In more detail

KB Group Entities

The KB Group Entities, comprising several companies including Koh Brothers Building & Civil Engineering Contractor (Pte) Ltd and G & W Precast Pte Ltd, reported a ransomware attack on 11 December 2023. A ransom note from the Lorenz ransomware group was found.

A threat actor gained access through a vulnerability in the Mitel IP telephony server, which was not adequately patched by the third-party vendor responsible for managing the system. The KB Group Entities had failed to clearly provide in their contract with the third-party vendor their expectations that the vendor would be responsible for patching the vulnerabilities.

The attack resulted in the encryption and deletion of files containing the personal data of 11,718 individuals, primarily current and former employees.

The types of personal data affected included the name, email address, contact number, address, employee identification number, NRIC/FIN number, gender, religion, race, marital status, passport information, date of birth, bank account information, employment information and salary information.

A total of 5,748 individuals' personal data was exfiltrated on the dark web.

MISC Group Pte Ltd

On 23 May 2024, the PDPC reached out to MISC after receiving information that a database containing personal data of 97,659 individuals associated with MISC was available for sale on the dark web.

The data breach was linked to MISC's online ordering website, where an API URL hosted on an Amazon Web Services (AWS) cloud server was publicly accessible. The database in the server was likely exfiltrated by the threat actor(s) by exploiting the API URL.

The compromised data included names, contact numbers, addresses, email addresses, and transaction information such as payment methods and amounts purchased.

The investigation revealed that MISC lacked adequate cybersecurity and data protection practices such as regular vulnerability scans on the AWS cloud server.

Following the incident, MISC implemented several remedial actions, including enabling a secret key on the API URL to prevent public access.

Consequences and decisions

In both cases, the PDPC accepted voluntary undertakings from the organizations to improve their data protection practices.

The KB Group Entities committed to disconnecting all servers, enforcing domain user password changes, patching and rebuilding affected servers, conducting compromise assessments on backup infrastructure, and deploying endpoint detection response solutions.

MISC agreed to engage an external service provider to enhance its cybersecurity setup and data protection policies, including appointing a data protection officer, establishing asset inventories, developing an incident response plan, and implementing necessary cybersecurity measures.

Key takeaways

The PDPC's actions in these cases highlight its ongoing commitment to enforce strict data protection standards.

Through these voluntary undertakings, the PDPC ensures that organizations take immediate and effective remedial actions to address data breaches and prevent future incidents.

Both cases also underscore the critical importance of robust cybersecurity practices. Organizations must regularly scan for vulnerabilities, patch systems promptly, and implement comprehensive data protection policies to safeguard personal data, mitigate the risk of data breaches, and ensure compliance with the PDPA. 

* * * * *

For further information and to discuss what this development might mean for you, please get in touch with your usual Baker McKenzie contact.

* * * * *

© 2024 Baker & McKenzie.Wong & Leow. All rights reserved. Baker & McKenzie.Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "principal" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.