at an individual level that means the
creator of the deep fake and what are the kind of penalties must have be
imposed on them and at a platform level that people who knowingly share or
platforms or companies which knowingly share such content they need to act in
case they are notified and I think the regulation is moving in this direction
uh on a more uh uh Stronger regulation I think uh some of the uh countries are
going right down to the creation software so China uh is having new
regulatory where companies need to disclose uh their software which is used
for creating uh Deep fakes and also for example recommendation algorithms so so
regulation at the individual level and at the platform level uh but there are
going to be challenges in actually nabbing Those who commit these these
crimes with Deep fakes how challenging is it going to be to actually sort of
pinpoint who they are yeah I think it is going to be extremely challenging when
the first generation of Deep fakes came out uh they were actually fairly easy to
detect because uh you know for example the eyes did not blink but the once the
did the scammers knew that this was the case they actually improved the software
so that they introduced blinking and now generative AI is becoming better and
better in fact for text using chat GPT you can create any stories for image it
is becoming pretty good though for example still uh some of this uh
generative AI software like stable diffusion they will get the human
anatomy wrong some of the signage in so so you can create for example a fake
this thing tsunami in London some of the street signs will be wrong so you can
easily spot them but they're just improving with time and I I think what
Regulators need to do is to understand the technology and I think in Singapore
I think uh imda is very much uh involved in lot of the AI activities and they're
very much aware of what is going on so I think technologists have to work with
regulators and work together however I think in the long run I think it is
going to be a cat and a mouse game where always regulation will be chasing
technology in the long run we therefore have to look at education uh educating
people about uh the risks of of seeing and believing the risk of uh you
know creating such software and making people responsible and ethical about the
usage of the software all right well before we go further let's take a look at the
increasing interest in generative AI which is gaining fans among Singapore's
business Community a survey by data privacy research firm Straits
interactive shows that about two in three smmes are either using or planning
to use it to generate text documents as well as videos but Nadira zidi finds out
that doing this could put at greater risk using generative AI to build
websites and write proposals has helped this software firm improve productivity
by almost 50% our Junior Executives use ChatGPT to generate proposals generate reports for our
clients previously we had to check their work but right now there's much less
checking because the grammar is taken care of we they just have to put in the
facts put in the figures and that is very easy for them and that saves us a
lot of time another firm is relying on AI for the education technology business
users can feed the software content and generate test questions we Empower
Educators to very easily create these AI tutors without any code simply by
dropping in their content so with their curated content as a result their
students will be able to chat with these AI tutors who already have all the
knowledge that the teacher has but while they are Pros to using AI privacy
breaches are not uncommon your contact details usage patterns device
information and location can be exposed some companies are putting let's say um
their their HR policies they are putting in some of their legal stuff inside
to try to get the AI to resmar or recategorize or rewrite some parts of it
and you may have to deal with with copyright issues or personal data issues
that's especially since most firms rely on open-source data where the source
code is freely available and can be redistributed or Modified by anyone to
reduce cyber security risks say they're taking precautionary measures such as
limiting the information that they upload I write very generally my prompt
I do not say who I am I just say that perhaps I'm the president of such
organization writing something to another organ ization and these are my
points any content that um that our customers put into the platform is
always containerized and it's never used to train any large language model or any
AI model that is not used by the institution even then smmes aren't
always sure if what they're doing is the right thing they add that there's a need
to put in place policies and govern the use of AI in smaller
firms yeah I know there are safeguards with digital but sometimes sometimes
when we're talking about generative AI it sounds like we're describing you know
a leaky ship when it comes to cyber security it can be that difficult to
keep up with the Bad actors as it were Prof when it comes to firms
sometimes they unknowingly are helping criminals sort of how can they
actually counter that so that they you know the sort of exposure to data leaks
to to privacy leaks is minimized I think first of all I think the firms need to understand this
new animal in town which is generative AI it's a can be a fantastic
productivity tool but there are risk involved as we heard just now having
said that I think one of the good things about our pdpc is they have a
suite of you know tools and guides available which I think small
companies and smmes can can make use of it there are two ways of countering
it is one is to have policies within the firm on how usage can be done so if
you're using for or summarizing documents or creating documents or
analyzing documents or creating code you should make sure that sensitive
information is never used on a public model which is like CH GP or or some
others but you can some if if you can afford it you can have a small private
model for which the data never goes out of the firm all right we never get very
far away from the job market when it comes to talking about the Singapore
economy let's take a look at some figures now that show how Rising
interest in adoption of AI is having an impact as one would expect on the job
market reports suggest Singapore becoming the fastest growing market for
artificial intelligence talent in the Asia Pacific outpacing countries like
India and Japan according to job portal indeed one in nearly 500 new job postings now is
related to generative AI that's almost five times higher than just four months
ago some of the fastest growing roles are algorithm engineers and data science
Specialists they are responsible for
Designing and improving AI applications but there is a skills Gap when it comes
to hiring these job roles typically need people who have knowledge in data
science web development and digital marketing back to you Prof Manan looking
at these numbers will this AI boom mean increased competition for talents within
the tech sector absolutely I think there is a huge demand for Talent right now uh
but there are mitigating factors for example at NUS School of computing we
have more than tripled our undergraduate intake over the last six years and
therefore the supply side is increasing in fact we at AI Singapore where
where I also which I also represent uh we have a very popular AI Apprentice
program which creates talent and in fact people from different backgrounds can
come and become a a professional in the AI field our master's program at n us
also there is a general track conversion program where people can take advantage
of these jobs in the long run Singapore has a smaller talent pool we are a small
country but I feel that AI can help us uh let me explain generative AI
especially for developing software can be a tremendous tool and for somebody
who is well vered in using generative AI to create code it can actually
dramatically increase the productivity and therefore in certain sense some of
the AI shortage hopefully can be alleviated by AI by improving the
productivity of our talent there are many opportunities for
engineers I mean and we're moving also into a space in the future where we
may not see so much coding necessary data Engineers may you know can actually
use um sort of systems as well new technology as it were so that we're
not so Reliant just on people but if we wanted to grow that talent pool in
Singapore what what would be the biggest thing that we need to do the first the
first step to that I think we are already doing that is we are introducing
various programs continuing education programs Master's programs conversion
programs which enable people who have the right mathematical logical skills
not necessarily Computing skills in in order to transition into this sector so
I would see that once there is a big demand for such roles more and more
people will be encouraged to take advantage of these programs for lifelong
learning programs and become you know kind of in know in a sense make
themselves proficient so that they are attractive to the new economy all right
thank you very much Professor Mohan Kankanhalli there Chair Professor of
Computer Science at NUS and Deputy executive chairman of AI SLE thank you
very much thank for having this evening"
CNA Source: https://www.channelnewsasia.com/watch/deepfake-videos-singapore-jump-500-2023-year-ago-report-3959751
-
Apps using AI to undress women in photos soaring in popularity
8 Dec 2023 |
NEW YORK – Apps and websites that use artificial intelligence (AI) to undress women in photographs are soaring in popularity, according to researchers. In September alone, 24 million people visited undressing websites, according to the social network analysis company Graphika.
Many of these undressing, or “nudify”, services use popular social networks for marketing, according to Graphika. For instance, since the beginning of 2023, the number of links advertising undressing apps increased more than 2,400 per cent on social media, including on X – formerly known as Twitter – and Reddit, the researchers said. The services use AI to recreate an image so that the person is nude. Many of the services work only on women.
These apps are part of a worrying trend of non-consensual pornography being developed and distributed because of advances in artificial intelligence – a type of fabricated media known as deepfake pornography. Its proliferation runs into serious legal and ethical hurdles, as the images are often taken from social media and distributed without the consent, control or knowledge of the subject.
One image posted to X advertising an undressing app used language that suggests customers could create nude images and then send them to the person whose image was digitally undressed, inciting harassment. One of the apps, meanwhile, has paid for sponsored content on Google’s YouTube, and appears first when searching with the word “nudify”.
A Google spokesperson said the company does not allow ads “that contain sexually explicit content. We’ve reviewed the ads in question and are removing those that violate our policies”. Neither X nor Reddit responded to requests for comment.
Non-consensual pornography of public figures has long been a scourge of the Internet, but privacy experts are growing concerned that advances in AI technology have made deepfake software easier and more effective.
“We are seeing more and more of this being done by ordinary people with ordinary targets,” said Ms Eva Galperin, director of cyber security at the Electronic Frontier Foundation. “You see it among high school children and people who are in college.”
Many victims never find out about the images, but even those who do may struggle to get law enforcement to investigate or to find funds to pursue legal action, Ms Galperin said.
There is currently no federal law banning the creation of deepfake pornography, though the US government does outlaw generation of these kinds of images of minors. In November, a North Carolina child psychiatrist was sentenced to 40 years in prison for using undressing apps on photos of his patients, the first prosecution of its kind under law banning deepfake generation of child sexual abuse material.
TikTok has blocked the keyword “undress” – a popular search term associated with the services – warning anyone searching for the word that it “may be associated with behaviour or content that violates our guidelines”, according to the app. A TikTok representative declined to elaborate. In response to questions, Meta Platforms also began blocking keywords associated with searching for undressing apps. A spokesperson declined to comment. BLOOMBERG
Source: https://www.straitstimes.com/world/apps-using-ai-to-undress-women-in-photos-soaring-in-popularity
Archive: https://archive.fo/asvZ4
-
Philippine education ministry hit by data leak involving over 210,000 school and tax records
Among the data exposed were profile photos of the applicants, and their parents' tax records.
Raul Dancel | Feb 21, 2024
A cyber-security researcher has found a vulnerability that exposed over 210,000 records of the Philippine education ministry to possible hacking and online scams.
Mr Jeremiah Fowler, a researcher at cyber-security firm vpnMentor, said in a report on Feb 20 that he found a gap that gave nearly unencumbered access to an online platform used by senior high school students applying for government vouchers to cover their tuition costs.
The cloud-stored database included some 154 gigabytes worth of tax filings, consent forms, government certifications, and employment and death certificates.
He said the tax records were particularly vulnerable, as these had the full names of those filing, as well as their home addresses, phone numbers, names of their employers and tax identification numbers.
The online application forms, meanwhile, contained the applicants’ full name, birthday, gender, address and contact information, as well as their parents’ sources of income and properties owned.
The application folders also contained photos of the students applying for vouchers.
“The exposure of… (these) documents is a serious potential security lapse, as they were stored without password protection and, therefore, available to anyone with an Internet connection,” said Mr Fowler.
The data could be used in phishing attempts and identity theft, he added.
The Philippines’ National Privacy Commission told The Straits Times that it was informed by Mr Fowler of the breach in January, and that “the vulnerability has been patched”.
But Mr Fowler said it was unclear how long the records were exposed or if anyone else could have gained access to the database.
“Only an internal forensic audit would be able to identify unauthorised access or potential malicious activity,” he said.
This was the second time the education ministry’s database has reportedly been compromised in 2024.
On Feb 14, Deep Web Konek – a community of cyber-security advocates – reported on Facebook that it unearthed a data breach involving 750GB worth of banking and personal records of students and teachers under the education ministry’s regional office south of the capital Manila.
The ministry said it ordered its field offices to run diagnostics and check if its servers had been hacked.
Earlier in February, hackers operating in China attempted to break into websites and e-mail systems of President Ferdinand Marcos Jr and several government agencies, including one promoting maritime security.
The Philippines has been ranked as the second most vulnerable to cyber threats after Indonesia among countries in South-east Asia.
Cyber-security firm Surfshark said in a report in October that at least 124 million accounts in the Philippines have been compromised since 2004. Indonesia topped the list, with 144 million affected accounts.
“In Asia, 52 accounts are breached per 100 people on average. However, in the Philippines, this number goes up to 106 per 100 people,” Surfshark lead researcher Agneska Sablovskaja said.
In October 2023, hackers released a massive trove of data from servers of the Philippine Health Insurance Corporation (Philhealth) after the state health insurer had refused to pay a ransom of US$300,000 (S$403,000).
Philhealth then revealed that the personal information of its 36 million members – around a third of the Philippine population – might have been compromised.
Its servers were hacked because it did not have cyber protection software. Some 96 computers were affected, or about a 10th of the agency’s units in its headquarters in metropolitan Manila.
Shortly after that incident, the homepage of the Philippines’ House of Representatives was defaced with a drawing of a smiling troll face and had to be taken offline.
Source: https://www.straitstimes.com/asia/se-asia/philippine-education-ministry-hit-by-data-leak-involving-over-210000-school-and-tax-records (https://www.straitstimes.com/asia/se-asia/philippine-education-ministry-hit-by-data-leak-involving-over-210000-school-and-tax-records)
Archive: https://archive.fo/wip/g21Kl (https://archive.fo/wip/g21Kl)
-
Over 40,000 Goldheart customers’ data allegedly leaked online; PDPC investigating
The database was shared on hacking forums and the Dark Web around May 20.
David Sun, Crime Correspondent | May 31, 2023
SINGAPORE – Hackers have leaked a database they claim contains the personal details of more than 40,000 customers of local jewellery chain Goldheart.
The database was shared on hacking forums and the Dark Web around May 20 and appears to contain the records of those who signed up for an online account with Goldheart from 2015 to 2022.
Checks by The Straits Times found that the database contained names, addresses, phone numbers, e-mail addresses and users’ dates of birth.
All of the database’s user entries, which numbered over 40,000, had e-mail addresses and birth dates.
In the posts sharing the database, hackers claimed it contained the details of 42,000 Goldheart customers.
However, ST found that less than 4,000 of the entries contained phone numbers and addresses.
Several hundred entries also appeared to be fake and contained spam messages.
In response to queries from ST, the Personal Data Protection Commission (PDPC) said it will be investigating.
A spokesman said: “PDPC is aware of the case. We have reached out to Goldheart for more information and will be investigating.”
Goldheart is a subsidiary of jewellery retailer Aspial, which also owns Lee Hwa Jewellery and pawnbroker Maxi-Cash.
According to its Facebook page, Goldheart is one of the largest local jewellery chains here, with more than 20 boutiques.
ST has contacted Goldheart for comment.
It was reported earlier in May that the PDPC ordered the Law Society to plug security gaps after a ransomware attack compromised the information of 16,009 members in 2021.
PDPC’s investigation also uncovered poor password practices for an IT administrator account, which had “Welcome2020lawsoc” as its password.
The PDPC separately also fined online furniture store FortyTwo $8,000 for a data breach in 2021.
The breach resulted in the leak of personal particulars belonging to 6,339 customers, including credit card details of 98 customers.
In another judgment, Kingsforce Management Services was found to have breached its obligation to protect personal data after its database of 54,900 job seekers was compromised and sold on a hacking forum in December 2021.
External cyber-security investigators identified outdated website coding technology as the cause of the incident, and the PDPC ordered the firm to ensure that regular patching, updates and upgrades take place for all software and firmware supporting its website and application.
Source: https://www.straitstimes.com/singapore/pdpc-investigating-alleged-online-leak-of-more-than-40000-goldheart-customers-data (https://www.straitstimes.com/singapore/pdpc-investigating-alleged-online-leak-of-more-than-40000-goldheart-customers-data)
Archive: https://archive.fo/Uz22q (https://archive.fo/Uz22q)
-
Indonesia Hit by Major Data Breaches Ahead of Elections 2024
The compromised data could be leveraged for a range of malicious activities, including identity theft, financial fraud, and targeted phishing campaigns.
Samiksha Jain | 9 February 2024
The threat actors have purportedly put up for sale vast amounts of sensitive data pertaining to Indonesian citizens and institutions. The gravity of the cyberattacks on Indonesia was highlighted by the claim that over 600,000 lines of Indonesian financial data are allegedly up for grabs on the dark web.
The data, spanning from 2021 to 2023, reportedly includes personal information such as names, phone numbers, addresses, emails, and National Identity Card (NIK) details. The price tag attached to this trove of information is a staggering US$600, with potential buyers instructed to make contact via the messaging app Telegram.
Cyberattack on PT Angkasa Pura I
In a separate incident, another threat actor has purportedly made available data belonging to Indonesia PT Angkasa Pura I.
This data breach is said to encompass a vast array of records totaling 68,237,264, containing sensitive information like names, emails, NIKs, phone numbers, addresses, and dates of birth. The asking price for this data haul is set at $5000.
The implications of these alleged cyberattacks on Indonesia, if confirmed, are profound. The compromised data could be leveraged for a range of malicious activities, including identity theft, financial fraud, and targeted phishing campaigns. Such data breaches in Indonesia not only undermine individual privacy but also pose significant risks to national security and financial stability.
This surge in cyberattacks on Indonesia is not an isolated incident. In recent years, the nation has witnessed a series of attacks, with various hacker groups targeting government websites and regional databases. In 2023, the Garnesia Team, a hacktivist group, identified an Indonesian government website associated with the Ministry of Public Works and Housing as a target.
Similarly, the infamous SiegedSec hacker group launched a cyber assault on the Pemalang region, further highlighting Indonesia’s vulnerability to cyber threats.
Exploring the Reasons Behind Cyberattacks on Indonesia
The recurring nature of these cyberattacks on Indonesia raises concerns about the cybersecurity posture of the country and its ability to safeguard sensitive data and critical infrastructure. Moreover, it begs the question: why has Indonesia become a continuous target for threat actors?
One plausible explanation lies in the country’s geopolitical significance, particularly in light of the upcoming presidential election scheduled for February 2024. Indonesia, the third-largest democracy in the world, is poised for a crucial leadership transition that could have far-reaching implications both domestically and internationally. The contest has attracted attention from major global players, including the United States and China, who are vying for influence in the region.
The strategic importance of Indonesia was highlighted by a joint statement issued by Presidents Joe Biden and Joko ‘Jokowi’ Widodo, announcing a Comprehensive Strategic Partnership between the two nations.
This partnership reflects Washington’s efforts to strengthen ties with Jakarta and assert its influence in Southeast Asia. However, China’s growing presence in the region, as evidenced by its deepening cooperation with Indonesia under the Belt and Road Initiative, adds another layer of complexity to the geopolitical landscape.
Cyberattacks on Indonesia: Tools of Influence
Against this backdrop, cyberattacks take on added significance, serving as a tool for state and non-state actors to exert influence, disrupt democratic processes, and undermine national security.
As Indonesia grapples with these persistent threats, strengthening cybersecurity measures and enhancing international cooperation will be paramount to safeguarding its digital infrastructure and preserving its sovereignty in an increasingly interconnected world.
Source: https://thecyberexpress.com/cyberattacks-on-indonesia (https://thecyberexpress.com/cyberattacks-on-indonesia)
Archive: https://archive.fo/ufWxE (https://archive.fo/ufWxE)
-
Carousell fined $58k for data breaches, including one where data of 2.6m users were sold
The Personal Data Protection Commission issued its decision on December 28, 2023 following the two data breaches.
Aqil Hamzah | Feb 23, 2024
SINGAPORE - Online marketplace Carousell has been fined $58,000 by the data privacy watchdog for two separate data breaches that took place in 2022, one of which involved data of more than two million users.
The other breach involved the exposure of the personal data of 44,477 Carousell users across Singapore, Malaysia, Indonesia, Taiwan and the Philippines.
The Personal Data Protection Commission (PDPC) published on its website on Feb 22 its decision, laying out why it fined the e-commerce platform for the two breaches.
The first incident, which was reported by The Straits Times in October 2022, involved a database reportedly containing the information of 2.6 million Carousell accounts that had been put on sale on hacking forums for $1,000. The 2GB database was uploaded on Oct 12 that year.
It came about after the launch of a public-facing application programming interface (API) during a system migration process, said the PDPC. An API is a software that allows two applications to communicate with each other.
Its intended function was to retrieve the personal data of users that were either followed by or following a particular Carousell user.
However, a filter was not applied to the function, which would ensure that non-public personal data, including e-mail addresses, telephone numbers and dates of birth, would not be called up.
A threat actor was able to capitalise on this by scraping the data from 46 accounts that had large numbers of users they had followed, or were following them, said the PDPC.
The data had been stolen between May 7 and 13, 2022, as well as on June 25 that year.
The bug was detected on Sept 15 that year, and was patched on the same day.
In its decision, the PDPC said Carousell had initially been unaware of the breach, and was informed about it by the watchdog on Oct 13, 2022.
The PDPC added that the e-commerce platform could not confirm the exact number of people affected, but Carousell estimates that almost 3.4 million people may have had their data compromised.
Meanwhile, the other data breach, which exposed the personal data of 44,477 Carousell users from Singapore, Malaysia, Indonesia, Taiwan and the Philippines, was caused by changes made to Carousell’s chat function on July 13, 2022.
The function was intended for the Philippine market and was meant to append to chat messages a user’s first name, e-mail address and phone number, provided they had given prior consent for this.
Instead, the change led to e-mail addresses and names of users in all markets being appended to chat messages, said the PDPC, which attributed this to “human error”. In the Philippines, users’ telephone numbers were also exposed, it said.
Carousell was made aware of the breach only after a user report on Aug 18, with a fix implemented six days later.
Although names associated with the accounts had been disclosed, the PDPC said it accepted Carousell’s explanation that the names were not necessarily the real names of users, and had been voluntarily given on their profiles.
It added that it did not consider the disclosure of the names relevant in assessing the breaches of the Personal Data Protection Act (PDPA).
The PDPC said Carousell had breached its obligation to protect personal data because it failed to conduct pre-launch testing and failed to document software specifications.
In the smaller data breach, it did not test the changes because they were intended only for select users in the Philippines. It also did not test for data security risks when it implemented the new API.
“Carousell admitted that prior to the second incident, it did not mandate comprehensive code reviews for security issues,” the PDPC added, referring to the breach that affected more than two million users.
There was also a lack of documentation when it came to the software being used, said PDPC.
In the case where changes were made to the chat function, the engineer was not aware that any tweaks made would affect other users.
It possibly also resulted in those involved in the system migration and the launch of the new API not knowing about the need to apply filters.
However, the PDPC said it recognised that Carousell had cooperated with its investigations, and had taken “prompt and effective” steps to remedy the situation after it learnt of both incidents.
Carousell had also not flouted the PDPA before this, and its early admission of liability was considered to be a significant mitigating factor.
The PDPC added that Carousell had adequate security measures put in place, but the hacker was sophisticated in his approach to avoid detection.
Besides the fine, the PDPC also directed Carousell to conduct reviews of its software testing procedures, as well as processes for documenting the specifications of software.
It must also rectify gaps identified in its review and provide a report of the actions taken within 90 days of the PDPC’s decision.
Source: https://www.straitstimes.com/singapore/carousell-fined-58k-for-data-breaches-including-one-where-data-of-26m-users-were-sold-on-hacking-forum (https://www.straitstimes.com/singapore/carousell-fined-58k-for-data-breaches-including-one-where-data-of-26m-users-were-sold-on-hacking-forum)
Archive: https://archive.fo/j4TD9 (https://archive.fo/j4TD9)
-
Poh Heng Jewellery hit by data breach, customers' personal information may have been compromised
Ryan Wong | 30 Mar 2024
SINGAPORE: Poh Heng Jewellery has notified its customers about a database breach that occurred on Monday (Mar 25).
In response to CNA's query, Ezekiel Chin, data protection officer at the jewellery company, said on Saturday that the unauthorised access may have compromised members' personal information.
"Upon discovery, we took prompt action to secure our system and have since reported the incident to the Personal Data Protection Commission (PDPC) and Singapore Police Force (SPF)," said Mr Chin.
"We have also confirmed that no passwords and payment information were leaked."
When asked why the affected users were not notified upon discovery of the breach, Mr Chin told CNA the immediate priority then was to secure the company's database and to ensure that there was no further compromise of data and its platforms.
"We also needed time to consolidate findings to report to PDPC and SPF to support and facilitate their investigations.
"While this may have taken time, it allowed us to better communicate steps taken to contain and resolve the situation to our affected members."
A check by CNA on Saturday afternoon found that Poh Heng's website was down with a posted notice: "We are upgrading our website to serve you better."
In a letter that was posted on Reddit and sent to customers, Poh Heng's Group CEO Eugene Goh said the unauthorised party accessed the personal data of customers. This may have included names, telephone numbers, email and residential addresses, member IDs, as well as the date of birth and country of residence.
"Please be assured that we do not store any financial information in your transaction with Poh Heng," read the letter. "There is also no evidence to suggest that user passwords have been accessed."
However, customers were advised to "closely monitor" their accounts with any organisation for any "suspicious or unusual activity".
"We recommend that you remain vigilant against phishing attempts, especially with regard to clicking on links that may direct you to malicious websites where your passwords or other personal information may be requested".
Poh Heng also told CNA it is currently working with relevant teams and experts to investigate the incident.
"Data security and user privacy are of utmost importance to us, and we will thoroughly review our platform and data protection processes to enhance safeguards against future attacks."
Source: https://www.channelnewsasia.com/singapore/poh-heng-jewellery-data-breach-customer-information-leaked-4231691
Archive: https://archive.md/XPnNK
-
Millions of customers' data found on dark web in latest AT&T data breach
Chloe Veltman | March 30, 2024
AT&T announced on Saturday it is investigating a data breach involving the personal information of more than 70 million current and former customers leaked on the dark web.
According to information about the breach on the company's website, 7.6 million current account holders and 65.4 million former account holders have been impacted. An AT&T press release said the breach occurred about two weeks ago, and that the incident has not yet had a "material impact" on its operations.
