Stepup (Sup) Pte Ltd

bd_3882077efca92574 · schema v1 · pii pii-v1

Background On 9 June 2025, Stepup (Sup) Pte. Ltd. (the “ Organisation ”) notified the Personal Data Protection Commission (the “ Commission ”) on a personal data breach after discovering that an unauthorised individual(s) had gained access to its database. Subsequently, personal data collected by the Organisation were exfiltrated and posted on the Organisation’s community channel in Discord on 7 June 2025 (the “ Incident ”). The personal data collected by the Organisation were stored in cloud databases hosted in Singapore and the Organisation established that it had not secured its database tables adequately. The Row Level Security for the database tables was not properly configured, which allowed anyone with a public key to have viewing permissions for all tables. Consequently, the personal data stored within were exfiltrated and posted by the unauthorised individual(s). The Incident affected the personal data of approximately 607 individuals including a combination of their names, email addresses and educational institutions. After the Incident, the Organisation removed the public key configuration and configured Row Level Security with appropriate roles and permissions to prevent further unauthorised access as required under section 24 of the Personal Data Protection Act 2012 (the “ PDPA ”). The Organisation did not have a data protection officer and did not develop and implement privacy policies as required to comply with sections 11 and 12 of the PDPA. The Organisation has since appointed a data protection officer and published this information and implemented the relevant privacy policies and processes. The Organisation also collected, used and/or disclosed an individual’s personal data without notifying the individuals of the purpose(s) for which it intends to collect, use, or disclosure an individual’s personal data on or before such collection, use or disclos

P pin to compareR raw source