Algas Engineering Pte Ltd

bd_b4ba6ae24821d500 · schema v1 · pii pii-v1

Background Algas Engineering Pte. Ltd. (the “ Organisation ”) notified the Personal Data Protection Commission (the “ Commission ”) on 15 April 2025 of a personal data breach involving its IT servers (the “ Incident ”). The Organisation established that the threat actor (“ TA ”) had likely executed the ransomware attack on a project manager’s laptop, which was the only device encrypted during the Incident, during an upgrade of the Organisation’s Operating System. Owing to several system inadequacies, the TA exfiltrated the Organisation’s files containing the personal data of 500 individuals who were the Organisation’s current (70 individuals) and former employees (430 individuals). The types of personal data affected included names, addresses, email addresses, telephone numbers, copies of national identification documents, passport numbers, photographs, dates of birth, bank account numbers and next-of-kin contact details. Upon discovery of the Incident, the Organisation took prompt remedial actions including restricting access rights to project-related folders and enabling password protection where possible and optimising firewall configuration with intrusion prevention signatures. The Organisation also notified the affected individuals. The data breach had likely occurred as the Organisation had inadequate security measures prior to the Incident such as lack in proactive monitoring that resulted in delayed detection, access to user endpoints and shared folders without additional password protection and inadequate training for employees on suspicious phishing emails. The Organisation’s servers were also vulnerable during the Operating System upgrade that may have created a window of exposure. The Organisation had basic protective measures in place including user access controls and password policies. Voluntary Undertaking Having considered the circumstances of the cas

P pin to compareR raw source