AT&T said the information included in the compromised data set varies from person to person. It could include social security numbers, full names, email and mailing addresses, phone numbers, and dates of birth, as well as AT&T account numbers and passcodes.
The company has so far not identified the source of the leak, at least publicly.
"Based on our preliminary analysis, the data set appears to be from 2019 or earlier," the company said. "Currently, AT&T does not have evidence of unauthorized access to its systems resulting in theft of the data set."
The company said it is "reaching out to all 7.6 million impacted customers and have reset their passcodes," via email or letter, and that it plans to communicate with both current and former account holders with compromised sensitive personal information. It said it plans to offer "complimentary identity theft and credit monitoring services" to those affected by the breach.
External cybersecurity experts have been brought in to help investigate, it added.
NPR reached out to a few AT&T stores. The sales representatives in all cases said they were as yet unaware of the breach.
On its website, the telecommunications company encouraged customers to closely monitor their account activity and credit reports.
"Consumers impacted should prioritize changing passwords, monitor other accounts and consider freezing their credit with the three credit bureaus since social security numbers were exposed," Carmen Balber, executive director of the consumer advocacy group Consumer Watchdog, told NPR.
An industry rife with data leaks
AT&T has experienced multiple data breaches over the years.
In March 2023, for instance, the company notified 9 million wireless customers that their customer information had been accessed in a breach of a third-party marketing vendor.
In August 2021 — in an incident AT&T said is not connected to the latest breach — a hacking group claimed it was selling data relating to more than 70 million AT&T customers. At the time, AT&T disputed the source of the data. It was re-leaked online earlier this month. According to a Mar. 22 TechCrunch article, a new analysis of the leaked dataset points to the AT&T customer data being authentic. "Some AT&T customers have confirmed their leaked customer data is accurate," TechCrunch reported. "But AT&T still hasn't said how its customers' data spilled online."
AT&T is by no means the only U.S. telecommunications provider with a history of compromised customer data. The issue is rife across the industry. A 2023 data breach affected 37 million T-Mobile customers. Just last month, a data leak at Verizon impacted more than 63,000 people, the majority of them Verizon employees.
A 2023 report from cyber intelligence firm Cyble said that U.S. telecommunications companies are a lucrative target for hackers. The study attributed the majority of recent data breaches to third-party vendors. "These third-party breaches can lead to a larger scale supply-chain attacks and a greater number of impacted users and entities globally," the report said.
Government rules adapt
Meanwhile, last December, the Federal Communications Commission (FCC) updated its 16-year-old data breach notification rules to ensure that telecommunications providers adequately safeguard sensitive customer information. According to a press release, the rules aim to "hold phone companies accountable for protecting sensitive customer information, while enabling customers to protect themselves in the event that their data is compromised."
"What makes no sense is leaving our policies stuck in the analog era," said FCC Chairwoman Jessica Rosenworcel in a statement regarding the changes. "Our phones now know so much about where we go and who we are, we need rules on the books that make sure carriers keep our information safe and cybersecure."
Source: https://www.npr.org/2024/03/30/1241863710/att-data-breach-dark-web
Archive: https://archive.md/Cx72z
-
Roku says more than 500,000 accounts impacted in cyberattack
12 Apr 2024
Streaming service provider Roku said on Friday it identified a second cyberattack that impacted about 576,000 additional accounts while investigating a breach that affected 15,000 user accounts earlier this year.
The company, which had more than 80 million active accounts, said the hackers did not gain access to any sensitive information such as full credit card numbers or other payment details.
Roku's shares were down about 2 per cent in early trading.
However, the company said it identified less than 400 cases where the information was used to make unauthorized purchases of streaming service subscriptions and hardware products using the payment method stored in the accounts.
The company said it would refund or reverse charges for accounts where it has determined unauthorized purchases have been made as part of the attack.
Roku pinned the unauthorized access to "credential stuffing", where users may have used the same credentials across different platforms.
Meanwhile, the company has enabled a two-factor authentication for all the accounts to beef up security controls.
Source: https://www.channelnewsasia.com/business/roku-says-more-500000-accounts-impacted-cyberattack-4261466
Archive: https://archive.fo/5RLTt
-
Personal information of parents, staff at 127 schools accessed in data security breach
20 Apr 2024
SINGAPORE: A data breach at one of its vendors has resulted in the "unauthorised access" of names and email addresses of parents and staff from five primary and 122 secondary schools, the Ministry of Education (MOE) said on Friday (Apr 19).
MOE said it was notified by Mobile Guardian that its user management portal had been breached on Wednesday, with the incident occurring at the company's headquarters in Surrey, United Kingdom.
Mobile Guardian is a device management app (DMA) installed on personal learning devices used by students, like iPads and Google Chromebooks. The app enables parents to manage students’ device usage by restricting applications or websites and screen time.
MOE added its own device management app was not affected by the data breach as it is separate from Mobile Guardian’s user management portal and "remains safe for use".
"There is no evidence of unauthorised access into the MOE DMA. Parents whose students use the iPad or Chromebook can continue to use the DMA as usual," it said.
The ministry as well as the schools involved will notify all affected parents and teachers about the data breach incident.
They are also advised to remain vigilant of any phishing emails that may be sent to them, MOE added.
The ministry said it has expressed its concerns to Mobile Guardian and a police report has been lodged.
In response to the incident, Mobile Guardian has implemented further security measures, such as locking down all administrative accounts.
The mobile device management software company is also working with information technology security experts to determine how the data breach occurred.
Mobile Guardian was appointed as MOE's official mobile device management services vendor in November 2020.
CNA has contacted the ministry, the Personal Data Protection Commission (PDPC) and Mobile Guardian for more information.
Source: https://www.channelnewsasia.com/singapore/mobile-guardian-data-breach-leak-email-names-personal-info-moe-4279521 (https://www.channelnewsasia.com/singapore/mobile-guardian-data-breach-leak-email-names-personal-info-moe-4279521)
Archive: https://archive.fo/t5WMK (https://archive.fo/t5WMK)
Reference (2020 MOE Tender): https://www.sgpbusiness.com/government/procurement/tender-number/MOE000ETT20300021 (https://www.sgpbusiness.com/government/procurement/tender-number/MOE000ETT20300021)
Archive (Tender): https://archive.fo/Ni3Rd (https://archive.fo/Ni3Rd)
MOE requests forensic investigation after data breach affecting 89,000 parents, school employees
Mobile Guardian is one of two companies that MOE uses to provide DMA solutions on students’ personal learning devices.
Gabrielle Chan | May 08, 2024
SINGAPORE - The software company at the centre of a hacking incident in April has been asked by the Ministry of Education (MOE) to appoint a forensic investigator to evaluate its systems and processes, and provide recommendations to prevent a recurrence.
Preliminary investigations by Mobile Guardian, which is headquartered in Surrey, Britain, show that an unauthorised individual had gained access to a support account on its management portal, using it to view information of customers based in the United States and Asia-Pacific region, including Singapore.
This affected about 67,000 parents and 22,000 school employees across 127 schools in Singapore, said Education Minister Chan Chun Sing in a written parliamentary reply on May 7.
He was responding to questions by Mr Don Wee (Chua Chu Kang GRC), Ms Joan Pereira (Tanjong Pagar GRC) and Dr Wan Rizal (Jalan Besar GRC) on MOE’s approach to ensuring the security and integrity of students’ personal learning devices, as well as measures to protect against online harm and data breaches.
The MPs raised concerns about the certification and training of IT vendors, response strategies for hacking incidents and governance policies for third-party service providers. They also asked about the ministry’s plans for enhancing transparency and communication with parents and the public regarding data security measures and breaches.
Investigations into Mobile Guardian’s systems are ongoing, and action will be taken if breaches of contractual obligations are found, said Mr Chan.
Mobile Guardian determined that the support account was compromised mainly due to inadequate password management, rather than the unauthorised individual exploiting vulnerabilities in its systems, he said.
The company had received an e-mail on April 12 that an unauthorised individual had gained access to its management portal, and this was considered a phishing e-mail, he said.
Mobile Guardian’s management portal is used for administrative purposes like providing technical support, and the portal has access to the name of the user, his or her e-mail address, time zone, school name and whether a person is a parent or a staff member, he said.
It is not able to change any configuration on the students’ personal learning devices, Mr Chan said, adding that none of the MOE or government IT systems have been compromised as the portal is not connected to them.
However, he said, no action was taken until after a second e-mail was received on April 16, when the individual showed proof of accessing the management portal and tried to extort money in exchange for keeping quiet about his or her ability to access the portal.
“Mobile Guardian acted on the second alert, and worked to establish the extent of access and customers affected.
“This included suspending all administrative accounts that could be used to access MG’s management portal,” Mr Chan said.
The ministry was notified on April 17 about the hacking incident, as well as the security measures implemented by Mobile Guardian on its management portal, he said.
With the support of the Cyber Security Agency and GovTech, MOE conducted security checks and did not find any suspicious activity on its Device Management Application (DMA) portal, nor any indication that the portal had been compromised.
On April 19, the ministry sent e-mails to all users affected to explain what the leaked information could be used for in the event that phishing or scam attempts were made, he said.
These users comprise parents and school employees who manage the DMA functions of their children and students.
A police report has been lodged over the incident, said Mr Chan.
“MOE takes a serious view of this incident,” he said. “Our IT service providers are contractually obligated to take measures to protect personal data against loss and unauthorised access.”
He added that the ministry expressed “deep dissatisfaction” with Mobile Guardian over this incident and will continue to safeguard IT systems by conducting independent audits and regular cyber-security testing.
“We will continue to place emphasis on user education and ongoing vigilance to ensure that our IT systems remain secure,” he said.
Mobile Guardian is one of two companies that MOE engages to provide DMA solutions which help schools and parents manage students’ use of their personal learning devices with functions like screen time limits.
The tender was awarded to Mobile Guardian in 2020, which holds the ISO27001 certification, an internationally recognised standard for information security management systems, Mr Chan said.
Source: https://www.straitstimes.com/singapore/moe-requests-forensic-investigation-after-data-breach-affecting-89000-parents-school-employees
Archive: https://archive.fo/AxoPh
-
CryptoChameleon: New Phishing Tactics Exhibited in FCC-Targeted Attack
February 29, 2024
Summary: Lookout recently discovered an advanced phishing kit exhibiting novel tactics to target cryptocurrency platforms as well as the Federal Communications Commission (FCC) via mobile devices. Following the tactics of groups like Scattered Spider, this kit enables attackers to build carbon copies of single sign-on (SSO) pages, then use a combination of email, SMS, and voice phishing to trick the target into sharing usernames, passwords, password reset URLs and even photo IDs from hundreds of victims, mostly in the United States.
Employees targeted at:
o Federal Communications Commission (FCC)
o Binance
o Coinbase
Cryptocurrency users at:
o Binance
o Coinbase
o Gemini
o Kraken
o ShakePay
o Caleb & Brown
o Trezor
Email, Password management, and Single sign-on services:
o LastPass
o AOL
o Gmail
o iCloud
o Okta
o Outlook
o Twitter
o Yahoo
Tactics and Flow of the FCC Phishing Site
Lookout first flagged this phishing kit when our automated analysis discovered a suspicious new domain registration that matched a common format used by Scattered Spider, as mentioned in a recent warning by CISA. The domain in question was fcc-okta.com, which is only a single character different from the legitimate FCC Okta Single Sign On (SSO) page.
This phishing kit first asks the victim to complete a captcha using hCaptcha. This is a novel tactic that prevents automated analysis tools from crawling and identifying the phishing site. It may also give the illusion of credibility to the victim, as typically only legitimate sites use captcha.
Upon visiting the site, the user is asked to confirm they are human.
Once the captcha is completed, the login page mimics the FCC’s legitimate Okta page.
A very good replica of the official Okta page for the targeted organization.
Upon providing their credentials, the victim can be sent to wait, sign in, or ask for the MFA token.
The victim is sent to a “loading” page to wait after entering their credentials.
Unlike typical phishing kits, which attempt to harvest credentials as quickly as possible, this one seems to be aware of modern security controls organizations have put in place such as MFA.
Lookout researchers saw that there is an administrative console that the operator uses to monitor the phishing page. While we were unable to directly access this console, we were able to access its javascript and css and piece together much of its functionality. Each time a victim visited the page and entered information, we observed that a new row was populated on a table. Once the victim enters their username and password, the admin is able to select from a long list of options of where to send them next.
The attacker likely attempts to log in using these credentials in real time, then redirects the victim to the appropriate page depending on what additional information is requested by the MFA service the attacker is trying to access, For example, they can be redirected to a page that asks for their MFA token from their authenticator app or a page requesting an SMS-based token.
The operator can choose various customizable pages to send the victim to next.
In some cases, when selecting an option, the operator will be prompted to provide more detailed information back to the victim. For example, when sending an SMS-based MFA token, the operator can provide the last digits of the victim’s actual phone number and customize whether the page should ask the victim for a 6 digit or 7 digit code to make it feel more legitimate.
The operator is prompted to customize the phishing page in real time by providing the last 2 digits of the phone number and selecting whether the victim should be asked for a 6 or 7 digit token.
Next, the operator would attempt to log in using the one-time password (OTP) token provided. At that point, the operator can direct the victim to any page, such as the real Okta sign in page, or a specific page with messages customized to different scenarios. For example, we found a page that tells the victim that their account is under review and to try to log in later at a time specified by the operator.
The operator would be asked to select a date when sending the victim to a page telling them their account was being reviewed.
While we were tinkering with the FCC Okta phishing site, the site was taken down and replaced with a racial slur.
Broader Phishing Kit Analysis
We were also able to investigate the phishing kit, which gave us additional insight into targets and tactics used. The kit contains numerous references to cryptocurrency platforms and SSO services. While the version of the kit targeted at the FCC impersonates the FCC’s specific Okta page by default, the kit is able to impersonate many different company’s brands.
The screenshot above displays this phishing kit’s ability to impersonate Coinbase
Based on the phishing site characteristics, Lookout researchers were able to identify other websites using this phishing kit. Most of the websites use a subdomain of official-server.com as their C2, in addition to others listed at the bottom of this report. We also found Okta impersonation pages targeting employees of Binance and Coinbase, but the majority of the sites seemed targeted at users of cryptocurrency and SSO services. Coinbase is the most-frequently targeted service. Since February 21, some of the newly registered phishing domains use subdomains of a new C2 original-backend.com
Lookout researchers have also been able to gain ephemeral access to the backend logs, where we noted consistently high quality of the stolen credentials. Typically, when accessing a phishing site’s data, it is filled with junk data that is obviously not someone’s real email address or password. However, a high percentage of the credentials collected by these sites look like legitimate email addresses, passwords, OTP tokens, password reset URLs, photos of driver’s licenses and more. The sites seem to have successfully phished more than 100 victims, based on the logs observed. Many of the sites are still active and continue to phish for more credentials each hour.
Some noteworthy files in the phishing kit include:
/js/consts.js contains the URL for the command and control (C2) server
/js/init.js contains the client-side logic for redirecting the victim and collecting the phished data
/css/ contains the style sheets for impersonating the sites
The phishing websites have been deployed on various hosting networks. In November and December of 2023, Hostwinds and Hostinger were the cybercriminals’ main choice of networks. However in January and February of 2024, most of the sites were hosted on RetnNet in Russia on IP 213.178.155.194. In general, it looks like sites hosted on RetnNet remain online longer compared to other hosting networks. This IP was active until February 17, after which the cybercriminals moved to new IP 185.12.127.233 on QWARTA LLC hosting services. On February 22, the cybercriminals moved to another IP 81.94.159.46 on OOO Westcall Ltd
Delivery Mechanisms Observed
We were also able to speak directly with some victims, and in doing so we were able to ascertain that a combination of phone calls and text messages were used to encourage the victim to complete the process. In one scenario, a victim received an unsolicited phone call that spoofed a real company’s customer support line. The person on the other end of the line was the threat actor, but sounded like a member of the support team from that company. They informed the victim that their account had been hacked, but that they would help them recover the account. While the victim was on the phone with the threat actor, they were sent a text message that linked them to the phishing page.
A text message provided by a victim, where they were alerted their account had been hacked (it had not) and to click on a phishing link to recover it.
While still on the phone with the victim, the threat actor encouraged them and helped them complete the steps. As a way to build credibility and trust, the actor consistently noted that the allegedly unauthorized device accessing the account was in Salt Lake City, Utah. This was mentioned in the text message, the phone call and on the phishing page itself (which is customizable to display different device types or locations).
The phishing kit contains specific references to the story being told to the victim on the phone and via text messages.
When directing the victim to the page above, the operator can select the device type and location to be displayed on the page.
When we asked victims to describe the person on the other end of the line they characterize them as sounding “American”, “well spoken”, and “had professional call-center communication skills”.
We believe that the combination of high quality phishing URLs, login pages that perfectly match the look and feel of the legitimate sites, a sense of urgency, and consistent connection through SMS and voice calls is what has given the threat actors so much success stealing high quality data.
Sifting through the logs, the majority of victim data that looks legitimate comes from iOS and Android devices, which indicates the attack is primarily targeted at mobile devices. The vast majority of the victims are in the US.
Attribution
This attack follows similar techniques as Scattered Spider – in particular impersonation of Okta, registration of domains using companyname-okta.com, and homoglyph swapping. An example of homoglyph swapping would be switching capital Is and lowercase Ls to make AcmeInc.com (with a capital I) look identical to Acmelnc.com (with a lowercase L substituted for the capital I). One domain that is used (binance-okta[..]com) has been known in the past to be affiliated with Scattered Spider .
Despite the similarities to Scattered Spider, there are enough differences to indicate that this is likely not being operated by that group. For example, despite the URLs and spoofed pages looking similar to what Scattered Spider might create, there are significantly different capabilities and C2 infrastructure within the phishing kit. This type of copycatting is common amongst threat actor groups, especially when a series of tactics and procedures have had so much public success.
It is unknown whether this is a single threat actor or a common tool being used by many different groups. However, there are many similarities in the backend C2 servers and test data our team found across the various phishing sites.
Protection
Based on similarities and similar infrastructure of previous attacks, Lookout customers have been protected against these phishing sites since before we identified this threat actor in January 2024. We have continued to track the general behaviors and techniques used to ensure protection against additional sites that use this kit and will continue to update protections through automated means as necessary.
Indicators of Compromise
Command and Control servers
lookoutsucks.com
official-server.com
server694590423.tech
island-placid-bromine.glitch.me
circular-noon-farmhouse.glitch.me
talented-friendly-price.glitch.me
dflfmgsdokasdcpl.com
original-backend.com
Phishing websites
help-lastpass.com
113712-coinbase.com
113912-coinbase.com
129045-coinbase.com
142724-coinbase.com
142746-coinbase.com
142764-coinbase.com
142786-coinbase.com
145126-coinbase.com
146282-coinbase.com
146784-coinbase.com
148942-coinbase.com
1502759-ledger.com
1519845-kraken.com
157192-uphold.com
157194-gemini.com
16159867-coinbase.com
16275-coinbase.com
167243-coinbase.com
17224652-coinbase.com
17384624-coinbase.com
173912-coinbase.com
17412627-coinbase.com
17512457-coinbase.com
17512657-coinbase.com
1751654-coinbase.com
1751854-coinbase.com
1751954-coinbase.com
17591024-coinbase.com
1759654-coinbase.com
17612416-coinbase.com
17612418-gemini.com
17612412-coinbase.com
17612486-coinbase.com
17618412-coinbase.com
17625-coinbase.com
17682192-coinbase.com
176822-coinbase.com
176823-coinbase.com
176824-coinbase.com
17691-coinbase.com
17825-coinbase.com
17913-coinbase.com
17916-coinbase.com
185417-coinbase.com
185421-coinbase.com
18547-coinbase.com
185614-coinbase.com
185617-coinbase.com
185914-coinbase.com
185924-uphold.com
187421-coinbase.com
18925-coinbase.com
191284-coinbase.com
192854-gemini.com
192856-coinbase.com
195102-coinbase.com
195127-coinbase.com
19524624-coinbase.com
19562-coinbase.com
19582-coinbase.com
195827-binance.com
197287-coinbase.com
83730493-coinbase.com
90251-gmail.com
90251-icloud.com
account-help-icloud.com
appie-pay.com
appleassist.org
applepayhelp.net
applepayhelp.org
blocked-coinbase.com
bofa-help.com
coinbase-login.com
coinbase-ticketsupport.com
coinbaseticketsupport.com
com-175691.help
com-83730493.help
com-fraud.management
com-ticket.info
compensation-coinbase.com
deposit-coinbase.com
finance-coinbase.com
firewall-coinbase.com
handle-coinbase.com
help-lastpass.com
indentity-coinbase.com
lockdown-coinbase.com
lockup-coinbase.com
login-nexo.com
nexotickets.com
officialbackupserver.com
original-backend.com
protection-kraken.com
receipt-coinbase.com
refunding-coinbase.com
reimburse-coinbase.com
reverts-coinbase.com
secureunlock-coinbase.com
securing-coinbase.com
swap-coinbase.com
ticketsupport-coinbase.com
transfers-kraken.com
unlock-kraken.com
verify-trezor.io
www-cb-wallet.com
www-cbwallet.com
www-coinbasewallet.com
www-help-apple.com
www-help-coinbase.com
bofa-help.com
suite-trezor.io
compensate-coinbase.com
142784-coinbase.com
ss-icloud.com07159889-coinbase.com
10195-coinbase.com
11246-coinbase.com
11247-coinbase.com
11248-coinbase.com
11258-coinbase.com
11259-coinbase.com
113912-coinbase.com
11472-coinbase.com
11923-coinbase.com
11957-coinbase.com
128147-coinbase.com
12958-coinbase.com
12984-okta.com
12985-coinbase.com
13130-coinbase.com
13247-coinbase.com
13247-icloud.com
13267-coinbase.com
146271510-coinbase.com
146282-coinbase.com
146284-coinbase.com
147260-coinbase.com
14765-coinbase.com
14817582-coinbase.com
14871904-coinbase.com
14891902-coinbase.com
1492864-coinbase.com
158312-coinbase.com
158372-coinbase.com
158702-coinbase.com
16171675-coinbase.com
16171832-coinbase.com
16178234-coinbase.com
16178237-coinbase.com
16178434-coinbase.com
162178-coinbase.com
162478-coinbase.com
162782-coinbase.com
162812-coinbase.com
162814-coinbase.com
16442580-coinbase.com
16450107-coinbase.com
16450207-coinbase.com
16458207-coinbase.com
16478202-coinbase.com
164872942-coinbase.com
16590-coinbase.com
16594373-coinbase.com
16624831-coinbase.com
16642124-coinbase.com
16642172-coinbase.com
16642580-coinbase.com
16642721-coinbase.com
16642724-coinbase.com
16642871-coinbase.com
16642872-coinbase.com
16712942-coinbase.com
16718672-coinbase.com
16728342-coinbase.com
16728348-coinbase.com
16728442-coinbase.com
16728472-coinbase.com
167285-coinbase.com
16729042-coinbase.com
16748272-coinbase.com
16782942-coinbase.com
16827420-coinbase.com
16827423-coinbase.com
16847145-coinbase.com
16893924-coinbase.com
17182-coinbase.com
17255030-coinbase.com
17259-kraken.com
172486-coinbase.com
17284652-coinbase.com
17286-coinbase.com
17334522-coinbase.com
17334522-kraken.com
17384522-coinbase.com
173912-coinbase.com
17494976-coinbase.com
17512854-coinbase.com
17512857-coinbase.com
1751954-coinbase.com
17525030-coinbase.com
17529580-coinbase.com
17614-coinbase.com
17618412-coinbase.com
17619-coinbase.com
176284-coinbase.com
17823920-coinbase.com
178253-coinbase.com
178294-coinbase.com
17912-coinbase.com
17914-coinbase.com
17917-coinbase.com
17954-coinbase.com
17958-coinbase.com
182043-coinbase.com
18275-gemini.com
18276-coinbase.com
18290185-coinbase.com
182967-coinbase.com
18560-coinbase.com
18571-coinbase.com
185912-coinbase.com
185914-coinbase.com
18592176-coinbase.com
18594162-coinbase.com
18594962-coinbase.com
18597162-coinbase.com
18719562-coinbase.com
1875290-coinbase.com
1882730-coinbase.com
18902-coinbase.com
18903-coinbase.com
189126-coinbase.com
18952-coinbase.com
192854-coinbase.com
192856-coinbase.com
19287-binance.com
19572-coinbase.com
195812-coinbase.com
195826-coinbase.com
1958262-coinbase.com
195827-binance.com
1958297-coinbase.com
19582970-coinbase.com
19582971-coinbase.com
19583-coinbase.com
19592653-coinbase.com
197304-coinbase.com
19730492-coinbase.com
19764162-coinbase.com
19803-coinbase.com
201784289-coinbase.com
210823644-coinbase.com
21158-coinbase.com
21509-coinbase.com
25985-coinbase.com
27699-coinbase.com
28367-coinbase.com
28676-coinbase.com
29185-coinbase.com
29195-coinbase.com
2a-coinbase.com
2b-coinbase.com
2c-coinbase.com
2f-coinbase.com
2fas-coinbase.com
2o-coinbase.com
2r-coinbase.com
2s-coinbase.com
2sv-coinbase.com
352134951-coinbase.com
38468-coinbase.com
39590-coinbase.com
41260-coinbase.com
427883-coinbase.com
43017-coinbase.com
47562-coinbase.com
50195-coinbase.com
5247-coinbase.com
54765-coinbase.com
57197-coinbase.com
58176-coinbase.com
58297-coinbase.com
61250-coinbase.com
61835-coinbase.com
61851-coinbase.com
61937-coinbase.com
71925-coinbase.com
72957-coinbase.com
72985-coinbase.com
74651-coinbase.com
754668948-coinbase.com
76159869-coinbase.com
76153-coinbase.com
81758-coinbase.com
81920-coinbase.com
81926-coinbase.com
81958-coinbase.com
826298-coinbase.com
83216-coinbase.com
837613-coinbase.com
83956-coinbase.com
87157-coinbase.com
87312-coinbase.com
89304-coinbase.com
89375-coinbase.com
91723-gemini.com
91752-coinbase.com
91756-coinbase.com
91782-coinbase.com
91835-coinbase.com
91845-coinbase.com
91923-coinbase.com
92758-coinbase.com
948122061-coinbase.com
978941-coinbase.com
accountrecovery-coinbase.com
action-shakepay.com
adjust-coinbase.com
admin-kraken.com
applechargebacks.com
authenticate-gemini.com
authorize-gmail.com
binance-okta.com
captcha-coinbase.com
cd-coinbase.com
coinbase-heip.com
coinbase-live.support
coinbase-reject.com
coinbase-ticket.com
coinbaseheip.com
com-2fa.help
com-2fa.support
com-3845.support
com-connect.help
com-fraud.support
com-help.support
com-reset.help
com-reset.net
com-ticket.live
com-ticket.support
contact-nexo.com
convert-coinbase.com
customerservice-coinbase.com
default-coinbase.com
defend-coinbase.com
deny-coinbase.com
disconnect-coinbase.com
escalate-coinbase.com
establish-coinbase.com
fcc-okta.com
fraudulent-coinbase.com
guard-apple.com
guard-icloud.com
guardian-coinbase.com
guide-gemini.com
help-bitfinex.com
help-shakepay.com
helpdesk-apple.com
helpdesk-gemini.com
helpdesk-icloud.com
identification-coinbase.com
lockdown-coinbase.com
login-nexo.com
keys-coinbase.com
messages-coinbase.com
newpassword-coinbase.com
prompt-coinbase.com
protect-apple.com
protect-coinbase.com
protect-gmail.com
protect-kraken.com
recoverme-coinbase.com
recoveryportal-coinbase.com
refunds-coinbase.com
reset-okta.com
restore-coinbase.com
return-coinbase.com
reverts-coinbase.com
secure-binance.us
secure-icloud.com
secure-nexo.com
secure-shakepay.com
security-umusic.com
server694590423.tech
session-coinbase.com
startrecovery-coinbase.com
signin-kraken.com
suite-trezor.io
supportportal-coinbase.com
tech-icloud.com
threat-coinbase.com
ticket-apple.com
ticket-coinbase.com
tickets-apple.com
tokens-coinbase.com
unblock-coinbase.com
unlink-coinbase.com
your-coinbase.com
welcome-coinbase.com
www-coinbasewallet.com
www-help-coinbase.com
www-help-gemini.com
Authors
David RichardsonVice President of Product, Endpoint and SecurityDavid Richardson has been building software to help individuals and enterprises secure mobile devices for over a decade. David currently leads the endpoint product management team and the security team at Lookout. He has 45 patents issued related to mobile security. He is a frequent speaker at security conferences on the topic of iOS and Android security.
