MISC Group Pte Ltd

bd_a0478c897fc9deb4 · schema v1 · pii pii-v1

Background On 23 May 2024, the Personal Data Protection Commission (the “ Commission ”) reached out to MISC Group Pte Ltd (the “ Organisation ”) after receiving information that a database containing personal data of individuals associated with the Organisation, were made available for sale on the dark web (the “Incident” ). The database was associated with the Organisation’s online ordering website and investigations found that the API URL to the website that was hosted on a cloud server in the Amazon Web Services (“ AWS ”) console had been publicly accessible. It was believed that the database in the server was likely exfiltrated by the threat actor(s) by exploiting the API URL. As a result of the Incident, the personal data of approximately 97,659 individuals, including their names, contact number, address, email address, transaction information such as choice of payment method and amount purchased were exposed on the dark web. The Organisation was found to be lacklustre in its cybersecurity and data protection practices as it had not developed or implemented data protection policies and procedures to comply with the Personal Data Protection Act 2012 (the “ PDPA ”). In addition, the AWS cloud server was not regularly scanned for vulnerabilities. Remedial Actions After the incident, the Organisation implemented the following: (a) Enabled a secret key on the API URL to prevent public access; and (b) Reviewed the restrictions on other server access keys. Voluntary Undertaking Having considered the circumstances of the case and the lack of knowledge by the Organisation in cybersecurity and data protection practices, the Commission accepted a voluntary undertaking (the “ Undertaking ”), which was executed on 6 September 2024, from the Organisation to engage an external service provider to improve its cybersecurity set-up and its data protection practices and policies. A

P pin to compareR raw source