Delugs Pte Ltd

bd_98cdf8267f8ff781 · schema v1 · pii pii-v2

Background Delugs Pte. Ltd. (the “Organisation”), a Singapore-based e-commerce business, notified the Personal Data Protection Commission (the “Commission”) on 15 December 2025 of a personal data breach involving its e-commerce storefront (the “Incident”). The Organisation established that the threat actor (“TA”) had gained access to its e-commerce application on 4 December 2025 by using compromised credentials for an overseas-based employee’s administrator account, which was shared with another four customer service staff. Thereafter, the TA injected malicious JavaScript code, modifying the Organisation’s storefront theme. The malicious script redirected customers who placed orders through the Organisation’s online shopfront to a spoofed checkout page which allowed personal data entered by customers to be captured and transmitted to the TA’s infrastructure. The Incident potentially affected 178 customers. The types of personal data affected included names, delivery addresses, email addresses, phone numbers and credit card information, specifically credit card numbers, expiry dates and CVV codes. Upon discovery of the Incident, the Organisation took prompt remedial actions. This included removing the malicious script and reviewing all theme files for additional suspicious code, as well as deleting and re-creating all employee accounts on its e-commerce IT infrastructure. The Organisation also notified all the potentially affected customers. The Incident likely occurred as the Organisation did not implement measures to prevent sharing of credentials for the compromised administrator account, which increased the likelihood of credentials being compromised despite the implementation of Multi-Factor Authentication. There was no enforcement of least privilege principles and the compromised account had excessive theme editing permissions, which the customer service staff di

P pin to compareR raw source