Savio Lau
Senior Staff Security Intelligence Researcher
Savio is a Security Intelligence Researcher at Lookout focusing on mobile phishing and content protection. Prior to joining Lookout, he worked as a threat researcher at Sophos for over a decade focusing on reversing and detecting Windows malware. He graduated with a Bachelor and a Masters of Applied Science, both from Simon Fraser University. He has many interests in infosec including network security, web security, malware, and spam.
Source: https://www.lookout.com/threat-intelligence/article/cryptochameleon-fcc-phishing-kit (https://www.lookout.com/threat-intelligence/article/cryptochameleon-fcc-phishing-kit)
Archive: https://archive.fo/olvfH (https://archive.fo/olvfH)
-
South Korean woman loses $70k to scam involving deepfake of Elon Musk
Apr 24, 2024
SEOUL – A South Korean woman was persuaded to purportedly invest 70 million won (S$69,600) after seeing a deepfake video of what appeared to be chief executive of Tesla Elon Musk, according to local reports on April 23.
Ms Jeong Ji-sun, whom South Korean broadcaster KBS has agreed to refer to by a pseudonym, shared how she became a victim of a romance scam on its In-Depth 60 Minutes.
On the April 19 episode, Ms Jeong opened up about how she first started talking with the con artist, who claimed to be Mr Musk.
“I experienced something like a dream last year. On July 17 (in 2023), ‘Musk’ added me as a friend on Instagram. Although I have been a huge fan of Musk after reading his autobiography, I doubted it at first.”
But Ms Jeong’s doubts did not last long.
“‘Musk’ sent me his ID card and a photo of him at work. In addition, ‘Musk’ talked about his children and about taking a helicopter to work at Tesla or SpaceX. He also explained that he contacts fans randomly.”
When Ms Jeong asked the scammer what it was like when he met South Korean President Yoon Suk-yeol in April 2023, he answered that “Yoon talked about... ‘Let’s establish gigafactories in Seoul and Jeju’”, according to Ms Jeong.
Yes, I would also like to receive SPH Media Group's SPH Media Limited, its related corporations and affiliates as well as their agents and authorised service providers.
marketing and promotions.
“‘Musk’ even said, ‘I love you, you know that?’ when we made a video call.”
After seeing a video of what appeared to be Mr Musk, Ms Jeong came to believe that the scammer was who he claimed to be.
The scammer later provided a Korean bank account number, and said: “I’m happy when my fans are getting rich because of me.”
However, South Korean laws lack provisions which may help to prevent such crimes, according to the show.
The show pointed out that many of the romance scams take the form of the victim making a payment via credit on fake websites set up by the criminal, which is not specified as a situation in which payment can be suspended.
According to a recent study conducted at Seoul-based Korea University, in a total of 280 crimes categorised between January and June of 2022, 71.4 per cent of the victims were women. THE KOREA HERALD/ ASIA
Source: https://www.straitstimes.com/asia/east-asia/south-korean-woman-loses-70k-to-elon-musk-deepfake-scam
Archive: https://archive.fo/en8Qa
-
Law firm Shook Lin & Bok hit by ransomware attack
Ang Hwee Min | 2 May 2024
SINGAPORE: Law firm Shook Lin & Bok was hit by a ransomware attack in April, it confirmed on Thursday (May 2).
The incident was discovered on Apr 9 and the law firm said it immediately engaged a cyber security team. Its systems were contained as of 2am on Apr 10, it said in a statement to CNA.
There is no evidence so far that the firm’s core document management systems, which contain client data, were affected, the statement read.
The firm continues to operate as per usual. It is also working closely with cyber security teams and other specialists to minimise the impact to its clients and stakeholders arising from the “illegal cyber intrusion”.
According to an article on SuspectFile, which calls itself an independent website focusing on the ransomware phenomenon, Shook Lin & Bok paid a ransom of US$1.4 million in Bitcoin to the Akira ransomware group.
The group initially demanded a ransom of US$2 million, which was negotiated down after a week, the article said.
The Cyber Security Agency of Singapore (CSA) said it was aware of the incident and has offered assistance to the law firm.
“The government strongly discourages victims from paying ransom, as there is no guarantee that locked data will be decrypted or that stolen data will not be used for malicious purposes once ransom has been paid,” its spokesperson said in a statement to CNA.
“Threat actors may also see such organisations as soft targets who are willing to pay up, and strike again. Paying also encourages the threat actors to continue their criminal activities and target more victims.”
Shook Lin & Bok did not respond to questions about whether they paid the ransom and how much they paid. CNA understands the firm has made a police report.
“All steps taken thus far in response to the illegal cyber intrusion and steps that we intend to take in future are and will be done with the best interest of our clients and stakeholders at the forefront of our consideration,” it said in its statement.
Ransomware remains a growing concern in Singapore and around the world, said the CSA spokesperson.
Organisations should take steps to enhance their posture against ransomware threats, said the spokesperson, urging them to refer to the government’s ransomware portal at go.gov.sg/rwportal for tools and resources.
If hit by ransomware, organisations should report it as soon as possible to the police and CSA’s Singapore Cyber Emergency Response Team, the spokesperson added.
China’s biggest lender, the Industrial and Commercial Bank of China, paid a ransom last November to the Lockbit ransomware gang. ICBC’s US arm was hit by a ransomware attack that disrupted trades in the US Treasury market.
The blackout at ICBC's US broker-dealer left it temporarily owing BNY Mellon US$9 billion, an amount many times larger than its net capital.
The hack was so extensive that even corporate email at the firm ceased to function, forcing employees to switch to Google mail, Reuters reported.
Also in November 2023, London-based law firm Allen & Overy suffered a “data incident impacting a small number of storage servers", but its email and document management system was not affected. Lockbit also took credit for the hack.
In 2023, Lockbit claimed to have hacked a number of high-profile companies, including aerospace giant Boeing and Britain's Royal Mail.
Source: https://www.channelnewsasia.com/singapore/shook-lin-and-bok-akira-ransomware-paid-ransom-bitcoin-4308441 (https://www.channelnewsasia.com/singapore/shook-lin-and-bok-akira-ransomware-paid-ransom-bitcoin-4308441)
Archive: https://archive.fo/fW9QL (https://archive.fo/fW9QL)
Reference 1a: Akira Decryptor (web), https://www.nomoreransom.org/en/decryption-tools.html (https://www.nomoreransom.org/en/decryption-tools.html)
Reference 1b: Akira Decryptor (Windows/7z): http://ip5.us/download/forum/avast_decryptor_akira64.7z (http://ip5.us/download/forum/avast_decryptor_akira64.7z)
SHA256 signature: bfe6f4279d1d25296f327d2f2a856660aaf88c3b1732fe2f34c9f227d2834223
Reference 2: SPF Ransomware resources, https://www.police.gov.sg/Advisories/Crime/Cybercrime/Ransomware (https://www.police.gov.sg/Advisories/Crime/Cybercrime/Ransomware)
Reference 3 (Anatomy of Akira Ransomware): https://www.trellix.com/en-sg/blogs/research/akira-ransomware (https://www.trellix.com/en-sg/blogs/research/akira-ransomware)
Reference 4: https://www.sentinelone.com/anthology/akira (https://www.sentinelone.com/anthology/akira)
Reference 5: SentinelOne Demo: SentinelOne VS Akira Ransomware - Detection and Mitigation
-
Poly intern accessed 55 OCBC customers’ info without authorisation; jailed six weeks
Christine Tan | Aug 05, 2023
SINGAPORE - While serving an internship at OCBC, a polytechnic student accessed 55 customers’ information without authorisation, including sensitive details such as their account balance.
The customers included “prominent local and foreign personalities, including political and public figures”, according to court documents, which did not reveal their identities.
Among the 55 customers was also one of the student’s friends, whose complaint to the bank led to the discovery of the offence.
Leon Leong Hong Jun, 25, who was a Nanyang Polytechnic (NYP) student at the time of the offence, pleaded guilty on Friday to one charge of unauthorised access to computer material under the Computer Misuse Act.
He was jailed for six weeks.
Court documents said Leong committed the offences in April 2022. At the time, he was on a school internship in the business compliance department of OCBC.
Tasked to help in data gathering and the procuring of review documents for the bank, he was given access to OCBC’s banking system, which contains customers’ details.
Between April 1 and 29, 2022, Leong entered the banking system to conduct searches on people whom he knew or knew about.
In total, he retrieved the profile information of 55 OCBC customers, including their names, identification numbers, addresses, as well as education and employment history.
Said Deputy Public Prosecutor Yee Jia Rong: “At all times, the accused knew that he was unauthorised to access these 55 customers’ profile information, as he was not doing so for business purposes.”
One of these customers was Leong’s friend. One day, in the course of an argument between them, Leong told the friend that he knew his personal banking information, including his bank balance.
On April 28, 2022, the friend complained to OCBC about Leong’s unauthorised access and disclosure of his information.
Questioned by the bank, Leong “admitted to his actions and claimed to have done so out of boredom and curiosity”, said DPP Yee.
The prosecutor said that Leong did not disclose any profile information of the 55 customers to any third party.
However, the fact that Leong had readily disclosed a friend’s personal information in an argument “clearly indicates his lack of restraint in dealing with such illegally obtained information”, said DPP Yee.
A representative from OCBC lodged a police report on June 13, 2022.
Calling for two to three months’ imprisonment for Leong, DPP Yee said there was significant potential harm to the affected customers. Not only had Leong accessed highly sensitive and confidential information of ordinary individuals, but he had also retrieved that of political and public figures.
For such high-profile people, the risk of onward dissemination and distribution of their information is significantly higher, said the prosecutor.
DPP Yee said deterrence should be the dominant sentencing consideration, noting that a major financial institution’s computer systems were breached.
NYP was informed about the offence after OCBC filed the police report.
Leong is currently a Year 3 student at NYP, said a spokesman for the polytechnic in response to The Straits Times’ queries.
While court proceedings were ongoing, the polytechnic had also convened a disciplinary inquiry. ST understands that Leong has not been suspended or expelled.
His six-month internship was terminated after the offence came to light.
The NYP spokesman said: “The polytechnic expects our students to obey the law at all times, and takes a strong stance against such acts of misuse.”
Source: https://www.straitstimes.com/singapore/courts-crime/polytechnic-intern-accessed-55-ocbc-customers-info-without-authorisation-jailed-six-weeks
Archive: https://archive.fo/RV9tC
-
MedStar Health Notifies 183,079 Patients of Recent Data Breach
May 6, 2024
On May 3, 2024, MedStar Health filed a notice of data breach with the U.S. Department of Health and Human Services Office for Civil Rights after discovering that an unauthorized party was able to access the company’s email system. In this notice, Medstar explains that the incident resulted in an unauthorized party being able to access consumers’ sensitive information, which includes their names, mailing addresses, dates of birth, dates of service, provider names, and health insurance information. Upon completing its investigation, Medstar began sending out data breach notification letters to all individuals whose information was affected by the recent data security incident.
If you received a data breach notification from MedStar Health, it is essential you understand what is at risk and what you can do about it. A data breach lawyer can help you learn more about how to protect yourself from becoming a victim of fraud or identity theft, as well as discuss your legal options following the MedStar Health data breach. For more information, please see our recent piece on the topic here.
What Caused the MedStar Health Data Breach?
The Medstar Health data breach was only recently announced, and more information is expected in the near future. However, Medstar’s filing with the U.S. Department of Health and Human Services Office for Civil Rights provides some important information on what led up to the breach. MedStar Health also posted a website notice discussing the incident.
According to these sources, MedStar Health recently learned that an unauthorized party had been able to access its email environment. In response, Medstar launched an investigation and confirmed that the email accounts were subject to unauthorized access intermittently between January 25, 2023 and October 18, 2023. The Medstar Health investigation also revealed that the affected email accounts contained confidential information belonging to certain patients.
After learning that sensitive consumer data was accessible to an unauthorized party, MedStar Health reviewed the compromised files to determine what information was leaked and which consumers were impacted. MedStar Health completed this process on March 6, 2024. While the breached information varies depending on the individual, it may include your name, mailing address, date of birth, date of service, provider name, and health insurance information.
On May 3, 2024, MedStar Health began sending out data breach letters to anyone who was affected by the recent data security incident. These letters should provide victims with a list of what information belonging to them was compromised.
More Information About MedStar Health
MedStar Health is a not-for-profit health system based out of Columbia, Maryland. MedStar Health operates ten hospitals and more than 300 care locations in Maryland, Virginia, and Washington, D.C. MedStar Health employs more than 32,000 people and generates approximately $6.3 billion in annual revenue.
Source: https://www.jdsupra.com/legalnews/medstar-health-notifies-183-079-5813066
Archive: https://archive.fo/wbsce
-
Mother of all breaches reveals 26 billion records: what we know so far
January 29, 2024 | Vilius Petkauskas, Deputy Editor
The supermassive leak contains data from numerous previous breaches, comprising an astounding 12 terabytes of information, spanning over a mind-boggling 26 billion records. The leak, which contains LinkedIn, Twitter, Weibo, Tencent, and other platforms’ user data, is almost certainly the largest ever discovered.
There are data leaks, and then there’s this. A supermassive Mother of all Breaches (MOAB for short) includes records from thousands of meticulously compiled and reindexed leaks, breaches, and privately sold databases. The full and searchable list is included at the end of this article.
Bob Dyachenko, cybersecurity researcher and owner at SecurityDiscovery.com, together with the Cybernews team, has discovered billions upon billions of exposed records on an open instance.
Even though at first the owner of the database was unknown, Leak-Lookup, a data breach search engine, said it was the holder of the leaked dataset. The platform posted a message on X, saying the problem behind the leak was a “firewall misconfiguration,” which was fixed.
According to the team, while the leaked dataset contains mostly information from past data breaches, it almost certainly holds new data, that was not published before. For example, the Cybernews data leak checker, which relies on data from all major data leaks, contains information from over 2,500 data breaches with 15 billion records.
The MOAB contains 26 billion records over 3,800 folders, with each folder corresponding to a separate data breach. While this doesn’t mean that the difference between the two automatically translates to previously unpublished data, billions of new records point to a very high probability, the MOAB contains never seen before information.
Researchers believe that the owner of the MOAB has a vested interest in storing large amounts of data and, therefore, could be a malicious actor, data broker, or some service that works with large amounts of data.
“The dataset is extremely dangerous as threat actors could leverage the aggregated data for a wide range of attacks, including identity theft, sophisticated phishing schemes, targeted cyberattacks, and unauthorized access to personal and sensitive accounts,” the researchers said.
The supermassive MOAB does not appear to be made up of newly stolen data only and is most likely the largest compilation of multiple breaches (COMB).
While the team identified over 26 billion records, duplicates are also highly likely. However, the leaked data contains far more information than just credentials – most of the exposed data is sensitive and, therefore, valuable for malicious actors.
MOAB graphic
A quick run through the data tree reveals an astoundingly large number of records compiled from previous breaches. The largest number of records, 1.4 billion, comes from Tencent QQ, a Chinese instant messaging app.
However, there are supposedly hundreds of millions of records from Weibo (504M), MySpace (360M), Twitter (281M), Deezer (258M), Linkedin (251M), AdultFriendFinder (220M), Adobe (153M), Canva (143M), VK (101M), Daily Motion (86M), Dropbox (69M), Telegram (41M), and many other companies and organizations.
The leak also includes records of various government organizations in the US, Brazil, Germany, Philippines, Turkey, and other countries.
According to the team, the consumer impact of the supermassive MOAB could be unprecedented. Since many people reuse usernames and passwords, malicious actors could embark on a tsunami of credential-stuffing attacks.
“If users use the same passwords for their Netflix account as they do for their Gmail account, attackers can use this to pivot towards other, more sensitive accounts. Apart from that, users whose data has been included in supermassive MOAB may become victims of spear-phishing attacks or receive high levels of spam emails,” the researchers said.
The leak’s scale is of yet unseen proportions. For example, in 2021, Cybernews reported a COMB that contained 3.2 billion records – only 12% of the supermassive MOAB of 2024.
We are updating the Cybernews data leak checker to include information from the MOAB, which will allow users to see whether their data was included in the largest known data leak. Meanwhile, users are strongly advised to stay vigilant and take care of their cyber hygiene.
Everyone should use strong, hard to guess passwords, enable multi-factor authentication on all important accounts, keep an eye for phishing and spear phishing attempts, check for password duplicates and immediately set up new protection for accounts that share the same passwords.
007.no
07elites.com
1000cv.it
1000literaryagents.com
1001pharmacies.com
12306.cn
123fish.net
:
:
:
zonealarm.com
zonehacks.com
zooma.ru
zoomcar.com
zoomcourier.ph
zoomsearchengine.com
zooplus.de
zoosbook.com
zoosk.com
zooville.org
zortam.com
zouve.com
zoxxe.eu
zunal.com
zxmail.ru
zybez.net
zynga.com
zzrbikes.com
Source: https://cybernews.com/security/billions-passwords-credentials-leaked-mother-of-all-breaches
Archive: https://archive.fo/Dzh28
-
Mysterious actor spills over 1.2B records on Chinese users
May 14, 2024 | Ernestas Naprys, Senior Journalist
An unknown actor is building a COMB – a compilation of many breaches – targeting Chinese individuals and already has over 1.2 billion records. Each one contains at least a phone number but often includes other sensitive data such as address or ID card number – and it’s leaking online.
On May 6th, the Cybernews research team discovered a colossal dataset solely focused on citizens of China. The entity behind it likely inadvertently misconfigured the Elasticsearch (data storage and search tool) instance and left the data leaking onto the internet.
The actor started inflating the COMB recently, as the first entry was uploaded on the 29th of April. A week later, the endpoint contained 1,230,703,487 personal data records of Chinese citizens and counting.
The entire population of China is roughly 1.4 billion, and the COMB is about 87% of that. Each record in the 100-gigabyte size leak contains at least a phone number.
Most of the data is aggregated from previous public leaks. However, the compilation also includes some private and previously unseen datasets.
“Such an immense collection of personal information suggests the individuals behind it likely have ulterior motives,” the Cybernews research team warns. “The complete dataset is likely to contain duplicates, but that may be by design. It allows threat actors to view all the leaked data about a person, tying together different data points from different leaks and breaches.”
This discovered COMB is the second largest leak this year, following the 26 billion records in the Mother of All Breaches (MOAB) collection left open by a data breach search engine.
What’s inside the stash?
The COMB is hosted in a data center in Germany. The leaky Kibana instance, the dashboard interface for viewing the data, was set to Simplified Chinese, suggesting that the administrator could also be of Chinese origin.
The data chest includes the following:
- 668,304,162 records containing QQ account numbers and phone numbers. QQ is a hugely popular social media app in China, similar to WhatsApp.
- 502,852,106 records containing Weibo account IDs and phone numbers. Weibo is a Chinese microblogging platform, similar to a hybrid of Twitter and Facebook.
- 50,557,417 records in the ShunFeng sub-dataset, including phone numbers, names, and addresses. ShunFeng provides logistic/courier services in China.
- 8,064,215 records in the Siyaosu sub-dataset, exposing names, phone numbers, addresses, and Identity Card numbers.
- 746,310 records in the sub-dataset called Chezhu, leaking name, phone number, email address, address, and Identity Card Number data.
- 100,790 records in the Pingan sub-dataset contain names, phone numbers, email addresses, home addresses, ordered services, card numbers, and amount paid. Ping An is an insurance company in China.
- 78,487 records in the Jiedai sub-dataset leaked names, phone numbers, addresses, ID card numbers, places of work, education levels, partner names, and phone numbers.
The intent may be malicious
At the time of discovery, attribution for the massive data leak could not be definitively made, as no individual or group has openly claimed responsibility for it.
“The discovered data was likely obtained illegally and is possibly intended to be used for illegal purposes. The data likely belongs to an individual threat actor or a group of individuals,” Cybernews researchers said.
Usually, large amounts of data are used in a black market for illegal services to search for previously leaked information. It may also be preparations for large-scale robocalling, scams, or phishing attempts focusing on Chinese citizens.
The data hoarder appears to have no interest in passwords, as none are present, despite many leaks in the past exposing them.
“The choice of Elasticsearch as data repository is also telling, as it is a go-to tool for both storing large amounts of data and also quickly searching for that data,” researchers said
Elasticsearch is capable of rapid sorting, near real-time data searching, and is highly scalable.
At the time of discovery, the personal information stash had just started to be built, with the potential for additional data to be included in the future.
The Cybernews research team has informed the German cloud provider about the seemingly illegally-stored and open data repository.
China has suffered massive data leaks in the past. In 2022, hackers claimed to have breached the Shanghai police, stealing data on one billion Chinese citizens. Last year, the data of 630 million Chinese was exposed on a Russian-linked forum, including bank card details.
The dangers ahead
People in China should be aware that their data is being compiled for potential future campaigns where threat actors may attempt widespread targeting.
Most of the data is not new. However, it only matters a little for malicious actors as long as the data itself is valid.
The users whose personal information has been included in the COMB may be targeted in spear-phishing attacks and receive higher than usual levels of spam emails, calls, or text messages from fraudsters.
While there are no passwords in the datasets, cybercrooks can still try to gain unauthorized access to accounts by matching the usernames and passwords from other leaks.
Phone numbers are often used as a means of authentication or account recovery. Therefore, attackers could attempt to steal identities or access online accounts without authorization.
“Scamming operates on a percentages basis. Armed with a billion phone numbers, attackers can attempt social engineering attacks to gain trust, impersonate individuals, or manipulate victims into revealing more sensitive information,” our researchers warn.
Other possibilities include using data for surveillance and tracking, especially if state-sponsored entities are involved.
