Bud Studio Pte Ltd

bd_6e8a5d03125b4974 · schema v1 · pii pii-v1

Background On 30 October 2025, Bud Studio Pte. Ltd. (the “Organisation”) notified the Personal Data Protection Commission (the “Commission”) of a personal data breach involving its Network Attached Storage (“NAS”) server (the “Incident”). The Organisation is a Singapore-based design and build practice. The Organisation established that it had suffered a ransomware attack on its NAS server on 27 October 2025, resulting in unauthorised access and modification by the threat actor(s) to the NAS server, affecting files holding personal data of approximately 252 individuals. There was no evidence of exfiltration or publication. The types of personal data affected included a combination of their names, NRIC numbers, telephone numbers, addresses, personal email addresses, as well as the signatures and NRIC copies of 2 individuals. The Organisation was lacklustre in its cybersecurity and data protection practices and was unaware of the security and maintenance of its IT infrastructure as it was primarily reliant on its IT vendor for the aforementioned. The Incident had likely occurred because of the absence of security measures, such as multi-factor authentication. At the time of the Incident, the Organisation had not developed or implemented any data protection policies or measures as required under sections 11 and 12 of the PDPA, including not having designated a data protection officer and not having documented internal and external data protection policies. Remedial Actions After the incident, the Organisation implemented the following remedial measures: (a) Appointed a DPO; and (b) Formulated an interim personal data protection policy. Voluntary Undertaking Having considered the circumstances of the case and the lack of knowledge by the Organisation in cybersecurity and data protection practices, the Commission accepted a voluntary undertaking (the “Undertaking”), which w

P pin to compareR raw source