In more detail
Key facts and findings
In March 2025, the Organization notified the Personal Data Protection Commission (PDPC) of a data breach incident wherein a threat actor gained unauthorized access to one of the Organization’s corporate email accounts. The threat actor subsequently used the compromised email account to send phishing emails to the Organization’s clients.
Investigations revealed that the data breach occurred when a staff member fell prey to a phishing attack, allowing the threat actor to gain access to the mailbox of the compromised email account to send phishing emails to contacts in the address book for about one hour. The personal data of 71 individuals — including their full names, addresses, NRIC numbers, passport numbers, nationalities and financial information — was affected.
Upon discovering the incident, the Organization’s remedial actions included the following:
- Notifying recipients of the phishing emails purportedly sent out by the Organization
- Forcibly logging out all Microsoft 365 users across the Organization to terminate all active sessions
- Resetting the password and revoking the Microsoft 365 license associated with the compromised mailbox
Voluntary undertaking
As part of its voluntary undertaking, the Organization committed to implementing the following:
- Conducting phishing simulation exercises for employees and identifying susceptible personnel
- Scheduling annual Vulnerability Assessment and Penetration Testing (VAPT) for all internet-facing assets and internal systems
- Implementing a Data Protection Management Programme (DPMP), including password policies and email data retention standard operating procedures
- Formalizing breach response procedures
- Undergoing Data Protection Trustmark (also known as DPTM) audit and certification
The PDPC will verify whether the Organization complies with the undertakings and, if necessary, issue a direction to ensure the Organization’s compliance.
Key takeaways
This case highlights the importance of conducting training and simulation exercises for employees to guard against phishing attacks, and having policies and procedures in place for data security, data retention and breach response procedures.
* * * * *
© 2025 Baker & McKenzie. Wong & Leow. All rights reserved. Baker & McKenzie. Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "principal" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.