Source: https://cybernews.com/security/mysterious-actor-exposes-billion-chinese-users
Archive: https://archive.fo/hswnC
-
Jumbo Group, Mustafa hit by cyber attacks
Ang Qing | 23 May 2024
SINGAPORE - Two well-known Singapore companies, Jumbo Group and Mustafa, have been hit by cyber attacks.
Jumbo Group said in a bourse filing on May 23 that the seafood restaurant chain was subjected to a “ransomware incident” recently.
The statement, signed off by group chief executive and executive director Ang Kiam Meng, did not mention the date, duration or extent of the attack, and whether a ransom was paid.
The group said neither it nor external experts have noticed any evidence of data being removed unlawfully, based on preliminary investigations.
It said: “The group had activated its business continuity plan immediately.
“As at the date of this announcement, there has been no significant impact to the group’s business operations arising from the incident.”
It added that the incident has been reported to the authorities, including the police, the Personal Data Protection Commission (PDPC) and the Cyber Security Agency of Singapore.
When contacted, a Jumbo Group spokesperson said it was unable to give more details due to ongoing investigations.
Separately, the Mustafa group of companies – which runs a shopping mall in Little India, among other businesses – has been hit by a data leak.
On April 25, a cyber attacker on popular hacker forum BreachForums claimed to have stolen the personal information of Mustafa customers and employees. The forum has been shut down in recent weeks.
The hacker, who previously claimed to have stolen data from a global database that companies use to identify potential criminals, alleged that he had obtained 180GB of data belonging to Mustafa.
Files uploaded onto the forum, seen by The Straits Times, contained data including full names, NRIC numbers and home addresses. The files have since been removed.
In response to ST’s queries, the PDPC said it is aware of and investigating the incident involving Mustafa, and has also contacted the group for more information.
Meanwhile, a Mustafa spokeswoman said it has engaged external cyber-security professionals and an auditor, and started a “thorough review” of its IT systems.
She added: “We have also reported the matter to the relevant authorities in Singapore.
“As investigations are still ongoing, we are not able to provide any other details at this stage.”
The group did not respond to queries on the timeline of its response to the attack and whether a ransom was paid.
Source: https://www.straitstimes.com/singapore/courts-crime/jumbo-group-mustafa-hit-by-cyber-attacks
Archive: https://archive.fo/WyKyV
-
Software firm fined $74k for data breach caused by weak password; half a million users affected
Ang Qing | 24 May 2024
SINGAPORE – A company running online language lessons for children around the world used a password based on its website name, LingoAce, making it vulnerable to the data breach that resulted.
More than half a million users were affected. Among personal data compromised were the cellphone numbers, bank account numbers, signatures and Chinese nationals’ identity card numbers.
Singapore-based firm PPLingo was fined $74,000, according to a Personal Data Protection Commission (PDPC) judgment released on May 23. It runs online Chinese and English language classes for children aged four to 15.
Some time in April 2022, a hacker obtained an administrator account password of LingoAce – “lingoace123” – via brute force attacks, a method that uses trial and error to crack encryption keys.
The password had remained unchanged for more than two years before the breach.
Using the privileged access of the compromised admin account, the hacker accessed personal data of 557,144 users, among them approximately more than 300,000 minors.
In the subsequent week, the hacker informed the firm that he had accessed LingoAce’s systems and listed personal data of several users in the text to prove this.
However, he did not follow up with any demands.
The commission found that the company had failed to put in place reasonable security arrangements to protect the personal data of its students, parents and staff.
The company was also found liable for not appointing anyone to ensure that it complied with Singapore’s data protection laws.
It appointed a data protection officer only after the data breach, more than five years after the firm was incorporated in 2016.
PDPC found that the firm’s security arrangement to protect personal data was inadequate because it did not have a password policy, apart from requiring a minimum length of eight characters.
As the company’s passwords did not need to be complex and never expired, hackers could easily gain access to the compromised admin account through brute force attacks.
The password was also vulnerable because it was based on the platform’s name and a common sequence of numbers.
The firm had also failed to implement multi-factor authentication for the compromised admin account. This feature has since become a baseline requirement for admin accounts to systems holding confidential, sensitive or large volumes of personal data.
Given factors like the firm’s prompt remedial action, which included notifying affected users, the commissioner determined that the firm would be fined $74,000.
After the firm was informed of the decision in July 2023, it asked for a lower fine because of several considerations, including the fact that the firm had made voluntary notifications about the breach to other data protection authorities in more than 40 other affected locations.
To avoid “double counting”, the firm asked that the commission consider only Singapore-based individuals when assessing the number of people impacted.
These reasons were rejected by the commission, which said that it would not lower the fine even if other data protection authorities meted out penalties for the same case.
PDPC also said that a firm is responsible for all personal data in its possession, not just those of individuals located here.
On May 23, PDPC also announced it had slapped a $28,000 fine on ferry operator Horizon Fast Ferry for a data leak affecting nearly 108,500 people who had booked tickets.
This was the second time that the Singapore-based firm, which provides ferries between Singapore and Batam, had been fined for flouting data protection laws here.
Personal data impacted in the leak included customers’ passport number, date of birth and passport issue as well as expiry date.
In March 2023, Horizon Fast Ferry had received several ransomware e-mails, which revealed that personal data of the firm’s customers had been leaked.
About a month later, the firm informed PDPC of the leak. It also took remedial actions such as engaging a vendor to develop a new website.
The commission found that the firm had failed to implement reasonable security arrangements, including not ensuring that its IT support vendor had staff sufficiently familiar with its operating system.
Source: https://www.straitstimes.com/singapore/poor-password-causes-software-firm-to-be-fined-74000-for-data-breach-affecting-half-a-million-users
Archive: https://archive.fo/HXupd
-
Data of 560 million Ticketmaster customers stolen, say hackers
30 May 2024
SYDNEY: A hacking group has claimed to have accessed the details of 560 million Ticketmaster customers worldwide.
ShinyHunters posted evidence of the hack on the dark web, according to a screenshot shared widely on social media, claiming to have swiped the personal details of Ticketmaster customers.
The group demanded a ransom payment of US$500,000, describing it as a "one-time sale", according to the post.
The stolen data purportedly included names, addresses, emails, phone numbers and the last four digits of customer credit card numbers along with the expiry dates.
CNA has contacted Ticketmaster for more information, including whether customers in Singapore were affected.
Australia's government said on Thursday (May 30) that its cyber security office was "engaging" with United States-based Ticketmaster about the apparent hack.
It urged people with "specific inquiries" to contact Ticketmaster directly.
The FBI has offered assistance to Australian authorities after a hacking group claimed to have accessed the details of 560 million customers worldwide, a US Embassy spokesperson said on Thursday.
HACKING "WILL GROW"
In January, a court in Los Angeles jailed Sebastien Raoult, a French computer hacker who was part of the ShinyHunters criminal gang.
He was sentenced to three years in prison and ordered to pay more than US$5 million in restitution after pleading guilty to conspiracy to commit wire fraud and aggravated identity theft.
US prosecutors said the extensive hacking caused millions of dollars in losses to victim companies and "unmeasurable additional losses" to hundreds of millions of individuals whose data was sold to other criminals.
Hacks are impacting more people with increasingly severe consequences, University of Wollongong cybersecurity professor Katina Michael told AFP.
The number of people hacked "will grow, it could be up to one billion in the future", she said.
Governments, companies and consumers are not doing enough to protect themselves or investing in basic protection mechanisms like two-factor authentication, Michael warned.
Ticketmaster, a California-based company, operates one of the largest online ticket sales platforms in the world.
The US Department of Justice last week filed a major antitrust lawsuit seeking to break up an alleged monopoly held by Live Nation Entertainment and its Ticketmaster subsidiary in the live music industry.
Ticketmaster's pricing practices, with high fees and lack of alternatives, have long been a political issue in the US, with little done historically to open up the market to more competition.
Source: https://www.channelnewsasia.com/world/ticketmaster-hack-customer-information-shinyhunters-560-million-ransom-4373031
Archive: https://archive.fo/jn2sU
-
2 weeks' jail for man who asked friend to conduct unauthorised search on DBS' customer info system
Jasmine Ong | May 19, 2023
SINGAPORE — To find an acquaintance who owed him money, Ang Kok How got a friend who was a DBS employee to do an unauthorised search on the bank's customer information system to illegally obtain the person's address and work place.
Ang, 35, who is a Singaporean, pleaded guilty on Friday (May 19) to a charge under the Computer Misuse Act and was sentenced to two weeks' jail.
Another charge under the Banking Act was taken into consideration during sentencing.
Ang's friend, Liong Yan Sin, pleaded guilty on Nov 21 last year to 10 charges under the Computer Misuse Act and six charges under the Banking Act, and was sentenced to 16 weeks' jail.
HOW IT HAPPENED
Before its investigations, the Commercial Affairs Department received a police report made by DBS, which alleged that between May 1 and Dec 6, 2018, Liong had not only accessed customers' information without any authorisation, but also disclosed some of the information to Ang.
Liong was employed by DBS then as a collections officer whose duty was to speak to bank customers about their outstanding payments, attend to their queries, and discuss payment plans with them.
He was given access to the bank's customer information system for the purposes of his job, and was made aware that he cannot disclose customers' information in an unauthorised manner or access customers' details outside the scope of his duties.
Deputy Public Prosecutor (DPP) Thiagesh Sukumaran said that Ang and Liong were acquaintances who engaged in activities such as gambling, drinking and playing basketball together.
The two were also mutually acquainted with a person named "Kelly", who had borrowed money from Ang to play poker.
She owed Ang around S$23,000 and even though she had paid back a small sum of the money, she stopped when she could not be contacted in September 2018.
Liong then asked Ang if he needed help to find Kelly.
Ang knew that in doing so, Liong would have to conduct an unauthorised search on the bank's customer information system in order to find Kelly's details.
Despite that, Ang asked Liong whether it was illegal to conduct such a search but was dismissed by Liong who told him "not to worry".
Ang eventually agreed to Liong's offer to find Kelly and on Sept 19 in 2018, Liong made searches on the system for customer details belonging to Kelly, and later obtained her registered home address and place of employment, which he gave to Ang.
It was not stated in court documents if Ang visited Kelly to try to get his money back.
Seeking a sentence of two to three weeks' jail, DPP Thiagesh said that even though Ang's culpability was lower than Liong, he had "abetted" Liong into making the unauthorised search on the system.
Disagreeing with the prosecution, Ang's lawyer Amarjit Singh of Amarjit Sidhu Law Corporation urged District Judge Kamala Ponnampalam to consider a one week jail sentence because Ang "only agreed to Liong's offer" and did not "disseminate the information", so there is no "abuse of trust" in this matter.
In delivering her sentence, the judge agreed with the prosecution that there is "no dispute" that the crime is serious and there should be "parity" with the sentence given to Liong since Ang also had a similar role in the offence.
For abetting Liong in conducting the unauthorised search through DBS' Customer Information System, Ang could have been fined up to S$5,000 or jailed for up to two years, or both.
Source: https://www.todayonline.com/singapore/2-weeks-jail-man-who-asked-friend-conduct-unauthorised-search-dbs-customer-info-system-2175181
Archive: https://archive.fo/BFzQL
-
Nurse who took 65 patients' details from clinic database to help boyfriend abuse cough syrup gets jail
Nikki Yeo | June 3, 2024
SINGAPORE — By logging into a clinic’s patient information system without authorisation, a nurse obtained the names and National Registration Identity Card (NRIC) numbers of at least 65 inactive patients to aid her boyfriend in abusing cough syrup.
Tan Tong Lin, 42, pleaded guilty to two charges under the Computer Misuse Act and one cheating charge on Monday (June 3). She was sentenced to five months’ jail.
The court heard that Tan was a nurse at M/S Helen Tan Clinic, which sold cough syrup over the counter without consultations, as long as patients gave their names and identity card numbers.
The clinic also had a rule that only 240ml of cough syrup could be sold to any given patient over a period of nine days.
To circumvent this rule and hide the fact that he was abusing cough syrup, Tan’s boyfriend Ng Kai Loon sought her help to buy cough syrup from the clinic under other patients’ names around May 1, 2021.
After agreeing to his request, Tan logged into the clinic’s patient information system and got a list of inactive patients’ details, whose patient statuses had been deactivated because they had not returned to the clinic for some time.
Obtaining the names and NRIC numbers of at least 65 patients without her employer’s authority, Tan shared this list of patients with her boyfriend.
She also reactivated patients’ statuses on at least 25 occasions between May 2021 and December 2021 to allow Ng to buy cough syrup under these patients’ names.
During the same period, her boyfriend bought cough syrup from the clinic while Tan was on duty, supposedly on behalf of the patients whose personal information he provided, though Tan knew Ng was buying it for his own consumption.
Tan sold cough syrup on at least 25 occasions and recorded these transactions under the personal details of the patients that Ng provided.
Her offences were discovered only a few months later in February 2022, when a patient complained that the clinic had allowed others to collect medication under her identity.
The clinic hired a private investigator for S$12,000 to uncover the offences.
In mitigation, the nurse’s lawyer, Mr Kalaithasan Karuppaya from law firm Regent Law LLC, urged the court to exercise leniency in sentencing.
He said that Tan “sincerely regrets” her actions and understood the seriousness of her offences, and said that she would not be back in court as an offender.
Tan had been convicted before of theft offences and the possession of drugs and drug utensils, the court heard.
In sentencing, District Judge Terence Tay said that Tan had abused her position as a nurse in a clinic to fuel her boyfriend’s substance abuse over a “long period of time”.
Although he noted that Tan had pleaded guilty at an early stage, he added that NRIC numbers are “sensitive information” that can lead to “dire consequences” such as identity theft.
Tan's breach of the clinic’s system could also have led to inaccurate record keeping, the judge added.
Anyone convicted of cheating can be jailed for up to 10 years and be fined.
Those who commit an unauthorised modification of computer material can be jailed for up to three years or fined up to S$10,000, or both, on a first offence. In the case of a second offence and conviction, a person can be jailed for up to five years or fined up to S$20,000, or face both punishments.
For committing unauthorised access to the clinic's patient information system, Tan could have been jailed up to two years or fined up to S$5,000, or both. In the case of a second or subsequent conviction, an offender could be jailed for up to three years or be fined up to S$10,000, or both.
Source: https://www.todayonline.com/news/nurse-took-patient-details-clinic-database-boyfriend-abuse-cough-syrup-jail-2434796
Archive: https://archive.fo/l4MA3
-
Personal data of 128,000 customers of moneylenders stolen after IT vendor hacked
25 Jul 2024
SINGAPORE: The personal information of about 128,000 customers of moneylenders has been stolen after a third-party IT vendor was hacked.
The Ministry of Law (MinLaw) on Thursday (Jul 25) confirmed the data breach involved the borrower data of 12 licensed moneylenders that are using the services of Ezynetic, a third-party IT vendor they engaged.
Ezynetic's system is not hosted on or linked to the government's network, said MinLaw, which is the regulator of licensed moneylenders.
The ministry added that Ezynetic's system was "accessed by a malicious actor" and data containing "personal identifiable information" was leaked.
In response to CNA's query, MinLaw said the compromised data included the names and NRIC numbers of borrowers, as well as loan information.
"The data has appeared on several sites. Affected borrowers have been advised to be on the alert for phishing and other scam attempts using the compromised data," said the ministry.
The 12 moneylenders are Ban King Credit, Credit 21, Lending Bee, Katong Credit, Credit Thirty3, GS Credit, 1AP Capital, Creditmaster, BST Credit, U Credit, Horison Credit and Credit Matters.
The moneylenders and Ezynetic have made reports to the police, the Cyber Security Agency of Singapore (CSA) and the Personal Data Protection Commission (PDPC).
They have started notifying their borrowers of the breach and have reminded them to stay vigilant against possible phishing scams, MinLaw said.
Eight other licensed moneylenders that use Ezynetic's services were not affected.
As a containment measure, Credit Bureau Singapore (CBS) has restricted access to the platform for all 20 licensed moneylenders served by Ezynetic.
Credit Bureau Singapore is the designated credit bureau that operates the Moneylenders Credit Bureau (MLCB) platform - a central repository of data on borrowers’ loans and repayment records with all licensed moneylenders in Singapore.
MLCB’s online functions remain fully available to the other 133 licensed money lenders in Singapore. Borrowers with queries may reach out to the respective licensed moneylenders for more information.
The ministry said it takes a serious view of the data breach.
"The licensed moneylenders have a duty to protect any information in its possession or control. This includes information residing on their third-party vendor systems.
"MinLaw is investigating the matter with CSA and PDPC. MinLaw is also in close contact with Credit Bureau Singapore to support affected licensed moneylenders' business recovery efforts."
Source: https://www.channelnewsasia.com/singapore/data-breach-licensed-moneylenders-minlaw-third-party-vendor-hack-4503606
Archive: https://archive.fo/vl8LJ
-
Esso discount programme customers’ credit card details possibly exposed after ransomware attack
Ariel Yu | Aug 30, 2024
SINGAPORE – The credit card details of motorists on the Esso Corporate Fleet Discount Programme could potentially have been exposed, after a ransomware attack on Singapore firm Abecha, which runs the programme.
In an e-mail to affected customers on Aug 28, Abecha said it discovered the attack on its servers and customer database on Aug 13. Customers’ credit card numbers and expiry dates could not be accessed as a result.
“As far as we are aware, none of your other personal data (such as names, addresses or any other contact details) was affected,” the e-mail stated.
Customers were advised to monitor their credit card statements for any unauthorised transactions, and report any suspicious transactions or unusual activity.
When contacted, an Abecha spokesman said: “There is no evidence that any data has been exfiltrated or extracted by the unauthorised party resulting from the incident. We will also like to assure our customers that there is no impact on any transactions, and it is very much business as usual for them.”
The Esso Corporate Fleet Discount Programme, a tie-up with ExxonMobil, has had more than 18,000 customers since it was launched in 2003.
The card is offered to corporate employees. Abecha also has similar programmes for corporate customers with Citibank and DBS Bank cards.
The firm declined to disclose the number of customers affected. It said it acted swiftly to shut down the affected servers. It also engaged professional data protection and cyber-security experts to investigate the incident and advise on the security measures to undertake.
Abecha has made a police report and notified the Personal Data Protection Commission Singapore, which said it is investigating the incident.
Public relations professional Alson Tang, 39, said he is worried as he had provided his bank account number when he registered for the Esso Corporate Fleet Discount Programme. “Fuel prices are very high and the discount is attractive, but my trust in the organisation has been shaken somewhat.”
Mr Davidson Chua, 25, co-founder of car selling aggregator platform Telequotes, said the news was “definitely shocking”.
He has not observed any suspicious transactions on the credit card that he used to sign up for the bulk fuel discount programme in April. “Without knowing about this news, I wouldn’t have checked my credit card transactions, and anything could have happened since I do not use the Abecha Esso fleet card on a regular basis,” he said, adding that he plans to cancel his card.
Source: https://www.straitstimes.com/singapore/esso-discount-programme-customers-credit-card-details-possibly-exposed-after-ransomware-attack
Archive: https://archive.fo/sepWp
An actual data breach notification received from Abecha:
From: "Billing Enquiry @ Abecha" <BillingEnquiry@abecha.com>
Subject: Notification of Cybersecurity Incident
Date: Tue, 3 Sep 2024 07:23:15 +0000
Dear Sir / Madam,
1. We are writing to inform you of a data security incident involving our customer database.
2. On 13 August 2024, we discovered that we were the victim of a ransomware attack, which infected our servers and customer database by encrypting and rendering inaccessible the following personal data:
(a) First and last names; and
(b) GIRO bank account numbers.
3. We acted swiftly to contain the situation by shutting down the affected servers, as well as engaging professional data protection and cybersecurity experts to investigate the incident and advise on the IT security enhancement initiatives that we should undertake. These investigations are still ongoing. We have also made a police report, as well as notified the Personal Data Protection Commission of Singapore. Please be assured that we are treating this matter with utmost seriousness.
4. At the time of this notification, we do not have any evidence to suggest that the customer databases were extracted and/or used for malicious purposes. We will inform you if our ongoing investigations reveal otherwise. Nevertheless, we recommend that you monitor your GIRO account for any unauthorised transactions, set limits on any GIRO deductions if necessary, and report any suspicious transactions or unusual activity.
5. We regret that this ransomware attack has taken place. We place great emphasis on protecting the personal data that we handle and are committed to being transparent about this incident. Every effort has been, and will be, taken to complete our internal investigations, stem the data breach and prevent recurrences. We are also proactively enhancing our cybersecurity infrastructure.
6. If you have further queries or require more information please contact our customer care team at BillingEnquiry@abecha.com
Best regards,
Abecha Customer Care Team
-
S’pore’s Personal Data Protection Commission investigating Bukit Sembawang Estates’ ‘cybersecurity incident’ in August
Jovi Ho | Wed, 2 Oct 2024
A string of Singapore Exchange-listed firms have been hit by cybersecurity attacks this year, including Beng Kuang Marine, YKGI, Jumbo Group, Aztech Global, IPS Securex Holdings and RE&S Holdings.
The Personal Data Protection Commission (PDPC) is conducting an investigation into a cybersecurity incident at Bukit Sembawang B61 Estates, which was first reported on Aug 13.
In an Oct 2 bourse filing, the Mainboard-listed company says the PDPC is investigating whether there has been a breach of the data protection obligations under Section 50 of the Personal Data Protection Act 2012, or PDPA.
Bukit Sembawang Estates is cooperating with the PDPC in the investigation.
Established in 2013, PDPC is Singapore's main authority body for administering the PDPA. The PDPC serves as Singapore’s main authority in matters relating to personal data protection and represents the Singapore government internationally on data protection-related issues.
The group had announced on Aug 13 that it had suffered a cybersecurity incident where an unknown party gained unauthorised access to certain IT servers and blocked off access to data.
According to a Sept 19 bourse filing, the group's appointed third-party forensic adviser said “certain data of the group may have been compromised and potentially exfiltrated”.
A string of Singapore Exchange S68-listed firms have been hit by cybersecurity attacks this year.
Beng Kuang Marine revealed on Aug 19 that its external IT service provider was the target of a ransomware attack. Soon Lian Holdings 5md and Hiap Seng Industries reported similar incidents in July.
YKGI, Jumbo Group 42r, Aztech Global 8az, IPS Securex Holdings, ES Group (Holdings) and RE&S Holdings 1g1 all reported ransomware attacks earlier this year.
Shares in Bukit Sembawang Estates closed flat at $3.77 on Oct 2.
Source: https://sg.finance.yahoo.com/news/pore-personal-data-protection-commission-150557247.html
Archive: https://archive.fo/YLlvR
-
Duo linked to Singapore-based Chinese cybercrime ring gets jail over purchased data of 9,369 people
Seow Gim Shen and Kong Chien Hoi conspired with Sun Jiao, an alleged member of a global Chinese cybercrime syndicate, to have the data supplied to them for a price.
Duo linked to Singapore-based Chinese cybercrime ring gets jail over purchased data of 9,369 people
Lydia Lam | 24 Oct 2024
SINGAPORE: Two Malaysian businessman who conspired with an alleged Chinese cyber criminal to buy the personal data of more than 9,300 people, believed to be stolen from gambling websites, were sentenced to 14 weeks' jail each on Wednesday (Oct 24).
Penang resident Seow Gim Shen, 42, and Selangor resident Kong Chien Hoi, 39, had pleaded guilty to one charge each of conspiring with Chinese national Sun Jiao to have the personal information of 9,369 unknown individuals supplied to them.
The prosecution had sought six months' jail for each of the men, while defence lawyers asked for a fine of S$10,000 each.
In sentencing, District Judge Christopher Goh noted the amount of personal information involved, accepting that only about a third of these particulars were "in some way active".
He noted also that the data was paid for, and that there had been further negotiations to obtain more data, although that fell through as Sun was arrested.
He viewed the reasons for obtaining the information - for online remote gambling - as an aggravating factor, saying he could not see this as being simply a business transaction.
He considered also the transnational nature of the offence, as Sun was living in Singapore when he provided the data to Seow and Kong, who were not in Singapore.
However, he said that this case was "less egregious" in the wider scheme of things than if it involved Singpass, NRIC or credit card details.
The information obtained included names and phone numbers of Thai nationals.
Seow and Kong were allowed to defer their jail terms while they consider lodging an appeal.
THE CASE
Seow was introduced to Sun, 42, by a Chinese national in 2019 at a casino in Cambodia.
He was told that Sun dealt in databases of personal information and could sell them to people involved in online gambling operations.
Seow then introduced Sun to his friend Kong, as he knew Kong had a client dealing in online gambling operations.
The two Malaysian men did not know that Sun was staying in Singapore, or what businesses he ran.
Sun is allegedly part of a global cybercrime syndicate based in Singapore, run by Chinese criminals who operated out of a rented bungalow in Mount Sinai, with alleged victims from countries like India and Korea.
Kong, Seow and Sun later shared a chat group titled “Malaysian Data” for Sun and Kong to negotiate the sale of the illegally obtained personal information.
After Kong asked to buy Thai nationals' personal information, Sun said he had the information of over 1 million Thais.
Kong asked for a sample, intending to use the data for an online gambling operation he was assisting in.
Sun sent a file to Kong and Seow on Jul 24 over WhatsApp, containing the personal information of more than 9,000 people including their names and phone numbers.
