Key facts
The Organisation is a Software-as-a-Service (SaaS) provider that provides information technology solutions and services to licensed moneylenders in Singapore. As part of its services, the Organisation’s clients would input personal data of their prospective loan applicants and borrowers into a system which allows them to verify the applicants’ and borrowers’ loan eligibility, generate Moneylenders Credit Bureau reports, track the loans, instalments, collections, payments and generation of profit and loss reports.
On or about 24 June 2024, the Organisation’s servers were infected by ransomware and it discovered it could not access its system. Investigations revealed that a threat actor had exploited a vulnerable web service to gain access to the system administrator account as the Organisation:
- Failed to disable or adequately secure the system administrator account, which is a well-known target of malicious users. The system administrator account, which had privileged access, was protected by weak passwords such as “p@ssword1” or “Password@1”, making it highly susceptible to brute force attacks; and
- Had not conducted any periodic vulnerability assessments or penetration testing of its infrastructure.
Findings and basis for determination
The PDPC found that the Organisation contravened its Protection Obligation under section 24(a) of the PDPA as it failed to:
- Have reasonable access controls such as implementing and enforcing a strong password policy that includes a minimum level of password complexity and a fixed period of password validity or regular change of passwords. This was necessary considering the volume and types of personal data in the possession and under the control of the Organisation; and
- Conduct reasonable periodic security reviews, such as conducting web application vulnerability scanning and assessments post deployment, or penetration testing.
Key takeaways
This case is a timely reminder for organisations that poor cyber hygiene measures such as weak password policies and infrequent security audits seriously expose organisations to cyberattacks and data breaches, and also enforcement action by the PDPC for a breach of the PDPA . In particular, the PDPC’s comment that the Organisation as a SaaS provider should possess the necessary technical expertise to implement reasonable cybersecurity measures to address evolving threats highlights the higher expectations on businesses in the technology sector to take appropriate and reasonable security arrangements to protect personal data in their possession or control .
The PDPC also indicated that incurring significant financial expenses in implementing remedial measures post-data breach is not necessarily a mitigating factor for any financial penalty imposed as such measures are a necessary part of an organisation’s ordinary compliance with the PDPA’s Protection Obligation. Accordingly, organisations should ensure they invest and implement in both prevention and remediation in their cybersecurity and data protection compliance strategy.
* * * * *
© 2025 Baker & McKenzie. Wong & Leow. All rights reserved. Baker & McKenzie. Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "principal" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.
