Sunray Woodcraft Construction Pte Ltd

bd_0f3bbd1566997400 · schema v1 · pii pii-v1

Background The Personal Data Protection Commission (the “ Commission ”) was notified by Sunray Woodcraft Construction Pte. Ltd. (the “ Organisation ” or “ SWCPL ”) on 11 May 2023 of a personal data breach involving the unauthorised access and exfiltration of personal data (the “ Incident ”). I nvestigations revealed that a malicious actor had utilised a ransomware-as-a-service against SWCPL’s corporate environments, by exploiting vulnerabilities or using compromised credentials. While the exact cause of the breach could not be determined, the malicious actor encrypted the Organisation’s files containing the personal data of 2,130 individuals who were the Organisation’s current or ex-employees or who had previously sought employment with the Organisation. The types of personal data affected included the name, address, NRIC number, passport number, date of birth, contact information, photographs, and payroll information. In addition, for 689 individuals out of the 2130 individuals affected, their personal email address was also affected. Remedial Actions Upon discovery of the Incident, SWCPL had taken prompt remedial actions including tightening the access controls to sensitive system interfaces, updating the latest patches to the firewall, strengthening the firewall rules, resetting the privileged accounts and passwords, and deploying an Endpoint Detection and Response software to continuously monitor end-user devices within its network. Undertaking Having considered the circumstances of the case, the Commission accepted a voluntary undertaking (the “ Undertaking ”) from SWCPL to improve its compliance with the Personal Data Protection Act 2012. The Undertaking was executed on 25 October 2023. As part of the Undertaking, SWCPL implemented the following: (a) Engaged Telstra Singapore for Cyber Detection and Response services to manage and oversee its IT environment; (b)

P pin to compareR raw source