The file was a sample extracted from a larger database and was part of negotiations for the sale of the full database.
Kong had an associate get the data tested. A detailed report showed that 34 per cent of the 2,000 numbers could be contacted. An SMS blast sent out to the 9,369 numbers showed that 32 per cent of the SMSes were successfully delivered.
Kong then sent the report results to Sun in the group chat and negotiated a price, with more data included. Kong said he also needed the personal information of people from Malaysia, Thailand and Vietnam, and asked Sun to let him know how many phone numbers he could provide.
On Sep 7, Seow asked Sun if he had data of Vietnam nationals. Sun sent a file containing the personal information of 6,800 people including Vietnamese names, email addresses, mobile numbers and bank account numbers.
On Sep 13, Kong transferred 20,000 USD Tether (about S$26,200) to Sun to pay for the full database of over a million people.
However, the two Malaysians did not receive the data, as Sun had been arrested.
About 160 officers from the Criminal Investigation Department conducted simultaneous raids islandwide on Sep 9, arresting six men believed to be linked to the syndicate of "global malicious cyber operators", the court heard.
Sun was arrested at a condominium along Bidadari Park Drive. He had a laptop containing computer programmes that could be used in cyber attacks.
Police forensic investigations uncovered the Malaysia data WhatsApp chat group, to which Kong and Seow belonged.
On Sep 21, the two Malaysians entered Singapore for the Grand Prix and were arrested two days later when attempting to leave the country.
Sun is remanded and his case is pending.
Source: https://www.channelnewsasia.com/singapore/duo-linked-singapore-based-chinese-cybercrime-ring-gets-jail-over-purchased-data-9369-people-4699751
Archive: https://archive.fo/dM09A
-
800,000 people just had their full names, SSNs and more exposed in massive insurance admin company data breach
Anthony Spadafora | 26 Oct 2024
Staying safe from hackers is hard enough as it is but even if you take all the necessary precautions, your personal data could still end up being exposed online as the result of a data breach and that’s exactly what just happened to more than 800,000 people.
As reported by BleepingComputer, the insurance administrative services company Landmark Admin has revealed that it suffered a data breach following a cyberattack that occurred back in May of this year. While you likely haven’t heard of this company before, there’s a chance it could have access to your sensitive personal information.
Landmark Admin is a third-party administrator for a number of insurance companies and it provides back-office services for them such as new business processing and claims administration. In fact, some of the insurance companies it works with include American Monumental Life Insurance Company, Pellerin Life Insurance Company, American Benefit Life Insurance Company, Liberty Bankers Life Insurance Company, Continental Mutual Insurance Company and the Capitol Life Insurance Company.
If any of the companies listed above happen to be your insurance company, then there’s a chance you may receive a data breach notification letter in the mail, if you haven’t already. Here’s everything you need to know about this latest data breach and what steps you should take next if your personal data was exposed online.
From cyberattack to data breach
The reason we know about this data breach in the first place is due to the fact that Landmark Admin had to submit extensive details on what happened in a filing with the Maine Attorney General’s office. In fact, similar filings from other companies are one of the ways in which we often learn more about data breaches.
In this particular filing, Landmark Admin explained that it first detected suspicious activity on its network back on May 13. To prevent this cyberattack from spreading further, the company shut down its IT systems and disabled remote access to its network.
From there, Landmark Admin worked with a third-party cybersecurity firm to investigate this incident and see whether or not any data was stolen during the attack. As it turns out, the company and the cybersecurity firm found evidence that the hackers behind the attack accessed files on the network that contained the sensitive personal information of approximately 806,519 people.
In the data breach notification sent out to affected individuals, Landmark Admin explained that the following information may have been accessed by hackers:- First name/initial and last name
- Date of birth
- Addresses
- Social Security numbers
- Tax identification numbers
- Driver’s license numbers
- Passport numbers
- Health insurance policy number
- Medical information
It’s worth noting though that the amount of exposed information “varies for each potentially impacted individual” according to Landmark Admin. This means that while one victim might have had their name and address exposed, another could have had their SSN and medical information exposed.
How to stay safe after a data breach
So what should you do if your insurance company used Landmark Admin’s services and your personal data was exposed as a result of this breach? For starters, you should check your mailbox to see if you received a data breach notification letter in the mail.
In case you’re wondering what this kind of notice would look like, there’s a sample copy included as a PDF in Landmark Admin’s filing with the Maine Attorney General’s office linked further up in this story. This letter has even more details on the incident and what the company did in its aftermath to protect its systems and the customer data stored on them.
While some companies fail to offer additional protection to affected customers or impacted individuals in this case, Landmark Admin is providing 12 months of free access to one of the best identity theft protection services through IDX. While we haven’t reviewed this particular service yet, IDX has been in business for 20 years, serves over 40 million customers and is used by Fortune 500 companies as well as the U.S. federal government.
If your identity happens to be stolen as a result of this data breach, IDX provides up to $1 million in identity theft insurance. These funds can be used to help get new documents, recover any lost wages or other damages and to hire legal counsel if necessary. Affected individuals will have access to credit monitoring services for a year as well.
For those who may be overly worried – and rightfully so after a data breach like this one — there are a number of different online data leak checkers you can use to see if your personal and financial information has ended up on the dark web. While Troy Hunt’s Have I Been Pwned is one of the oldest and most widely known, Surfshark recently launched its own data leak checker. However, as the number of data breaches has shot up in recent years, it’s likely you might find out that your data was exposed in a different incident. This is why the letter from Landmark Admin is the best way to know if your personal information was part of this particular data breach.
From here, you’re going to want to monitor all of your online accounts to look for anything unusual or suspicious. If the hackers behind this breach have your SSN, they could try and open new financial accounts, apply for a loan or even get a job or visit the doctor using your information. Likewise, if a cybercriminal commits crimes using your SSN, they end up on your criminal record.
If a year's subscription to credit and identity theft monitoring isn't enough for you, Murphy Law Firm has begun investigating claims on behalf of affected individuals. In fact, the law firm is currently putting together a class action lawsuit and you can join it here.
Data breaches like the one detailed above are becoming all too common but at least this time, Landmark Admin did the right thing by providing affected individuals with identity theft and credit monitoring. As for the data breach itself, the company and law enforcement are still investigating and we could learn more about it in the future.
Source: https://www.tomsguide.com/computing/online-security/800-000-people-just-had-their-full-names-ssns-and-more-exposed-in-a-massive-insurance-admin-company-data-breach
Archive: https://archive.fo/Z9lvR
-
IC numbers linked to S'pore businesses easily obtained on Acra portal
Using Acra's portal, people were able to access the NRIC numbers of those connected to a Singapore-registered business.
Sandra Davie and Lee Li Ying for The Straits Times | Dec 13, 2024
People have raised privacy concerns over being able to access individuals’ National Registration Identity Card (NRIC) numbers on the Accounting and Corporate Regulatory Authority’s (Acra) portal.
People were able to access the IC numbers of those connected to a Singapore-registered business.
The concerns were raised by readers spooked by recent scams, including what happened to a holidaying couple whose bank accounts were blocked and credit cards cancelled by identity thieves.
On Dec 11, The Straits Times was alerted to the search feature on the Bizfile portal for business regulations and filings.
“I found my IC number on Bizfile,” said housewife Gina Tan, who started checking the portal after a scammer posing as an Interpol officer called her mother and read out her address and IC number.
Believing that they were legitimate because they had her details, her mother almost sent the scammers her own bank details, but was stopped in time by Mrs Tan.
Telcos are required to verify users’ identities – by using Singpass or photo identification cards such as NRICs or work passes – when issuing physical SIM cards or e-SIMs.
Mrs Tan also found the names and IC numbers of her friends.
On Dec 12, ST was able to obtain the NRIC numbers and full names of several prominent businessmen and Cabinet ministers directly from the Bizfile website, free.
For $33 a name, ST was also able to buy the full profiles of these people and obtain their listed business address, current appointments and past appointments.
ST contacted Acra and the Infocomm Media Development Authority on Dec 12 for comment.
Source: https://tnp.straitstimes.com/news/singapore/ic-numbers-linked-spore-businesses-easily-obtained-acra-portal (https://tnp.straitstimes.com/news/singapore/ic-numbers-linked-spore-businesses-easily-obtained-acra-portal)
-
Govt apologises for Acra lapse, will accelerate efforts to educate public on proper NRIC use
Goh Yan Han | 20 Dec 2024
SINGAPORE - Efforts to educate the public on the proper use of NRIC numbers will be accelerated, amid uncertainty and anxiety after the disclosure of the identification numbers on the business portal of the Accounting and Corporate Regulatory Authority (Acra) last week.
Plans to consult the private sector on the issue will also be fast-tracked.
At an almost two-hour press conference on Dec 19, Minister for Digital Development and Information Josephine Teo, Second Minister for Finance Indranee Rajah and Acra chief executive Chia-Tern Huey Min apologised multiple times for the anxiety caused.
They also assured Singaporeans that the Government was taking the public’s concerns on the matter seriously.
Asked if the move away from the use of masked NRIC numbers was a policy U-turn, Mrs Teo said the Government has been consistent in its stance on the proper way NRIC numbers should be handled.
The only thing that has changed is that the Government has decided not to use masked NRIC numbers, she said.
This move is meant to protect Singaporeans from the vulnerabilities and risks associated with the incorrect practice of using the number as an authenticator, rather than a unique identifier, she said.
For example, some organisations have started depending on individuals producing their full NRIC numbers as proof of who they are to grant access to privileged information or services – this makes the NRIC an authenticator, beyond simply identification.
Partial NRIC numbers are also not as secure as people think they are, as a good guess of one’s full NRIC number can be generated with partial numbers, especially if the year of birth is known.
Mrs Teo said the Government was intending to address the issue and the false sense of security that has arisen through its broad move to stop using masked NRIC numbers within government functions.
In her opening remarks, she said: “I would firstly like to acknowledge the concerns of the public, which we take very seriously. We are very sorry to have caused them much anxiety.
“We had wanted to give them better protection, and this required a change in our policy involving the use of NRIC numbers.”
The confusion started on Dec 9 when Acra launched its new Bizfile portal, which allowed users to search for individuals linked to business entities. It then provided full NRIC numbers as part of its aim to provide transparency of business operations.
This caused anxiety and an outcry among Singaporeans long used to having NRIC numbers as private and confidential information.
The Ministry of Digital Development and Information’s (MDDI) response on Dec 13 revealed that the move was a coordination mishap – Acra had run ahead of the Government’s intent to phase out the use of masked NRIC numbers.
At the press conference, Mrs Chia-Tern said Acra had misunderstood an MDDI circular issued earlier to government agencies to cease any planned use of masked NRIC numbers in new business processes and services.
It had taken this to mean that it should unmask NRIC numbers in its new portal – for example, rendering *****456A as S0123456A.
“This was a mistake on Acra’s part, and I apologise for this. Our oversight has caused anxiety and confusion to the public,” she said.
The search function in question was disabled on the night of Dec 13, and a new version will be launched next week with search results that do not show any NRIC numbers.
Ms Indranee said that while this change will make it less convenient for some users of Bizfile, the authorities had assessed this to be the right balance to strike between corporate transparency and public concerns regarding personal information.
She added that the ministry and Acra are “thoroughly reviewing the incident to identify areas where we should have done and can do better, including improving the communication and coordination between agencies, and the features of our digital services”.
When asked how many NRICs had been made accessible in the new Bizfile portal, Ms Indranee said that was something the authorities are checking on.
The Government had intended for this move away from the use of masked NRIC numbers to first be a within-government effort, such as in cross-agency functions, said Mrs Teo.
This would improve efficiency and also address a false sense of security regarding the numbers within the Government itself.
The ministry knew that changing mindsets would have to be done over a period of time, and a major effort would be needed to help Singaporeans understand the risks, due to longstanding practices, said Mrs Teo.
Within the Government, some steps to do this had already been taken. Agencies were instructed to stop using NRIC numbers as a password or to prove someone is who he claims to be.
They were also told to discontinue the use of masked NRIC numbers, starting with new services, and followed by existing services as each service is updated, said Mrs Teo.
The ministry had also made plans for a public education campaign covering three broad areas.
These include the risks currently faced with NRIC numbers being used improperly, as well as how Singaporeans can better protect themselves and organisations can change their incorrect practices.
Further down the road, the authorities would need to educate the public on how they view the NRIC number and to return it to its original purpose as a unique identifier, said Mrs Teo.
These were all in the works, and the current situation is not for want of trying or an unwillingness to communicate, she said.
“All this was at the back of our minds… This timeline has become very compressed as a result (of this incident),” said Mrs Teo.
“We had thought that we could stage it out properly, but clearly, given people’s anxiety, we have got to compress the timeline and do it much earlier,” she said.
The concepts surrounding this change are not easily explained to people, and there are different dimensions to consider, such as the difference between not using masked numbers versus unmasking numbers or using other identifiers, she noted.
“Not using masked NRIC numbers does not mean that we will unmask all currently masked NRIC numbers. We should have made this clear,” she said.
There is also a public consultation scheduled for 2025 to get feedback from the private sector and members of the public.
While the Government has made clear its stance on the use of NRIC numbers, it recognises that its usage of the numbers is different from the private sector.
In a statement on the evening of Dec 19, the Association of Banks in Singapore, which comprises over 150 local and foreign banks, said that banks are conducting a thorough review of their practices on the use of NRIC numbers.
It also assured consumer banking customers that NRIC numbers alone cannot be used to make payment or fund transfers.
Mrs Teo said the Government has not decided on updated guidelines for private sector usage, adding that consultation is necessary to inform changes to these guidelines set out by the Personal Data Protection Commission.
For now, the guidelines that were issued in 2018 remain valid, stressed Mrs Teo.
Organisations and individuals that have been careful and responsible in how they collect and use NRIC numbers should continue with their current practices.
Those who are using NRIC numbers – full or partial – as a password or authenticator should stop as soon as possible.
“We are not making drastic overnight changes. We do, however, need to move decisively to phase out the incorrect uses of the NRIC number, the sooner the better,” said Mrs Teo.
Source: https://www.straitstimes.com/singapore/govt-apologises-for-acra-lapse-will-accelerate-efforts-to-educate-public-on-proper-nric-use (https://www.straitstimes.com/singapore/govt-apologises-for-acra-lapse-will-accelerate-efforts-to-educate-public-on-proper-nric-use)
Archive: https://archive.fo/VGZJ9 (https://archive.fo/VGZJ9)
__________________________
Misunderstanding of internal govt circular led to unmasking of NRIC numbers on Bizfile: Acra
Source: Straits Times
Article Date: 20 Dec 2024
Author: Lee Li Ying
Acra CEO apologises for lapse and says agency should have taken more care.
A misunderstanding of an internal government circular and lack of coordination between government staff had led to the disclosure of full NRIC numbers on a new business portal, said the chief executive of the Accounting and Corporate Regulatory Authority (Acra).
The Ministry of Digital Development and Information (MDDI) had in July issued a circular to government agencies telling them to stop using masked NRIC numbers in new business processes and services as part of a broader policy shift to gradually move away from using NRIC numbers as a method of authentication.
At a press conference on Dec 19, Acra chief executive Chia-Tern Huey Min said staff from her agency had “interpreted the requirements to cease the use of masked NRIC numbers as needing to unmask the numbers in our new Bizfile portal”.
“Acra sought to clarify with MDDI what were the scope and implementation timeline of this new requirement. But communications between the two agencies were not sufficiently clear, leading to Acra’s mistaken thinking,” said Mrs Chia-Tern.
Acra rolled out its new Bizfile portal on Dec 9. It allowed the public to access full NRIC numbers via a search for free, sparking concerns about data privacy.
Mrs Chia-Tern apologised for the lapse, which she said had caused anxiety and confusion among the public.
“As the owner of the Bizfile portal, Acra should have been more mindful that many Singaporeans have long treated their NRIC numbers as private and confidential information, and would not want to have their full NRIC numbers searchable on the new portal,” she said.
“We should also have taken more deliberate care to ensure that such information, deemed sensitive by many, is provided only when needed. Acra will learn from this lesson and tighten our systems and processes,” she added.
Minister for Digital Development and Information Josephine Teo said the miscommunication took place despite attempts to coordinate and seek clarification. “We are very sorry,” she added.
Acknowledging the confusion caused by the Government’s statement that it is moving away from masked NRIC numbers, she clarified multiple times during the two-hour press conference that this new approach does not mean automatically unmasking and using a person’s full NRIC number in all circumstances.
The Government is not asking for all NRIC numbers to suddenly be revealed, Mrs Teo said.
She noted that the Government uses full NRIC numbers to facilitate services such as disbursements of grants and subsidies to different individuals with the same name, for example.
The private sector will be consulted to get feedback on what scenarios may require the use of unmasked NRIC numbers, among other issues, Mrs Teo added.
Second Minister for Finance Indranee Rajah said the Government is reviewing the incident to identify areas where communication and coordination between agencies can be improved.
“It is still premature at this stage to say if anything is going to happen to particular staff in question... This is an instance of a misunderstanding. One has to ascertain exactly how that came about, and have a look at the full facts before deciding on what, if anything, needs to be done,” she said.
Mrs Chia-Tern also explained Acra’s role as the national business registry, which has to maintain transparency in Singapore’s business environment.
To do so, it has to establish and administer a repository of information relating to business entities and the people behind the entities, and provide access to this information.
The Bizfile portal allows the public to search for the name and unique entity number of companies, as well as company directors and shareholders.
This information enables companies or individuals to carry out checks before they decide to do business with another party.
For example, a company considering appointing an individual as a board director can check the Bizfile portal for the individual’s associations with other companies.
“This helps the company in a few ways – it can reveal potential conflicts of interest, past bankruptcies involving the individual, the performance of companies the individual is associated with, and whether the individual is holding an excessive number of directorships,” said Mrs Chia-Tern. “These insights are crucial for the company to obtain but may not be appropriate to inquire directly from the individual.”
Mrs Teo also said that despite Acra’s exemption from Personal Data Protection Act (PDPA) requirements, the Government has always taken seriously its responsibility to protect the data entrusted to the public sector and will continue to strengthen its data governance practices.
“To be clear, the Government’s personal data protection standards, set collectively by the Public Sector Governance Act and our own internal rules, are aligned with the PDPA and adapted to the public service context. So, it is not as though within the Government, there are no rules,” said Mrs Teo, adding that such internal rules existed even before the PDPA came into force.
She added: “Acra, like other public agencies, is expected to comply with these rules and the Public Sector Governance Act, which are no less stringent than the PDPA requirements, and often more stringent.”
Source: https://www.singaporelawwatch.sg/Headlines/misunderstanding-of-internal-govt-circular-led-to-unmasking-of-nric-numbers-on-bizfile-acra (https://www.singaporelawwatch.sg/Headlines/misunderstanding-of-internal-govt-circular-led-to-unmasking-of-nric-numbers-on-bizfile-acra)
Archive: https://archive.fo/fOh1G
(https://archive.fo/fOh1G)
Reference 1: Personal Data Protection Act 2012, https://sso.agc.gov.sg/Act/PDPA2012 (https://sso.agc.gov.sg/Act/PDPA2012)
Reference 2: Public Sector Governance Act, https://sso.agc.gov.sg/Act/PSGA2018
(https://sso.agc.gov.sg/Act/PSGA2018)
-
Hong Kong crime ring used deepfake personas and dating apps to steal millions
Kyle Baird | 5 January 2025
Hong Kong authorities have dismantled a criminal syndicate that exploited deepfake technology and dating apps to con victims in Taiwan, Singapore, and Malaysia for over HK$34 million.
The operation led to the arrest of 31 individuals and the seizure of HK$100 million in suspected criminal assets, including cash, luxury handbags, and watches.
The group operated from two rented locations in Kowloon Bay.
Recruits were trained to create fake online personas using AI-powered deepfake images of attractive individuals. They then lured victims into online romantic relationships.
Once trust was established, the scammers persuaded victims to invest in fraudulent crypto platforms.
Victims believed they were profiting from their investments until attempts to withdraw funds were met with demands for taxes or penalty fees.
Superintendent Charles Fung Pui-kei highlighted the syndicate’s use of AI tools to enhance their deception.
“They used face-swapping technology to create convincing profiles, tricking victims into believing they were interacting with real people,” Fung said.
These are all hallmarks of “pig butchering” scams.
Globally, such scams siphoned over $4.4 billion last year, according to TRM Labs.
In research published earlier this year, the blockchain intelligence firm found that 75% of wallets linked to pig butchering scams showed signs of on-chain money laundering.
Source: https://www.dlnews.com/articles/regulation/hong-kong-crime-ring-used-deepfakes-to-steal-millions
Archive: https://archive.fo/AtD6a
-
Coinbase says hackers bribed staff to steal customer data and are demanding $20 million ransom
May 15 2025 | Tanaya Macheel
Coinbase on Thursday reported that cybercriminals bribed overseas support agents to steal customer data to use in social engineering attacks. The incident may cost Coinbase up to $400 million to fix, the company estimated.
The crypto exchange operator received an email on May 11 from someone claiming they obtained information about certain Coinbase customer accounts as well as other internal Coinbase documentation, including materials relating to customer service and account management systems, Coinbase reported in a Securities and Exchange Commission filing.
The company’s shares were down more than 6% in morning trading.
The email demanded money in exchange for not publicly disclosing the information, but Coinbase says it has not paid the demand and is cooperating with law enforcement on the investigation of the incident.
Although passwords and private keys were not compromised, affected data included sensitive data such as names, addresses, phone numbers and emails; masked bank account numbers and identifiers as well as the last four digits of Social Security numbers; government ID images and account balances, the company said.
“Cyber criminals bribed and recruited a group of rogue overseas support agents to steal Coinbase customer data to facilitate social engineering attacks,” the company said in a blog post. “These insiders abused their access to customer support systems to steal the account data for a small subset of customers. No passwords, private keys, or funds were exposed and Coinbase Prime accounts are untouched. We will reimburse customers who were tricked into sending funds to the attacker.”
Coinbase had detected the breach independently in previous months, per the filing. It immediately terminated the employees involved, warned customers whose information may have been accessed and enhanced its fraud monitoring protections.
The threat actor paid overseas contractors and employees in support rolls to obtain the information, it said.
“We’re cooperating closely with law enforcement to pursue the harshest penalties possible and will not pay the $20 million ransom demand we received,” the company said in the blog. “Instead we are establishing a $20 million reward fund for information leading to the arrest and conviction of the criminals responsible for this attack.”
Coinbase operates the largest crypto exchange in the U.S. In the past week it announced an acquisition that is expected to help it expand its global reach and gained entry to the benchmark S&P 500 stock index, which will take effect next week. On the earnings call last week, CEO Brian Armstrong discussed his ambition to make Coinbase “the No. 1 financial services app in the world” in the next five to 10 years.
Source: https://www.cnbc.com/2025/05/15/coinbase-says-hackers-bribed-staff-to-steal-customer-data-and-are-demanding-20-million-ransom.html
Archive: https://archive.fo/YGc4U
-
The 16-billion-record data breach that no one’s ever heard of
19 June 2025 | Vilius Petkauskas, Deputy Editor
Several collections of login credentials reveal one of the largest data breaches in history, totaling a humongous 16 billion exposed login credentials. The data most likely originates from various infostealers.
Unnecessarily compiling sensitive information can be as damaging as actively trying to steal it. For example, the Cybernews research team discovered a plethora of supermassive datasets, housing billions upon billions of login credentials. From social media and corporate platforms to VPNs and developer portals, no stone was left unturned.
Our team has been closely monitoring the web since the beginning of the year. So far, they’ve discovered 30 exposed datasets containing from tens of millions to over 3.5 billion records each. In total, the researchers uncovered an unimaginable 16 billion records.
None of the exposed datasets were reported previously, bar one: in late May, Wired magazine reported a security researcher discovering a “mysterious database” with 184 million records. It barely scratches the top 20 of what the team discovered. Most worryingly, researchers claim new massive datasets emerge every few weeks, signaling how prevalent infostealer malware truly is.
“This is not just a leak – it’s a blueprint for mass exploitation. With over 16 billion login records exposed, cybercriminals now have unprecedented access to personal credentials that can be used for account takeover, identity theft, and highly targeted phishing,”
researchers said.
“This is not just a leak – it’s a blueprint for mass exploitation. With over 16 billion login records exposed, cybercriminals now have unprecedented access to personal credentials that can be used for account takeover, identity theft, and highly targeted phishing. What’s especially concerning is the structure and recency of these datasets – these aren’t just old breaches being recycled. This is fresh, weaponizable intelligence at scale,” researchers said.
The only silver lining here is that all of the datasets were exposed only briefly: long enough for researchers to uncover them, but not long enough to find who was controlling vast amounts of data. Most of the datasets were temporarily accessible through unsecured Elasticsearch or object storage instances.
What do the billions of exposed records contain?
Researchers claim that most of the data in the leaked datasets is a mix of details from stealer malware, credential stuffing sets, and repackaged leaks.
There was no way to effectively compare the data between different datasets, but it’s safe to say overlapping records are definitely present. In other words, it’s impossible to tell how many people or accounts were actually exposed.
However, the information that the team managed to gather revealed that most of the information followed a clear structure: URL, followed by login details and a password. Most modern infostealers – malicious software stealing sensitive information – collect data in exactly this way.
