Quest Technology Pte Ltd

Background On 6 December 2023, the Personal Data Protection Commission (the “ Commission ”) was notified by Quest Technology Pte Ltd (the “ Organisation ”) of a ransomware attack on its servers, resulting in its former and current employees’ personal data to be encrypted and subsequently deleted (the “ Incident ”). The Incident was first discovered on 4 December 2023 when employees found that their shared drives were all empty, containing only a readme file from the ransomware. Additionally, the backup systems had also failed and were compromised. As a result of the Incident, the personal data of approximately 75 individuals, including their names, residential addresses, contact number, NRIC number, date of birth, and salary was affected. The Commission found the Organisation to be wanting in its cybersecurity and data protection practices. First, the Organisation lacked personal data policy and internal guidelines for the employees. Second, there were no documented IT-related policies such as patch management policies and access control policies. Finally, there was a lack of reasonable password policy or management. Remedial Actions After the incident, the Organisation implemented the following: (a) Strengthened passwords to at least 8 characters with a 90-day aging for its Gmail, ERP, domain accounts, and the CCTV account; and (b) Provided cybersecurity courses to all staff to enhance awareness. Voluntary Undertaking Having considered the circumstances of the case and the lack of knowledge by the Organisation in cybersecurity and data protection practices, the Commission accepted a voluntary undertaking (the “ Undertaking ”), which was executed on 24 June 2024, from the Organisation to engage an external service provider to improve its cybersecurity set-up and its data protection practices and policies. As part of the Undertaking, after the initial set-up, the exter