Billions of logins and passwords exposed in a massive data leak
Information in the leaked datasets opens the doors to pretty much any online service imaginable, from Apple, Facebook, and Google, to GitHub, Telegram, and various government services. It’s hard to miss something when 16 billion records are on the table.
According to the researchers, credential leaks at this scale are fuel for phishing campaigns, account takeovers, ransomware intrusions, and business email compromise (BEC) attacks.
“The inclusion of both old and recent infostealer logs – often with tokens, cookies, and metadata – makes this data particularly dangerous for organizations lacking multi-factor authentication or credential hygiene practices,” the team said.
What dataset exposed billions of credentials?
The datasets that the team uncovered differ widely. For example, the smallest, named after malicious software, had over 16 million records. Meanwhile, the largest one, most likely related to the Portuguese-speaking population, had over 3.5 billion records. On average, one dataset with exposed credentials had 550 million records.
Some of the datasets were named generically, such as “logins,” “credentials,” and similar terms, preventing the team from getting a better understanding of what’s inside. Others, however, hinted at the services they’re related to.
For example, one dataset with over 455 million records was named to indicate its origins in the Russian Federation. Another dataset, with over 60 million records, was named after Telegram, a cloud-based instant messaging platform.
“The inclusion of both old and recent infostealer logs – often with tokens, cookies, and metadata – makes this data particularly dangerous for organizations lacking multi-factor authentication or credential hygiene practices,”
the team said.
While naming is not the best way to deduce where the data comes from, it seems some of the information relates to cloud services, business-oriented data, and even locked files. Some dataset names likely point to a form of malware that was used to collect the data.
It is unclear who owns the leaked data. While it could be security researchers that compile data to check and monitor data leaks, it’s virtually guaranteed that some of the leaked datasets were owned by cybercriminals. Cybercriminals love massive datasets as aggregated collections allow them to scale up various types of attacks, such as identity theft, phishing schemes, and unauthorized access.
A success rate of less than a percent can open doors to millions of individuals, who can be tricked into revealing more sensitive details, such as financial accounts. Worryingly, since it's unclear who owns the exposed datasets, there’s little impact users can do to protect themselves.
However, basic cyber hygiene is essential. Strong and frequently changed passwords can be the difference between a safe account and stolen details. Users should also review their systems for infostealers, to avoid losing their data to attackers.
Billions of records exposed online
Major data leaks, with billions of exposed records, have become nearly ubiquitous. Last week, Cybernews wrote about what is likely the biggest data leak to ever hit China, billions of documents with financial data, WeChat and Alipay details, as well as other sensitive personal data.
Last summer, the largest password compilation with nearly ten billion unique passwords, RockYou2024, was leaked on a popular hacking forum. In 2021, a similar compilation with over 8 billion records was leaked online (https://cybernews.com/security/rockyou2021-alltime-largest-password-compilation-leaked/).
In early 2024, the Cybernews research team discovered what is likely still the largest data leak ever: the Mother of All Breaches (http://) (MOAB), with a mind-boggling 26 billion records.
Source: https://www.tomshardware.com/tech-industry/cyber-security/16-billion-accounts-exposed-in-one-of-the-largest-data-breaches-in-history-enormous-data-haul-holds-two-accounts-for-every-human-alive
Archive: https://archive.fo/YKZLD
-
Qantas says 6 million customer accounts accessed in cyber hack
02 Jul 2025
A cyber hacker broke into a database containing the personal information of millions of customers, Qantas said, in Australia's biggest breach in years and a setback for an airline rebuilding trust after a reputational crisis.
The hacker targeted a call centre and gained access to a third-party customer service platform containing six million names, email addresses, phone numbers, birth dates and frequent flyer numbers, Qantas said in a statement on Wednesday (Jul 2).
The airline did not specify the location of the call centre or customers whose information was compromised. It said it learnt of the breach after detecting unusual activity on the platform and acted immediately to contain it.
"We are continuing to investigate the proportion of the data that has been stolen, though we expect it will be significant," Qantas said, reporting no impact on operations or safety.
Last week, the US Federal Bureau of Investigation said cybercrime group Scattered Spider was targeting airlines and that Hawaiian Airlines and Canada's WestJet had already reported breaches. Qantas did not name any group.
"What makes this trend particularly alarming is its scale and coordination, with fresh reports that Qantas is the latest victim" of a hack, said Mark Thomas, Australia director of security services for cyber security firm Arctic Wolf.
Scattered Spider hackers are known to impersonate a company's tech staff to gain employee passwords and "it is plausible they are executing a similar playbook", Thomas said.
Charles Carmakal, chief technology officer of Alphabet-owned cybersecurity firm Mandiant, said it was too soon to say if Scattered Spider was responsible but "global airline organisations should be on high alert of social engineering attacks".
Qantas' share price was down 3.3 per cent by mid-session trade against a flat overall market.
UNWELCOME ATTENTION
The breach is Australia's most high-profile since those of telecommunications network operator Optus and health insurance leader Medibank in 2022 prompted cyber resilience laws including mandatory reporting of compliance and incidents.
It brings unwelcome attention to Qantas which is trying to win public trust after actions during and after the COVID-19 pandemic saw it plunge on airline and brand league tables.
Qantas was found to have illegally sacked thousands of ground workers during the 2020 border closure while collecting government stimulus payments. It also admitted selling thousands of tickets for already-cancelled flights.
The airline drew the ire of opposition politicians who said it lobbied the federal government in 2022 to refuse a request from Qatar Airways to sell more flights. Qantas denied pressuring the government which eventually refused the request - a move the consumer regulator said hurt price competition.
Qantas CEO Vanessa Hudson has improved the airline's public standing since taking office in 2023, reputation measures showed.
"We recognise the uncertainty this will cause," Hudson said of the data breach. "Our customers trust us with their personal information and we take that responsibility seriously."
Qantas said it notified the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and the Australian Federal Police.
ACSC declined to comment and AFP said only that it was aware of the incident. The OAIC was not immediately available for comment.
The airline said the hacker did not access frequent flyer accounts or customer passwords, PIN numbers or login details.
Charles Carmakal, chief technology officer of cybersecurity firm Mandiant Consulting, said the recent spate of cyberattacks on airlines has raised concerns over the impact on operations or safety.
"Fortunately, we haven't seen any real impact to the ability to fly and travel, but that's something that everybody's keeping a very close eye on right now," he told CNA's Asia Now.
Carmakal urged organisations to improve their cybersecurity defences, including the way they identify individuals for password resets.
"There are a number of technical things that the adversary does once they initially gain access to the organisation's IT environment, and a lot of the actions that the threat actor takes are actually incredibly noisy," he added.
"So there are actually a lot of opportunities for victim organisations to determine that they've been compromised and to kick the attackers out early on in the attack lifecycle, ideally before the threat actor has the ability to steal data from the organisation or disrupt business operations."
Source: Reuters/gr/ec/ca
Source: https://www.channelnewsasia.com/world/qantas-hack-data-breach-6-million-customers-5215121
Archive: https://archive.fo/4AGxp
Reference: About Scattered Spider, https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
Archive (Ref): https://archive.fo/MD6v7
-
Credit reports among personal data of 190,000 breached, put for sale on Dark Web; IT vendor fined
Jul 05, 2025 | Ian Cheng
SINGAPORE - IT vendor Ezynetic has been fined $17,500 for failing to protect its clients’ data, which resulted in more than 190,000 individuals’ personal data being stolen and put for sale on the Dark Web.
Ezynetic had failed to put in place reasonable security arrangements to protect the personal data in its possession or under its control, the Personal Data Protection Commission (PDPC) said on July 3 via a statement on its website.
At the time of the breach, which Ezynetic uncovered on June 24, 2024, the company was operating an IT system linked to the Moneylenders Credit Bureau platform operated by Credit Bureau Singapore.
Enzynetic’s affected clients – previously identified as moneylenders Ban King Credit, Credit 21, Lending Bee, Katong Credit, Credit Thirty3, GS Credit, 1AP Capital, Creditmaster, BST Credit, U Credit, Horison Credit and Credit Matters – would input personal data of their prospective loan applicants and borrowers into the money lending system.
This would allow them to verify the applicants’ and borrowers’ loan eligibility, generate MLCB credit reports and profit and loss reports, as well as track loans, instalments, collections and payments.
In a judgment, the PDPC said that investigations found that a threat actor had exploited a vulnerable web service application to gain access and control of Ezynetic’s system administrator account to access the money lending system. After gaining access to the money lending system, the threat actor obtained the personal data of the affected individuals.
The data stolen included a combination of the name, address, e-mail address, telephone number, NRIC number, date of birth and the financial information available in the MLCB credit reports of 190,589 individuals. These individuals were notified of the incident on July 1, 2024.
PDPC, which was informed of the incident on June 26, 2024, said its investigations revealed that Ezynetic had failed to disable or adequately secure the system administrator account, which is often targeted by malicious users.
The account password at the time of the incident, which was p@ssword1 or Password@1, was susceptible to brute force attacks, wherein hackers repeatedly try to gain access to systems by trying different passwords.
Ezynetic was also found not to have performed any periodic vulnerability assessment or penetration testing of its infrastructure, said the commission.
Following the incident, Ezynetic rebuilt its entire network and migrated to a cloud environment for its servers, and implemented enhanced security measures for the new network after consultations with the Cyber Security Agency of Singapore and the Ministry of Law.
PDPC’s decision
Under the Personal Data Protection Act (PDPA), which Ezynetic was found to have breached, organisations must protect personal data in its possession or under its control by making reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification or disposal, or similar risks.
Its failure to conduct a reasonable periodic security review also amounted to a breach of the PDPA; according to PDPC’s checklists to guard against common types of data breaches, organisations should, as a basic practice, periodically conduct web application vulnerability scanning and assessments.
PDPC said that a fine was appropriate, as Ezynetic was a Software-as-a-Service provider, which should possess the necessary technical expertise to implement reasonable cyber security measures to address the evolving threats.
According to Microsoft’s cloud computing platform Azure, Software-as-a-Service, or SaaS for short, is a cloud-based model where software applications are hosted by a service provider and accessed over the internet. SaaS providers manage the underlying infrastructure, security, maintenance, and updates.
Ezynetic was also directed by the PDPC to obtain Cyber Security Agency of Singapore’s Cyber Trustmark Certification for its new IT network and report to the Commission on its completion. Such marks certify good cyber-security practices, helping companies benchmark and show their preparedness to meet new risks,
On Dec 2, Ezynetic was informed of PDPC’s preliminary decision, and the following day, it sought a waiver or reduction to the fine. The firm cited its financial commitment to mitigating the breach, its losses as a result of ongoing disruptions caused by the breach, and that it had cooperated with all regulatory bodies throughout the investigation.
However, PDPC rejected this, as Ezynetic’s financial commitment was a “necessary part of its obligation to implement reasonable security arrangement” under its protection obligation, and that Ezynetic’s cooperativeness was already taken into account while determining the fine amount.
“Whilst (Ezynetic) did provide some invoices showing that it had incurred expenses to implement remedial measures, these did not show that (Ezynetic) is in such a dire financial situation that the imposition of a financial penalty of $17,500 would adversely impact its ability to continue its business,” said PDPC.
As a result, the PDPC said Ezynetic was required to pay the fine within 30 days of from the date of the relevant notice accompanying its decision. If it does not do so, interest will be accrued until the fine is paid in full.
The firm will also be required to obtain Cyber Trustmark Certification for its new IT network within 9 months from the date of PDPC’s decision, and has to report to the commission within 14 days of doing so.
Source: https://www.straitstimes.com/singapore/credit-reports-among-personal-data-of-190000-breached-put-for-sale-on-dark-web-it-vendor-fined
Archive: https://archive.fo/zIRrM
-
AI-generated child abuse web pages surge 400 per cent, alarming watchdog
Published Jul 10, 2025
LONDON – Reports of child sexual abuse imagery created using artificial intelligence tools have surged 400 per cent in the first half of 2025, according to new data from the Britain-based non-profit Internet Watch Foundation (IWF).
The organisation, which monitors child sexual abuse material online, recorded 210 web pages containing AI-generated material in the first six months of 2025, up from 42 in the same period the year before, according to a report published this week.
On those pages were 1,286 videos, up from just two in 2024.
The majority of this content was so realistic it had to be treated under British law as if it were actual footage, the IWF said.
Roughly 78 per cent of the videos – 1,006 in total – were classified as “Category A”, the most severe level, which can include depictions of rape, sexual torture and bestiality, the IWF said.
Most of the videos involved girls and, in some cases, used the likenesses of real children.
The growing prevalence of AI-generated child abuse material has alarmed law enforcement worldwide.
As generative AI tools become more accessible and sophisticated, the quality of the pictures and videos are improving, making it harder than ever to detect using traditional techniques.
While early videos were short and glitchy, the IWF now sees longer, more realistic productions featuring complex scenes and varied settings.
The authorities say the content is often used for harassment and extortion.
“Just as we saw with still images, AI videos of child sexual abuse have now reached the point they can be indistinguishable from genuine films,” said Mr Derek Ray-Hill, interim chief executive of the IWF.
“The children being depicted are often real and recognisable. The harm this material does is real, and the threat it poses threatens to escalate even further,” he said.
Taking action
Law enforcement agencies are starting to take action.
In a coordinated operation earlier in 2024, Europol arrested 25 individuals in connection with distributing such material.
More than 250 suspects were identified across 19 countries, Bloomberg reported.
The IWF called for Britain to develop a regulatory framework to ensure AI models have controls to block the production of this type of material.
In February, Britain became the first country to criminalise the creation and distribution of AI tools intended to generate child abuse content.
The law bans possession of AI models optimised to produce such material, as well as manuals that instruct offenders on how to do so.
In the United States, the National Centre for Missing and Exploited Children – an IWF counterpart – said it received more than 7,000 reports related to AI-generated child sexual abuse content in 2024.
While most commercial AI tools include safeguards against generating abusive content, some open source or custom models lack these protections, making them vulnerable to misuse. BLOOMBERG
Source: https://www.straitstimes.com/world/ai-generated-child-abuse-web-pages-surge-400-per-cent-alarming-watchdog
Archive: https://archive.fo/Wh4IQ
-
Personally identifiable information has been found in DataComp CommonPool, one of the largest open-source data sets used to train image generation models.
Eileen Guo | July 18, 2025
Millions of images of passports, credit cards, birth certificates, and other documents containing personally identifiable information are likely included in one of the biggest open-source AI training sets, new research has found.
Thousands of images—including identifiable faces—were found in a small subset of DataComp CommonPool, a major AI training set for image generation scraped from the web. Because the researchers audited just 0.1% of CommonPool’s data, they estimate that the real number of images containing personally identifiable information, including faces and identity documents, is in the hundreds of millions. The study that details the breach was published on arXiv earlier this month.
The bottom line, says William Agnew, a postdoctoral fellow in AI ethics at Carnegie Mellon University and one of the coauthors, is that “anything you put online can [be] and probably has been scraped.”
The researchers found thousands of instances of validated identity documents—including images of credit cards, driver’s licenses, passports, and birth certificates—as well as over 800 validated job application documents (including résumés and cover letters), which were confirmed through LinkedIn and other web searches as being associated with real people. (In many more cases, the researchers did not have time to validate the documents or were unable to because of issues like image clarity.)
A number of the résumés disclosed sensitive information including disability status, the results of background checks, birth dates and birthplaces of dependents, and race. When résumés were linked to people with online presences, researchers also found contact information, government identifiers, sociodemographic information, face photographs, home addresses, and the contact information of other people (like references).
Examples of identity-related documents found in CommonPool’s small-scale data set show a credit card, a Social Security number, and a driver’s license. For each sample, the type of URL site is shown at the top, the image in the middle, and the caption in quotes below. All personal information has been replaced, and text has been paraphrased to avoid direct quotations. Images have been redacted to show the presence of faces without identifying the individuals.
When it was released in 2023, DataComp CommonPool, with its 12.8 billion data samples, was the largest existing data set of publicly available image-text pairs, which are often used to train generative text-to-image models. While its curators said that CommonPool was intended for academic research, its license does not prohibit commercial use as well.
CommonPool was created as a follow-up to the LAION-5B data set, which was used to train models including Stable Diffusion and Midjourney. It draws on the same data source: web scraping done by the nonprofit Common Crawl between 2014 and 2022.
While commercial models often do not disclose what data sets they are trained on, the shared data sources of DataComp CommonPool and LAION-5B mean that the data sets are similar, and that the same personally identifiable information likely appears in LAION-5B, as well as in other downstream models trained on CommonPool data. CommonPool researchers did not respond to emailed questions.
And since DataComp CommonPool has been downloaded more than 2 million times over the past two years, it is likely that “there [are]many downstream models that are all trained on this exact data set,” says Rachel Hong, a PhD student in computer science at the University of Washington and the paper’s lead author. Those would duplicate similar privacy risks.
Good intentions are not enough
“You can assume that any large-scale web-scraped data always contains content that shouldn’t be there,” says Abeba Birhane, a cognitive scientist and tech ethicist who leads Trinity College Dublin’s AI Accountability Lab—whether it’s personally identifiable information (PII), child sexual abuse imagery, or hate speech (which Birhane’s own research into LAION-5B has found).
Indeed, the curators of DataComp CommonPool were themselves aware it was likely that PII would appear in the data set and did take some measures to preserve privacy, including automatically detecting and blurring faces. But in their limited data set, Hong’s team found and validated over 800 faces that the algorithm had missed, and they estimated that overall, the algorithm had missed 102 million faces in the entire data set. On the other hand, they did not apply filters that could have recognized known PII character strings, like emails or Social Security numbers.
“Filtering is extremely hard to do well,” says Agnew. “They would have had to make very significant advancements in PII detection and removal that they haven’t made public to be able to effectively filter this.”
Examples of résumé documents and personal disclosures found in CommonPool’s small-scale data set. For each sample, the type of URL site is shown at the top, the image in the middle, and the caption in quotes below. All personal information has been replaced, and text has been paraphrased to avoid direct quotations. Images have been redacted to show the presence of faces without identifying the individuals. Image courtesy of the researchers.
There are other privacy issues that the face blurring doesn’t address. While the blurring filter is automatically applied, it is optional and can be removed. Additionally, the captions that often accompany the photos, as well as the photos’ metadata, often contain even more personal information, such as names and exact locations.
Another privacy mitigation measure comes from Hugging Face, a platform that distributes training data sets and hosts CommonPool, which integrates with a tool that theoretically allows people to search for and remove their own information from a data set. But as the researchers note in their paper, this would require people to know that their data is there to start with. When asked for comment, Florent Daudens of Hugging Face said that “maximizing the privacy of data subjects across the AI ecosystem takes a multilayered approach, which includes but is not limited to the widget mentioned,” and that the platform is “working with our community of users to move the needle in a more privacy-grounded direction.”
In any case, just getting your data removed from one data set probably isn’t enough. “Even if someone finds out their data was used in a training data sets and … exercises their right to deletion, technically the law is unclear about what that means,” says Tiffany Li, an associate professor of law at the University of San Francisco School of Law. “If the organization only deletes data from the training data sets—but does not delete or retrain the already trained model—then the harm will nonetheless be done.”
The bottom line, says Agnew, is that “if you web-scrape, you’re going to have private data in there. Even if you filter, you’re still going to have private data in there, just because of the scale of this. And that’s something that we [machine-learning researchers], as a field, really need to grapple with.”
Reconsidering consent
CommonPool was built on web data scraped between 2014 and 2022, meaning that many of the images likely date to before 2020, when ChatGPT was released. So even if it’s theoretically possible that some people consented to having their information publicly available to anyone on the web, they could not have consented to having their data used to train large AI models that did not yet exist.
And with web scrapers often scraping data from each other, an image that was originally uploaded by the owner to one specific location would often find its way into other image repositories. “I might upload something onto the internet, and then … a year or so later, want to take it down, but then that [removal] doesn’t necessarily do anything anymore,” says Agnew.
The researchers also found numerous examples of children’s personal information, including depictions of birth certificates, passports, and health status, but in contexts suggesting that they had been shared for limited purposes.
“It really illuminates the original sin of AI systems built off public data—it’s extractive, misleading, and dangerous to people who have been using the internet with one framework of risk, never assuming it would all be hoovered up by a group trying to create an image generator,” says Ben Winters, the director of AI and privacy at the Consumer Federation of America.
Finding a policy that fits
Ultimately, the paper calls for the machine-learning community to rethink the common practice of indiscriminate web scraping and also lays out the possible violations of current privacy laws represented by the existence of PII in massive machine-learning data sets, as well as the limitations of those laws’ ability to protect privacy.
“We have the GDPR in Europe, we have the CCPA in California, but there’s still no federal data protection law in America, which also means that different Americans have different rights protections,” says Marietje Schaake, a Dutch lawmaker turned tech policy expert who currently serves as a fellow at Stanford’s Cyber Policy Center.
Besides, these privacy laws apply to companies that meet certain criteria for size and other characteristics. They do not necessarily apply to researchers like those who were responsible for creating and curating DataComp CommonPool.
And even state laws that do address privacy, like California’s consumer privacy act, have carve-outs for “publicly available” information. Machine-learning researchers have long operated on the principle that if it’s available on the internet, then it is public and no longer private information, but Hong, Agnew, and their colleagues hope that their research challenges this assumption.
“What we found is that ‘publicly available’ includes a lot of stuff that a lot of people might consider private—résumés, photos, credit card numbers, various IDs, news stories from when you were a child, your family blog. These are probably not things people want to just be used anywhere, for anything,” says Hong.
Hopefully, Schaake says, this research “will raise alarm bells and create change.”
Source: https://www.technologyreview.com/2025/07/18/1120466/a-major-ai-training-data-set-contains-millions-of-examples-of-personal-data
Archive: https://archive.fo/pW3R8
References
Hong, Rachel, Jevan Hutson, William Agnew, Imaad Huda, Tadayoshi Kohno, and Jamie Morgenstern. 2025. “A Common Pool of Privacy Problems: Legal and Technical Lessons from a Large-Scale Web-Scraped Machine Learning Dataset.” https://www.arxiv.org/abs/2506.17185
Gadre, S. Y., Ilharco, G., Fang, A., Hayase, J., Smyrnis, G., Nguyen, T., Marten, R., Wortsman, M., Ghosh, D., Zhang, J., Orgad, E., Entezari, R., Daras, G., Pratt, S., Ramanujan, V., Bitton, Y., Marathe, K., Mussmann, S., Vencu, R., Cherti, M., Krishna, R., Koh, P. W., Saukh, O., Ratner, A., Song, S., Hajishirzi, H., Farhadi, A., Beaumont, R., Oh, S., Dimakis, A., Jitsev, J., Carmon, Y., Shankar, V., & Schmidt, L. (2023). DataComp: In search of the next generation of multimodal datasets (arXiv preprint arXiv:2304.14108). https://arxiv.org/abs/2304.14108
-
147,000 customer records affected following data breach at Cycle & Carriage
Cycle & Carriage was alerted on Jul 14 to unauthorised access into its database containing customer information.
01 Aug 2025
SINGAPORE: A breach at Cycle & Carriage's database has affected about 147,000 records containing customer information, the car distributor said on Friday (Aug 1).
In response to CNA's queries, a spokesperson from Cycle & Carriage said that it was alerted on Jul 14 to "unauthorised access" into its customer relationship management system by a threat actor who downloaded some customer information.
"About 147,000 data records are affected. Most of the downloaded records have missing or partial information," added the spokesperson.
The affected data records may contain names and contact information - such as email addresses and phone numbers - with about 2 per cent of them containing National Registration Identity Card (NRIC) numbers and deposit amounts.
No banking or credit card information was divulged, the spokesperson said.
Cycle & Carriage is the local authorised dealer for car brands like Mercedes-Benz, Mitsubishi, Kia, Citroen and Peugeot.
"Once we became aware of the incident, we have taken measures to prevent further unauthorised access to the system," the spokesperson said.
"A thorough investigation was carried out and forensic experts were activated to look into the possible causes of this unauthorised access."
Apologising to affected customers, Cycle & Carriage said that the company has internal processes, protocols, and training in place to support data governance and cyber hygiene, but will continue to "review and refine these as needed" in light of the incident.
The firm has lodged a police report and notified the Personal Data Protection Commission (PDPC).
It has also begun to inform affected customers in batches from Wednesday.
In an email sent to a customer on Thursday, which CNA has seen, the firm referred to a "cybersecurity incident" and added that it was still investigating the full scope of the breach.
Customers were advised to be cautious of phishing activities or suspicious requests for personal information.
Responding to CNA's queries, PDPC said it is aware of the incident and is investigating the case.
On the matter of personal data protection, it added that members of the public who require information can refer to its website.
When asked about the incident, the Cyber Security Agency of Singapore (CSA) also pointed to its advisory, saying that organisations need to raise their defences against common data breach vectors.
This is to reduce the risk of a data breach and they should also implement adequate cybersecurity measures to minimise the impact on their customers.
Source: https://www.channelnewsasia.com/singapore/cycle-carriage-data-breach-cybersecurity-incident-customer-records-affected-5271746
Archive: https://archive.fo/5BZg0
-
Millions Allegedly Affected in Allianz Insurance Breach
Have I Been Pwned claims that the compromised data includes physical addresses, dates of birth, phone numbers, and more, for life insurance customers.
19 August 2025, Kristina Beek
The Allianz Life data breach, which the company confirmed in July, led to hackers allegedly stealing the personal data of around 1.1 million customers.
The insurance giant has 1.4 million customers, and its parent company, Allianz, has more than 125 million.
The affected number of individuals is according to data breach notification website Have I Been Pwned, an online resource that allows users to check when their email address has been included in a data breach. The site also added that the type of compromised data includes dates of birth, genders, phone numbers, email addresses, names, and physical addresses.
The breach, first reported by TechCrunch, occurred on July 16 after a threat actor was able to gain access to a third-party, cloud-based customer relationship management (CRM) system used by the insurance company before stealing the personal information of the company's customers, employees, and other professionals.
The stolen data was hosted on a database by Salesforce, a cloud giant used by a host of other companies that have found themselves in similarly compromising positions. These companies include Qantas, Google, Pandora, and more.
Allianz Life originally disclosed the breach in a filing with Maine's attorney general, but only provided a placeholder for its data breach notification letter to affected Maine residents and has yet to update it since. The filing also does not list the total number of people affected in the breach.
The company said at the time that it intended to begin notifying affected individuals of the data breach around Aug. 1 as per its filing and confirmed that it will be offering identity theft protection services for two years through Kroll.
Source: https://www.darkreading.com/cyberattacks-data-breaches/millions-allianz-insurance-breach
Archive: https://archive.fo/uvURq
-
Hackers leak Qantas data containing 5 million customer records after ransom deadline passes
Cait Kelly | 11 Oct 2025
Hackers say they have leaked the personal records of 5 million Qantas customers on the dark web, after a ransom deadline set by the cybercriminals passed.
The airline is one of more than 40 firms globally caught up in the hack, reported to contain up to 1bn customer records.
The hacker collective Scattered Lapsus$ Hunters released an extortion note on a data leaks site on the dark web last week, demanding payment in return for preventing the stolen data from being shared.
The Qantas data, which was stolen from a Salesforce database in a major cyber-attack in June, included customers’ email addresses, phone numbers, birth dates and frequent flyer numbers. It did not contain credit card details, financial information or passport details.
On Saturday the group marked the data as “leaked”, writing: “Don’t be the next headline, should have paid the ransom.”
Jeremy Kirk, analyst at Intel 471, a cyber threat intelligence company, said 44 companies had been included in the leak including Gap, Vietnam Airlines, Toyota, Disney, McDonald’s, Ikea, and Adidas.
He said the hacker group was well known and operated out of countries such as the US, UK and Australia.
“This particular group is not a new threat; they’ve been around for some time,” Kirk said. “But they’re very skilled in knowing how companies have connected different systems together.”
A Qantas spokesperson previously told Guardian Australia its priorities were “continued vigilance and providing ongoing support for our customers” after the June attack.
“We continue to offer a 24/7 support line and specialist identity protection advice to affected customers,” the spokesperson said.
A Salesforce spokesperson told Guardian Australia the company “will not engage, negotiate with, or pay any extortion demand”.
There was no indication the Salesforce platform had been compromised, the company said via a statement.
“We are aware of recent extortion attempts by threat actors, which we have investigated in partnership with external experts and authorities. Our findings indicate these attempts relate to past or unsubstantiated incidents, and we remain engaged with affected customers to provide support,” it said.
It is understood the global data was stolen between April 2024 and September 2025 and includes personal and contact information of the companies’ customers and employees, including dates of birth, purchase histories and passport numbers.
“No company wants to see hundreds of thousands, or millions, of records of their customers just on the internet,” Kirk said. “That’s awful. It’s awful for the companies. It’s awful for the people affected.”
In July, Qantas obtained an ongoing injunction from the NSW supreme court ensuring protections to prevent the stolen data being accessed, viewed, released, used, transmitted or published by anyone, including third parties.
Kirk said there was no financial data but criminals could potentially use leaked personal information to open credit cards. He said people should monitor their accounts for suspicious activity, and beware of scam emails that are personalised.
“These days, a lot of threat groups are now generating personalised phishing emails,” he said. “They’re getting better and better at this – and these types of breaches help sort of fuel that economy, that underground fraudster economy.”
Qantas said on Sunday: “With the help of specialist cyber security experts, we are investigating what data was part of the release.”
“We have also put in place additional security measures, increased training across our teams and strengthened system monitoring and detection since the [mid-year] incident occurred,” a spokesperson said.
Source: https://www.theguardian.com/business/2025/oct/11/hackers-leak-qantas-data-containing-5-million-customer-records-after-ransom-deadline-passes
Archive: https://archive.fo/qLk6L
Reference 1: https://unit42.paloaltonetworks.com/scattered-lapsus-hunters
Reference 2: https://krebsonsecurity.com/2025/10/shinyhunters-wage-broad-corporate-extortion-spree
-
Gmail Passwords Confirmed In 183 Million Account Breach Database
By Davey Winder, | Oct 26, 2025
Earlier this year, I reported on a data leak that included a whopping 184,162,718 passwords and logins impacting the likes of Apple, Facebook and Instagram users. That data leak was disclosed on May 22, and now, in a rather spooky seeming coincidence, news of 183 million passwords and login credentials from an April 2025 breach has emerged. Adding the details of website URLs, email addresses and passwords to the Have I Been Pwned database, owner Troy Hunt said the data consisted of both “stealer logs and credential stuffing lists” including confirmed Gmail login credentials. Here’s what we know and what you need to do.
Have I Been Pwned is something a staple resource for anyone who is genuinely concerned about their account login security. Why so? Because it’s the go-to for discovering when any of your email addresses, accounts, or passwords are found in data leaks, dark web password breach lists, and the like. Best of all, it’s entirely free to use. When a new entry appears with the number of affected accounts being 183 million, and the compromised data listed as email addresses and passwords, more than a few heads will pop up above the parapets and pay attention. Mine certainly did following the October 21 addition.
Having done some digging for further information, I was drawn to a lengthy analysis by Hunt himself, which looked inside the Synthient threat data provided to HIBP. Benjamin Brundage from Synthient revealed in a blog posting that the data came from the results of monitoring infostealer platforms across the course of close to a year.
The total amount of information sent to HIBP comprised 3.5 terabytes of data, 23 billion rows of it in all. The output of the stealer logs concerned, Hunt said, consisted primarily of three things: website address, email address and password. “Someone logging into Gmail,” Hunt wrote, “ends up with their email address and password captured against gmail.com, hence the three parts.” Of course, there’s a lot of recycling of credentials that goes on in the cybercriminal world, so Hunt initially wanted to check the freshness of the database he had in his hands.
An analysis of a 94k sample revealed 92% were not, in fact, new. “Most of what has been seen before was in the ALIEN TXTBASE stealer logs,” Hunt confirmed. However, the math wizards out there will have noted that this steal leaves 8% that is new and fresh, or more than 14 million credentials if you extrapolate it. Actually, the final tally was 16.4 million previously unseen addresses in any data breach, not just stealer logs.
HIBP also checks to see if the credentials are genuine by sending out some of the details to people on the subscriber base who are impacted. “One of the respondents was already concerned there could be something wrong with his Gmail account,” Hunt said, and that person was able to validate that the entry was “an accurate password on my Gmail account.”
Of course, it is not just Gmail users who will be impacted by this leak, so I would advise everyone to go and check at HIBP to see if their account credentials might be included. If so, then you will need to change those passwords with immediate effect. If you reuse your passwords, and please don’t do that, it will mean changing them at every single account where they are repurposed. I have approached Google for a statement.
Source: https://www.forbes.com/sites/daveywinder/2025/10/26/gmail-passwords-confirmed-as-part-of-183-million-account-data-breach (https://www.forbes.com/sites/daveywinder/2025/10/26/gmail-passwords-confirmed-as-part-of-183-million-account-data-breach)
Archive: https://archive.fo/OBQDy
(https://archive.fo/OBQDy)
Reference: https://www.forbes.com/sites/daveywinder/2025/05/23/184162718-passwords-and-logins-leaked---apple-facebook-snapchat (https://www.forbes.com/sites/daveywinder/2025/05/23/184162718-passwords-and-logins-leaked---apple-facebook-snapchat)
-
Mass hacking of IP cameras leave Koreans feeling vulnerable in homes, businesses
17 Dec. 2025 | 기자 사진 MICHAEL LEE
When Kim Ha-eun, a mother of two, installed internet protocol (IP) cameras in her home after giving birth for the first time five years ago, she hoped the devices would ease the need for her and her husband to remain physically present around the clock to watch over their children.
“Being able to see what was happening inside the house in real time was important for us if we had to step outside, even for something as simple as a grocery run,” she said.
But news that hackers recently breached approximately 120,000 IP cameras across Korea — often found inside private homes like Kim’s — has left her and many others seething, prompting the government to take action.
As shocking the scale of the intrusions was the alleged motive behind them. Videos captured by the hacked cameras were allegedly sold to an overseas pornography website, exposing some of the most intimate moments of unsuspecting victims to anonymous viewers abroad.
Only 1,193 videos from the hacked cameras have been uncovered so far on overseas websites, raising concerns that many more remain undiscovered.
In response, an interagency task force comprising officials from the Ministry of Science and ICT, the Personal Information Protection Commission and the National Police Agency announced on Dec. 7 that it would pursue a multilayered reform package. The measures aim to shift responsibility beyond individuals and camera manufacturers to include business users and telecommunications providers.
Yet as policymakers scramble to overhaul regulations and reinforce technical safeguards, interviews with everyday users of IP cameras reveal a gap between how these devices are used and understood and the level of risk they actually pose.
Weaponizing tools of reassurance
For Kim, the five IP cameras in her home were initially meant to provide peace of mind. The cameras — one in each child’s bedroom, as well as units in the living room and kitchen — run continuously, providing a live feed accessible through a mobile app.
Privacy and data security, however, were not central considerations in her decision. Kim’s husband installed the system himself using online instructions, setting a password for the cameras that the couple has not changed since. Until learning of the hacking scandal during the interview, Kim had not even seen the news.
Her experience reflects a broader structural problem.
According to Kim Ji-yoon, an assistant professor of computer science and engineering at Gyeongsang National University, Korea maintains “relatively strict regulations,” such as the Personal Information Protection Act, governing footage recorded by closed-circuit television (CCTV) systems. However, he said, “there are limitations in applying these regulations to devices such as home-use or privately installed IP cameras.” As a result, devices designed for intimate domestic spaces often fall through regulatory cracks.
Authorities later confirmed that many hacked cameras were protected by simple or widely known passwords that were rarely changed. A government survey found that only 59 percent of installation companies consistently carried out mandatory security measures, such as changing default password settings.
Upon learning of the incident, Kim Ha-eun said she would change her password immediately. But her frustration was directed less at herself than at the companies behind the technology.
“These camera manufacturers need to do a better job,” she said. “Their devices are basically broadcasting our private lives if they’re not secured.”
Illusion of low risk
Marshall Brown, a 41-year-old American working at an intergovernmental organization in Seoul, installed a single IP camera in his living room before traveling abroad in 2022, mainly to check on his cats. The camera featured a remote panning function that offered a wide field of view.
Like Kim, Brown never changed the camera’s password. He said the threat of IP camera hacking felt “abstract and distant.”
He routinely unplugged the camera after returning from trips — not out of privacy concerns, but because the need to monitor his cats remotely disappeared. Eventually, he removed the device altogether when friends began staying long-term in his apartment during his absences.
Experts say this sense of detachment is common. Prof. Kim noted that while surveillance equipment used in public spaces is increasingly subject to strict security certification, IP devices “are somewhat excluded from this trend.”
The diversity of manufacturers and products, he added, makes “consistent standards difficult to apply,” reinforcing a consumer perception that such devices carry minimal risk.
Brown likened his reaction to the camera scandal to his response to previous large-scale data breaches in Korea, including those involving SK Telecom and Coupang.
“I still don’t know how something like this affects me in the long run,” he said. “If fear of these situations became widespread, it would feel almost dystopian.”
Human harm
What sets the current case apart — and prompted the government’s unusually forceful response — is the nature of the harm involved.
Police believe one suspect hacked 63,000 IP cameras, producing 545 videos that he sold to an overseas website for 35 million won ($24,000) in cryptocurrency. Another suspect allegedly hacked 70,000 devices, creating 648 videos that he later sold to the same website for 18 million won.
The two individuals, whom police say are not accomplices, sourced most of their footage from IP cameras installed in ordinary homes, gynecology offices, breastfeeding rooms, massage parlors, Pilates studios and waxing salons. They often accessed the same compromised devices repeatedly. The videos accounted for 62 percent of all content on the website, which includes a separate “Korean” category.
Two additional suspects are accused of hacking 15,000 cameras and 136 devices, respectively, to collect footage for private possession.
Unlike leaked phone numbers or delivery addresses, compromised IP camera footage can expose faces, bodies, children and private spaces. Prof. Kim emphasized that hacked cameras can reveal “an individual’s movements, daily life and relationships,” making the potential for privacy violations “extremely high.”
Kim Ha-eun echoed that concern, saying penalties “should be really harsh,” given that a hacked camera feed “lays bare our entire daily existence.”
Prof. Kim added that when information involving “an unspecified large number of victims is leaked and distributed,” recovery becomes exceptionally difficult. In such cases, he said, victim protection must extend beyond punishment to include deletion and blocking of content, dispute resolution, mediation and litigation.
The government’s follow-up measures reflect that approach. High-risk businesses such as bathhouses, accommodation facilities and medical institutions have been reminded of their legal obligations, while joint inspections of hospitals and massage clinics have begun. Lawmakers are also pursuing legislation to mandate the use of security-certified IP cameras in sensitive facilities, along with design-stage requirements for complex passwords.
Victim support measures include faster takedown of illegal videos, expanded legal and psychological assistance, and intensified investigations into the distribution of content recorded without consent.
Yet Prof. Kim argues that regulation should go further upstream. He said it is necessary to establish “minimum security standards with enforceability” for consumer devices and to “clearly define, at an institutional level, the responsibility of device suppliers to guarantee security.”
He also advised users to avoid installing cameras in locations that could capture “personally identifiable information, private spaces or parts of the body.”
Beyond passwords: Rethinking responsibility
Much of the public discussion has focused on weak passwords. But Prof. Kim said a single failure cannot explain the mass hacking.
“Rather than one cause,” he said, “this should be understood as multiple factors acting together,” including the use of unauthenticated devices, technical weaknesses in how footage is stored and transmitted, and lapses in security updates.
He cautioned against framing the issue solely as user negligence, calling instead for institutional guidelines that limit IP camera use to the “minimum necessary authority, purpose and scope.”
Brown, drawing on phishing simulations at his workplace, questioned whether frequent password changes alone offer meaningful protection.
“The idea that changing your password all the time will protect your data is antiquated,” he said. “You also have to be aware of what you’re clicking and who you’re communicating with.”
This view aligns with the government’s longer-term plans, which include tailored education for installation companies, businesses and digitally vulnerable populations, as well as broader public security guidelines.
Erosion of trust
As IP cameras become increasingly common in homes, workplaces and public facilities, the scandal has raised more profound questions about surveillance, trust and dependence on networked technologies.
Prof. Kim warned that while AI-based video analysis offers convenience, technologies designed to “identify, track and classify” individuals risk tipping the balance too far. Through “appropriate laws, regulations and operational practices,” he said, society must renegotiate the trade-off between convenience and privacy.
He also predicted that demand for low-cost or noncertified products would decline alongside consumer trust. At the same time, he said, the scandal could increase demand for security-certified devices, creating incentives for companies to invest more heavily in security.
For Kim Ha-eun, the reckoning is already personal.
“I’m thinking about getting rid of the camera system as the children grow older,” she said. “They’ll become more independent, and we won’t need to watch them as closely through cameras anymore.”
Source: https://koreajoongangdaily.joins.com/news/2025-12-17/national/socialAffairs/Mass-hacking-of-IP-cameras-leave-Koreans-feeling-vulnerable-in-homes-businesses/2478843
Archive: https://archive.fo/Wh7zo
-
Instagram Data From 2024 Leak Reappears, Exposing 17.5M Accounts
11 Jan 2026
A 2024 Instagram API flaw has resurfaced on the dark web, exposing data from 17.5 million accounts. The data, including usernames, emails, phone numbers, and addresses, was scraped in late 2024 and reappeared in early 2026. Malwarebytes warned users to watch for phishing attempts using Instagram’s system. Meta has not yet commented. On-chain news shows rising concerns over data security amid inflation data volatility.
Seventeen and a half million Instagram accounts just got an unwanted encore appearance on the dark web, thanks to an old API flaw that’s back to cause fresh headaches.
According to a security notice from cybersecurity firm Malwarebytes, data tied to roughly 17.5 million Instagram users is circulating freely on Breachforums after resurfacing in early January 2026, courtesy of a threat actor using the handle “Solonik.” The twist: this wasn’t a brand-new breach. The data reportedly traces back to a misconfigured Instagram API from late 2024 that allowed large-scale scraping of user profiles, quietly collecting structured information before disappearing—until now.
“Beware of emails and messages that claim to come from Instagram, as they could be sent by malicious hackers trying to trick you into handing over your password,” Malwarebytes explained in a distributed alert email. “If you’re concerned, sign into your Instagram account and reset your password to a new, strong, unique password.”
(https://ip5.us/download/forum/20260111%20Instagram%20Data%20From%202024%20Leak%20Reappears,%20Exposing%2017.5M%20Accounts.jpg)
The freshly reposted dataset is said to include usernames, emails, phone numbers, physical addresses, and account metadata, making it catnip for scammers and identity thieves. As of Jan. 10, Meta had not issued a public statement, while reports of unsolicited password reset emails has spiked. Old data, new damage—because the internet never forgets, and neither do cybercriminals. What makes this leak especially irritating is how it’s being used.
Attackers aren’t blasting obvious scam emails; instead, they’re triggering legitimate Instagram password reset messages from the platform’s real security domain, banking on confusion to do the dirty work. With enough personal details in hand, bad actors can escalate from phishing to even SIM swapping and targeted fraud, particularly for users who recycle passwords across sites.
Malwarebytes flagged the breach during routine dark web monitoring, showcasing how recycled data can still fuel very current attacks. While the exposure appears global—with confirmed impacts in parts of Europe—the risk profile is universal: account takeovers, financial fraud, and a fresh reminder that scraped data ages like milk, not wine. The fix is unglamorous but effective: stronger passwords, two-factor authentication, and a healthy suspicion of any “urgent” email demanding clicks.
FAQ 🔒
Q: Was this a new Instagram hack?
A: No, the data reportedly originates from a 2024 API scraping issue and only resurfaced publicly in January 2026.
Q: What information was exposed?
A: Usernames, emails, phone numbers, partial or full addresses, and account metadata were included.
Q: Why are users getting real password reset emails?
A: Attackers are abusing Instagram’s legitimate reset system to make phishing attempts seem authentic.
Q: What should affected users do now?
A: Change passwords immediately, enable two-factor authentication, and monitor accounts for suspicious activity.
Source: https://news.bitcoin.com/instagram-data-from-2024-leak-reappears-exposing-17-5m-accounts
Archive: https://archive.fo/98fs1
-
Date: Mon, 23 Feb 2026 12:19:05
From: no_reply@thedecard.com
To: XXX
Subject: Important Update Regarding Your DeCard Account
Dear XXX,
We are writing to inform you of a recent security incident involving unauthorised access to certain customer data.
On 19 February 2026, our monitoring systems detected unusual activity. Our engineering team immediately investigated and identified and addressed a security issue affecting limited user data. The issue was resolved within 30 minutes of detection and is no longer present.
Your DeCard account remains fully operational, and your balance remains secure. At this time, there is no evidence of unauthorised transactions resulting from this incident. Based on our investigation, the following information associated with your account may have been accessed:
Your identification document information (NRIC/ID number: ending XXXX or passport number ending XXXX, submitted for verification), including your name, date of birth, address, and contact details
Your 16 digit card number (but not CVV number)
There is currently no indication that passwords, card PINs, payment authentication credentials, or card details required to complete transactions, such as the card security code (CVV), were accessed.
We are closely monitoring affected accounts for unusual activity. If you would prefer additional peace of mind, we are offering complimentary physical card replacement. Please contact our Customer Support team via Telegram at @TheDeHelpBot or our dedicated hotline at +65 6571 0128 and we will assist you.
As an added precaution, we recommend that you remain vigilant against phishing attempts or suspicious messages requesting personal information. DeCard will never ask you for your password, PIN, or one-time password via email, phone, or messaging platforms.
We have strengthened our security controls and are conducting a comprehensive review of the incident. The security and privacy of our customers are of utmost importance to us, and we are committed to taking all necessary steps to minimise the risk of a similar incident occurring in the future. We have also informed the relevant regulatory authorities and are cooperating fully with them.
We sincerely apologise for the concern this may cause and appreciate your continued trust in DeCard.
Thank you,
The DeCard Team
-
From: "Billing Enquiry @ Abecha" <BillingEnquiry@abecha.com>
Subject: Notification of Cybersecurity Incident
Date: Tue, 3 Sep 2024 07:23:15
Dear Sir / Madam,
1. We are writing to inform you of a data security incident involving our customer database.
2. On 13 August 2024, we discovered that we were the victim of a ransomware attack, which infected our servers and customer database by encrypting and rendering inaccessible the following personal data:
(a) First and last names; and
(b) GIRO bank account numbers.
3. We acted swiftly to contain the situation by shutting down the affected servers, as well as engaging professional data protection and cybersecurity experts to investigate the incident and advise on the IT security enhancement initiatives that we should undertake. These investigations are still ongoing. We have also made a police report, as well as notified the Personal Data Protection Commission of Singapore. Please be assured that we are treating this matter with utmost seriousness.
4. At the time of this notification, we do not have any evidence to suggest that the customer databases were extracted and/or used for malicious purposes. We will inform you if our ongoing investigations reveal otherwise. Nevertheless, we recommend that you monitor your GIRO account for any unauthorised transactions, set limits on any GIRO deductions if necessary, and report any suspicious transactions or unusual activity.
5. We regret that this ransomware attack has taken place. We place great emphasis on protecting the personal data that we handle and are committed to being transparent about this incident. Every effort has been, and will be, taken to complete our internal investigations, stem the data breach and prevent recurrences. We are also proactively enhancing our cybersecurity infrastructure.
6. If you have further queries or require more information please contact our customer care team at BillingEnquiry@abecha.com
Best regards,
Abecha Customer Care Team
26 Feb 2026: Breach of the Protection Obligation by SESAMi (Singapore) Pte Ltd and Abecha Pte Ltd
A financial penalty of $8,750 was imposed and directions were issued to SESAMi (Singapore) Pte Ltd for failing to put in place reasonable security arrangements to protect the personal data in its possession or under its control. PDPC also issued directions to SESAMi (Singapore) Pte Ltd's subsidiary, Abecha Pte Ltd, for similar reasons.
Source: https://www.pdpc.gov.sg/all-commissions-decisions/2026/02/breach-of-the-protection-obligation-by-sesami-singapore-pte-ltd-and-abecha-pte-ltd
Archive: https://archive.fo/mMj6o
PDF: https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/commissions-decisions/gd_sesami-singapore-pte-ltd_abecha-pte-ltd_29122025.pdf
-
An actual phishing email from Redmart data breach 😢
------------ snip
From: <redmart@trXXXXXX.com>To: <redmart@trXXXXXX.com>
Subject: Important information about your account password.
Date: Mon, 6 Apr 2026 21:25:57 +0300
X-Mailer: Microsoft Outlook 16.0 Hello,
We were unable to reset the password for your trXXXXXX.com account because there were too many unsuccessful attempts to answer your security questions.
To protect the security of your account, you will not be able to reset your password for the next eight hours.
If you didn't make this change or believe an unauthorized person has accessed your account,
go to support.tr (https://simoguba.z33.web.core.windows.net/)XXXXXX.com (https://simoguba.z33.web.core.windows.net/) to reset your password as soon as possible.
Then sign in (https://simoguba.z33.web.core.windows.net/) at trXXXXXX.com to review and update your security settings.
trXXXXXX.com Support.
------------ snip
References- R1. Phishing website from the above (be careful): https://simoguba.z33.web.core.windows.net (https://simoguba.z33.web.core.windows.net)
- R2. Dec 2022, RedMart fined S$72,000 for data breach resulting in online sale of customer data, https://www.channelnewsasia.com/singapore/redmart-fined-s72000-data-breach-lazada-3159496 (https://www.channelnewsasia.com/singapore/redmart-fined-s72000-data-breach-lazada-3159496)
- R3. Dec 2022, Breach of the Protection Obligation by RedMart, https://www.pdpc.gov.sg/all-commissions-decisions/2022/11/breach-of-the-protection-obligation-by-redmart (https://www.pdpc.gov.sg/all-commissions-decisions/2022/11/breach-of-the-protection-obligation-by-redmart)
-
Instructure confirms data breach, ShinyHunters claims attack
By Lawrence Abrams | May 3, 2026
Educational tech giant Instructure has confirmed that data was stolen in a cyberattack, with the ShinyHunters extortion gang claiming responsibility.
Instructure is a U.S.-based education technology company best known for developing Canvas, a widely used learning management system that helps schools, universities, and organizations manage coursework, assignments, and online learning.
On Friday, Instructure disclosed that it suffered a cybersecurity incident and is working with third-party cybersecurity experts and law enforcement to investigate it.
On Saturday, the company issued an update stating that the personal information of users was exposed in the breach.
"While we continue actively investigating, thus far, indications are that the information involved consists of certain identifying information of users at affected institutions, such as names, email addresses, and student ID numbers, as well as messages among users," reads the updated statement.
"At this time, we have found no evidence that passwords, dates of birth, government identifiers, or financial information were involved. If that changes, we will notify any impacted institutions."
As part of the response, Instructure has deployed patches, increased monitoring, and rotated application keys as a precautionary step.
Customers are required to re-authorize access to Instructure's API for new application keys to be issued.
While Instructure has not responded to BleepingComputer's questions about when the breach occurred and whether they were being extorted, the ShinyHunters extortion gang has now listed the company on its data leak site.
"Nearly 9,000 schools worldwide affected. 275 million individuals data ranging from students, teachers, and other staff containing PII," reads the data leak site.
"Several billions of private messages among students and teachers and students and other students involved, containing personal conversations and other PII. Your Salesforce instance was also breached and a lot more other data is involved."
ShinyHunters claimed that the data was stolen from Instructure via a vulnerability in their systems, which has now been patched.
This data allegedly consists of over 240 million records tied to students, teachers, and staff. The threat actor says the data contains students' names, email addresses, enrolled courses, and private messages to teachers.
Data shared by the threat actor indicates that the alleged dataset spans almost 15,000 institutions hosted across multiple geographic regions, including North America, Europe, and Asia-Pacific.
BleepingComputer has not been able to independently confirm which schools or how many individuals were impacted and has contacted Instructure with additional questions about the threat actor's claims.
Source: https://www.bleepingcomputer.com/news/security/instructure-confirms-data-breach-shinyhunters-claims-attack (https://www.bleepingcomputer.com/news/security/instructure-confirms-data-breach-shinyhunters-claims-attack)
Archive: https://archive.fo/SyJRj (https://archive.fo/SyJRj)
Reference 1: "Vishing for Access: Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft", https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft (https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft)
Archive (R1): https://archive.fo/1OnOd (https://archive.fo/1OnOd)
Reference 2: https://en.wikipedia.org/wiki/ShinyHunters (https://en.wikipedia.org/wiki/ShinyHunters)
Students’ names, IDs ‘may have been exposed’ in Canvas cyberattack but passwords, marks safe: NUS
BNB Diviyadhaarshini | May 09, 2026
SINGAPORE – The National University of Singapore (NUS) has informed its students that while some information such as their names and e-mail addresses may have been exposed in a global data breach, their confidential information such as passwords has not been compromised.
NUS was one of many local and international institutions affected by the massive cyberattack on May 7. The attack, claimed by ShinyHunters, a cyberextortion group, saw access to the Canvas learning platform blocked, reported AFP.
In a May 8 e-mail to students about what it called the “data security incident” involving the Canvas “learning management system” seen by The Straits Times, NUS said it was working with Instructure to “thoroughly investigate and assess the situation”.
Instructure is the US-based vendor that owns and runs Canvas.
Attributing the information to Instructure, NUS added that the information “that may have been exposed is limited to: name, e-mail address, student ID”.
“We would like to assure you that your NUS log-in credentials such as passwords have not been compromised, and all student marks remain secure,” it added.
In a reply to queries from The Straits Times on May 9, NUS said: “Operational impact is assessed to be minimal as the current semester has concluded and all examinations have ended.
“We have in place back-up and business continuity processes to ensure downstream activities such as marking and grading proceed unaffected.”
The Singapore University of Social Sciences (SUSS) also told ST on May 9 that “access to Canvas has been restored and there has been no significant disruption to SUSS’ overall operations”.
As an additional precaution, both NUS and SUSS advised students to stay alert and vigilant.
Students were urged not to reply to suspicious e-mails, messages or phone calls, refrain from sharing personal information or log-in details, and to change passwords and enable multi-factor authentication where available.
SUSS added that it was reviewing relevant access controls and security configurations.
The Singapore Institute of Management, the Singapore College of Insurance, the Institute of Singapore Chartered Accountants, NTUC LearningHub, The Learning Lab, KLC International Institute and The Learning Space SG were among the other local institutions affected by the data breach.
Thousands of foreign institutions, including Harvard University and Stanford University, were hit by the attack.
Some schools and universities whose students’ data was stolen individually sought to deal directly with the hackers to prevent data release, a source familiar with the matter told Reuters on May 8.
In a message allegedly sent by ShinyHunters and seen on forum platform Reddit, the affected institutions were threatened with the release of stolen data.
“If any of the schools in the affected list are interested in preventing the release of their data, please consult a cyberadvisory firm and contact us privately at TOX to negotiate a settlement,” read the statement. TOX refers to a peer-to-peer messaging platform.
Source: https://www.straitstimes.com/singapore/students-names-ids-may-have-been-exposed-in-cyber-attack-but-passwords-marks-uncompromised-nus (https://www.straitstimes.com/singapore/students-names-ids-may-have-been-exposed-in-cyber-attack-but-passwords-marks-uncompromised-nus)
Archive: https://archive.fo/ZihaG (https://archive.fo/ZihaG)
Reference: https://www.ransomware.live/group/shinyhunters (https://www.ransomware.live/group/shinyhunters)
Reference: https://canvaslostmydata.org (https://canvaslostmydata.org)
Reference: https://breach.vip (https://breach.vip)
Reference: http://91.215.85.103/pay_or_leak/ (http://91.215.85.103/pay_or_leak/)
Reference: https://github.com/x-aether-x/shinyhunters-threat-intel-report/blob/main/ioc_list.md (https://github.com/x-aether-x/shinyhunters-threat-intel-report/blob/main/ioc_list.md)
Reference (List of Institutions affected): https://web.archive.org/web/20260507042014/http://91.215.85.103/pay_or_leak/instructure_affected_schools_list.txt (https://web.archive.org/web/20260507042014/http://91.215.85.103/pay_or_leak/instructure_affected_schools_list.txt)
8 May 2026: Technical Advisory: ShinyHunters Breach of Instructure Canvas LMS: https://businessinsights.bitdefender.com/technical-advisory-shinyhunters-breach-instructure-canvas-lms (https://businessinsights.bitdefender.com/technical-advisory-shinyhunters-breach-instructure-canvas-lms)
(https://tralvex.com/download/forum/20260509%20Shinyhunter%20Canvas.jpg)
Canvas hack: Company pays criminals to delete students' stolen data
13 May 2025 | Joe TidyCyber correspondent, BBC World Service
The company behind the popular Canvas software, which was hacked last week causing major disruption at thousands of universities and colleges, has paid the hackers not to publish stolen data online.
The cyber-attack affected an estimated 9,000 institutions in the US, Canada, Australia and the UK, with exams disrupted after the Canvas service went down.
The hackers threatened to publish 3.5 terabytes of student and university data they had stolen in the breach.
Instructure, the maker of Canvas, has now confirmed it has "reached an agreement" with the hackers, who have said they deleted the data and promised not to extort any students or institutions.
Paying cyber criminals goes against the advice of law enforcement agencies around the world, as it can fuel further attacks and offers no guarantee the data has been deleted.
In previous cases, criminals have accepted ransom payments but lied about destroying stolen data, instead keeping it for resale.
For example, when the notorious LockBit ransomware group was hacked by the National Crime Agency, police found stolen data had not been deleted even after payments had been made.
Instructure said in a statement on its website that protecting students' and education staff data was its primary motivation.
"While there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to give customers additional peace of mind, to the extent possible," the company said.
Instructure did not set out the terms of the agreement but said that it meant that:
o the data was returned to the company
o it received "digital confirmation of data destruction"
o it had been informed that no Instructure customers would be extorted as a result of the incident
o the agreement covers all affected customers, with no need for individuals to engage with the hackers
The breach was discovered on 29th April and was claimed online by the prolific Shiny Hunters extortion group.
Neither the hackers nor the company are explicitly saying that money was exchanged, but cyber extortion groups like Shiny Hunters operate by forcing their victims to send money in bitcoin after a negotiation through an encrypted chat service.
A ransom note demanding payment in bitcoin appeared on screens during a cyber-hacking incident on the cloud-based platform Canva.
It is unusual for victims of cyber attacks to publicly acknowledge paying hackers, but Instructure has maintained a high level of transparency, providing regular updates on its website.
That openness may be partly because the attack was highly visible and affected students directly.
Students sitting exams in the US were particularly badly affected, losing access to Canvas for revision and, in some cases, having online exams interrupted.
Aubrey Palmer, a meteorology student at Mississippi State University, told the BBC that they and other students had just finished writing a 2,900‑word exam essay when a ransom message suddenly appeared on their screens.
Courtesy of Aubrey Palmer Meteorology student Aubrey Palmer points to a weather diagram on a blackboard with a piece of chalk while smiling and facing a classroom. Courtesy of Aubrey Palmer
Affected student Aubrey Palmer
The note read: "Shiny Hunters has breached Instructure (again)."
It threatened to release stolen data unless a ransom was paid in bitcoin by Canvas or affected universities.
"My knee‑jerk reaction was that I'd been hacked myself, because that's what it looked like," Aubrey said.
"But then I actually read the ransom note and saw it was Canvas that had been hacked."
Aubrey added dozens of students received the same message, and there was confusion in the exam room about whether their work had been saved.
Mississippi State University later announced some exams would be postponed to allow students to recover any lost work.
Shiny Hunters is known for hacking organisations, stealing data and then publicly pressuring victims to pay ransoms in bitcoin.
The group has been linked to other breaches, including attacks on Jaguar Land Rover and Gucci. The criminals are English‑speaking and believed to be young.
In Telegram messages exchanged with the BBC, Shiny Hunters said it had hacked Canvas twice before last Thursday's attack.
Instructure disclosed a breach in September 2025 in a post on its blog.
Shiny Hunters has also claimed it breached the company again in April 2026, ahead of the 29 April attack.
When asked how it felt about the stress and disruption caused to students like Aubrey Palmer, the group said: "We have no comment on that."
It would not say how much it had been paid by Instructure.
Source: https://www.bbc.com/news/articles/cdepzg83x87o
Archive: https://archive.fo/rSrMN
-
LTA circular to potential EV charger owners reveals hundreds of e-mail addresses under carbon copy feature
Derryn Wong | May 5, 2026
[SINGAPORE] More than 350 e-mail addresses of individuals were shown to all recipients of an e-mail circular from the Land Transport Authority (LTA) sent on Monday (May 4).
The message, seen by The Business Times, was sent at around 5.50 pm by the authority’s National Electric Vehicle Centre (NEVC) to inform potential owners of private electric vehicle chargers about a new digital service on the OneMotoring platform to register EV chargers with the authority.
It was sent with addresses under the carbon copy feature instead of blind carbon copy (bcc), meaning that all recipients could see all the other e-mail addresses in the chain.
A follow-up e-mail was sent at 10.44 pm to apologise for inadvertently disclosing the e-mail addresses.
Lim Yong Xian, deputy director of EV regulations at NEVC, said: “The staff involved has been counselled and advised to exercise greater care in handling such information. We have since reinforced our processes to ensure that recipients’ e-mail addresses are placed in the ‘bcc’ field in future, to prevent a recurrence.”
BT has queried LTA on the matter.
Source: https://www.businesstimes.com.sg/singapore/lta-circular-potential-ev-charger-owners-reveals-hundreds-e-mail-addresses-under-carbon-copy-feature
Archive: https://archive.md/wip/A4ReC
-
ChatGPT Gave Out My Address and Phone Number
By Matt Novak | May 13, 2026
Back in the 20th century, every city in America distributed a very large book to everyone’s home with a near-complete list of phone numbers and addresses for the people who lived there.
It was called a phone book and it was considered an extremely normal way to find contact information. Fast forward to 2026, and knowing someone’s address or phone number is considered some of the most intimate knowledge anyone can possess about you.
Eileen Guo at MIT Technology Review has a new article about the rising concern over AI chatbots giving out phone numbers. The assumption is that personally identifiable information (PII) is being used in training data, which allows anyone to request the numbers lodged deep in the machine, as it were.
Guo writes about some people who’ve been inundated with wrong numbers, including a software developer in Israel who started getting customer service calls after Gemini was giving out his number.
Weird mistakes are one issue, and a predictable one given AI’s error rate. Perhaps more concerning for the average person is the possibility of AI chatbots giving out their real phone number. I tested out various chatbots to see what they’d say if I requested my own phone number.
ChatGPT
ChatGPT accurately delivered a real phone number that I haven’t had in a few years. But it was a number that I had for many, many years before moving to Australia. The chatbot noted that, “I can’t verify whether that number is still current or active.”
It appears to have pulled the number from a PDF of a FOIA request that I made to the FTC back in 2016. I also asked ChatGPT for Matt Novak’s address, which was also in that obscure document. The AI chatbot happily volunteered that as well, though I no longer live there.
When I prompted it for another phone number for Matt Novak in California, it gave the number for a different Matt Novak in the Los Angeles area. But it seemed to have no qualms with doing the search and delivering real numbers.
Grok
Grok refused to hand over the phone number, despite my repeated pleas that it was needed for a life or death situation. Grok also recognized that I was asking for my own phone number, something the other chatbots never mentioned.
Claude
Claude told me that, “Sharing private contact details of individuals — including journalists — raises serious privacy concerns.” After telling Claude that Matt Novak had previously given me his phone number but I had forgotten it, the chatbot still refused.
Perplexity
Perplexity refused to give out my phone number and when it listed my email, it was censored with the words [email protected]. Curiously, Perplexity had no problem handing out my Signal user name. Despite repeated badgering, Perplexity refused to hand over the phone number.
Gemini
Gemini also refused and directed people to try my professional email address (mnovak@gizmodo.com) as well as my personal one (matt@paleofuture.com), both of which have been listed publicly with my consent all over the internet.
When I asked Gemini whose phone number is 818-925-4375, it correctly answered, “That phone number belongs to the journalist Matt Novak.” But don’t worry, that’s the number I do give out freely. None of the other AI chatbots would give up info on who that number belongs to. It’s me. But I consider it a little like my spam-line inbox.
It’s kind of funny that the entire idea of privacy has been flipped on its head over the past 20 years or so. Sharing your most intimate private moments or vacation photos on platforms like Instagram seems like no big deal. Back in the 1990s, that kind of wide exposure may have felt violating. But here in 2026, your phone number is a closely guarded secret.
And that’s not necessarily wrong or weird. It’s just how culture can shift over time. Privacy is ultimately a social construct.
Source: https://gizmodo.com/chatgpt-gave-out-my-address-and-phone-number-2000758330
Archive: https://archive.fo/jHCcz[/email]
-
AI-specific notifications mandatory for firms using personal data to train AI models: PDPC
Lee Li Ying | Jul 20, 2026
SINGAPORE – From July 20, organisations in Singapore will need to inform consumers when they use personal data to train generative artificial intelligence models, as the nation seeks to promote greater transparency and accountability.
“As more organisations develop, adapt or deploy generative AI tools, we must address the question of accountability,” said Minister for Digital Development and Information Josephine Teo, announcing the move at the Singapore Data Festival on July 20.
Singapore Data Festival was formerly known as Personal Data Protection Week, with the last run in 2025. The event has since been rebranded to reflect the broader role of data and AI in the digital economy.
The new measure, called AI-specific notifications, is set out in the advisory guidelines on the use of personal data in generative AI systems.
The guidelines were released by the Personal Data Protection Commission (PDPC) on July 20 following a month-long public consultation from June 2 to July 1.
The PDPC explained in the advisory guidelines that the AI-specific notifications are needed because there are risks that sensitive personal data – like children’s data, and health and credit records – could be exposed or reconstructed from generative AI models. It could be difficult to remove or correct information once it has been used to train a model.
Personal data comprises everything from names, phone numbers and e-mail addresses to voice recordings, photographs, biometric information, and financial and transaction records.
In the past, organisations could rely on broad privacy notices if they use personal data for “new product development” or “personalisation of services”.
Even though AI-specific notices are mandatory, the PDPC did not prescribe the content of such notices or where to place them, but recommended that companies explain the types of data used through in-app pop-ups or dedicated webpages. Channels for consumers to opt out or withdraw their consent are also not mandatory.
When call centres use call recordings to train AI models, a privacy policy or script update will suffice. AI-specific notifications are not required when anonymised personal data is used for AI training.
Organisations, including banks, insurers and social media platforms, are not allowed to decline services to consumers if they say no to AI training.
A separate set of voluntary guidelines released on July 20 also urges AI chatbot providers to disclose information such as their systems’ capabilities, limitations, reliability and safety measures.
These are AI assistants designed for public use, ranging from general-purpose chatbots developed by frontier AI companies to specialised assistants offered by businesses such as banks, airlines, insurers and retailers.
Such chatbots are the most commonly used generative AI application for users, but many may not know the chatbots’ limitations or what happens to the data they input.
“The information usually exists. But it is scattered across terms of service, privacy notices and other documents, and is often either too simplistic or too technical for ordinary users,” said Teo.
Thus, the guidelines recommend a “chatbot information card” – akin to a medicinal product label – that provides users with key information about an AI chatbot in a single place. It can take different forms, such as a dedicated information page or a disclosure document.
Teo pointed out that medicinal product labels do not list every scientific detail but tell people the essentials of what the drug is for, how to take it, how much is recommended, the side effects to watch for and when not to use it.
“The information card is meant to work the same way. It sets out in plain language what the chatbot is for, what it is not for, how data may be handled and how users can report issues,” said Teo.
Big tech companies like Google and Meta, as well as local giants like DBS Bank, OCBC Bank, Singapore Airlines and Synapxe, will be rolling out their own versions of the chatbot information cards over the next 12 months.
DBS has two chatbots – Joy, which provides 24/7 support for corporate clients, and digibot, which handles banking queries like checking account balances and loan enquiries. Both clearly inform users they are interacting with a generative AI-powered service and provide the option to speak to a human operator.
“We welcome IMDA’s pragmatic approach to balancing transparency with implementation flexibility that will help strengthen trust in AI across the ecosystem and advance Singapore’s ambition to be a trusted AI financial hub,” said Derrick Goh, group chief operating officer at DBS.
Teo said that for Google, the company will be consolidating key information about its flagship AI chatbot Gemini, while Meta will provide clear and accessible information about its AI-powered products.
Public sector agencies like the National Library Board and Health Promotion Board will also be adopting the guidelines.
“The companies I mentioned are early adopters who are demonstrating leadership in data and AI governance. We hope many more will follow,” said Teo.
The data protection conference takes place from July 20 to 24 at the Sands Expo and Convention Centre.
Source: https://www.straitstimes.com/tech/ai-specific-notifications-mandatory-for-firms-using-personal-data-to-train-ai-models-pdpc
Archive: https://archive.fo/XZ5L8
-
Cybersecurity incident affected 48 mosques, four madrasahs; no ransom paid: MUIS
The incident, which was first reported earlier in the week, involved a human resources and payroll system.
Darcel Al Anthony | 17 Sep 2026
SINGAPORE: No ransom was paid following a cybersecurity incident involving software vendor Avelogic, the Islamic Religious Council of Singapore (MUIS) said on Thursday (Sep 17).
The incident, first reported on Tuesday, affected Avelogic's human resources and payroll system and clients across different sectors. In the community sector, this included 48 mosques, four madrasahs, the Islamic Learning Hub and Management Office and Mosque-Madrasah-Wakaf Shared Services, MUIS said.
A police report was made, and Avelogic is continuing to investigate the incident and its wider impact, MUIS said.
The council added that it was “concerned” about the impact on the affected organisations and their employees and that it was working with those affected to ensure salaries would continue to be paid on time.
"Alternative payroll arrangements are already in place, and there has been no disruption to religious or public-facing services," said MUIS.
Avelogic has since recovered the affected data and engaged independent cybersecurity experts to investigate the incident.
Based on investigations so far, there is no evidence that a large amount of data was taken from the system, MUIS said. Data stored in the affected system is also encrypted as an additional layer of protection.
Investigations and security checks are ongoing, and the system will only resume operations after the relevant safeguards and checks have been completed.
"MUIS will continue to support the affected community sector organisations to ensure essential HR and payroll functions continue without disruption," the council said.
MUIS told CNA on Tuesday that the incident did not affect the delivery of public-facing or government services. It did not reveal the number of people affected or what information may have been compromised.
Separately, Avelogic published a cybersecurity incident notice concerning its SmartHRMS system, which it described as a payroll and human resources management system for enterprises.
In an update on Monday, the company said an independent forensic investigation found no evidence of bulk data exfiltration, based on available Amazon Web Services network telemetry covering confirmed threat actor activity from Aug 30 to Aug 31.
Avelogic did not identify affected customers. It said sensitive data fields within SmartHRMS remained protected by application-layer encryption.
The company filed a police report on Aug 31 and notified the Personal Data Protection Commission (PDPC). A PDPC spokesperson told CNA on Wednesday that it was investigating the data breach notification filed.
Avelogic appointed cybersecurity firm Black Panda on Sep 3 to conduct a forensic investigation. It added that it had recovered the latest data set and aimed to have its new system running by Friday.
Source: https://www.channelnewsasia.com/singapore/muis-ransomware-payroll-mosques-cybersecurity-6391666
-
More than 23,500 Simba customers affected in data breach involving IC numbers, birth dates
27 Sep 2026
SINGAPORE: Telecommunications company Simba has suffered a data breach affecting 23,549 customers, involving names, identity card numbers and dates of birth.
Based on the company's investigations so far, the data affected also included mobile numbers and email addresses of customers who had registered for Simba's services.
In a statement on Friday (Sep 25), Simba said it had discovered the incident a day earlier and had since resolved it.
No credit card or bank account information is "at risk", the company said.
The company added that there was currently no indication that any of the affected data had been "maliciously misused".
"Simba is treating this incident seriously and have swiftly resolved it.
"We have also taken immediate and appropriate actions to review existing security measures to protect core infrastructure and systems," it said, adding that it was working with the relevant authorities on the incident.
The company is also progressively notifying affected customers via email, with the process expected to be completed within the next week.
In response to CNA's queries, the Personal Data Protection Commission said it was aware of the incident and was investigating.
Source: https://www.channelnewsasia.com/singapore/more-23500-simba-customers-affected-in-data-breach-involving-ic-numbers-birth-dates-6413636
Archive: https://archive.li/JlIjU
-
Nearly 100,000 affected as Bee Cheng Hiang suffers Singapore's first AI-related data breach
October 01, 2026 | Asyiqin Nadzri
Nearly 100,000 Bee Cheng Hiang customers had their email addresses exposed after an employee used an AI tool to generate code for a mass marketing email.
The incident is reportedly Singapore's first AI-related data breach notified to the Personal Data Protection Commission (PDPC).
The incident took place on April 25. Bee Cheng Hiang notified the PDPC two days later.
PDPC Commission accepted a voluntary undertaking by Bee Cheng Hiang in September, to improve its compliance with the Personal Data Protection Act 2012.
The email was sent out in batches of about 1,000 customers, so recipients were able to see the email addresses of other people in the same batch.
Insufficient AI prompt
Bee Cheng Hiang said the employee had used a generative AI tool to help create a programme for sending marketing emails from a local mailing list.
However, the instructions given to the AI did not specify that recipients' email addresses should be hidden from one another.
The resulting code therefore caused multiple customers' addresses to appear in the same email.
The PDPC said the incident was not caused by a malfunction in the AI tool, but by human error in developing the email distribution code.
The affected email addresses were the only personal data involved, and the PDPC said there was no evidence that they were subsequently misused.
The employee had tested the programme before it was deployed, but only checked activity logs instead of examining the content of an actual test email.
This meant the problem was not detected before the marketing emails were sent.
Company introduces additional checks
Bee Cheng Hiang, which is known for their bak kwa, stopped the bulk email distribution after discovering the issue, corrected the code and informed affected customers.
The company has since introduced a requirement for at least two employees to check all bulk email communications before they are sent, according to the PDPC.
The PDPC also noted that this was Bee Cheng Hiang's first attempt at incorporating AI tools into its business operations.
Following the incident, the company gave a voluntary undertaking to improve its compliance with the Personal Data Protection Act. The PDPC accepted the undertaking on Sept 2.
As part of the undertaking, Bee Cheng Hiang will establish a framework governing employees' use of AI for coding.
This includes requiring independent technical reviews of AI-generated code that involves personal data.
The company will also strengthen its software testing procedures, including testing emails using dummy accounts before deployment.
It plans to formalise its response to the incident into a data breach procedure, as well as introduce automated measures to prevent emails containing multiple addresses from being sent in a single email field.
PDPC urges businesses to assess risks before using AI
The PDPC reportedly said organisations should conduct appropriate data protection impact assessments before adopting AI tools to improve business processes.
It also recommended that companies establish clear policies and processes, alongside testing and review mechanisms, to ensure employees use AI responsibly and protect personal data.
The case highlights that while AI may be used to assist with coding and other business functions, organisations remain responsible for checking how AI-generated outputs handle personal data before putting them into use.
Source: https://www.asiaone.com/singapore/pm-wong-urges-economists-stay-grounded-ai-advances
Archive: https://archive.li/iS9yV