Poh Heng Jewellery Pte Ltd

Background On 29 March 2024, Poh Heng Jewellery (Private) Limited (the “ Organisation ”) notified the Personal Data Protection Commission (the “ Commission ”) of a personal data breach involving a cyber incident where a threat actor (“ TA ”) had obtained the source code for its e-commerce website (the “ Affected Website ”) through exploiting vulnerabilities (the “ Incident ”). Investigations revealed that that the TA had likely probed the Affected Website requesting for “/git.” web resources and found an exposed link to a configuration folder containing the website deployment file. This information allowed the TA to find the integrated GitHub repository of the Organisation’s then-Website vendor, A&C Atelier Pte Ltd (“ A&C ”) and obtain the Affected Website’s source code. The source code contained hardcoded API keys and integration credentials which the TA had exploited to access a HubSpot Middleware application that was integrated to the Affected Website at the time. Subsequently, the TA downloaded the personal data of 81,465 customers. The types of personal data affected included the name, contact number, residential address, personal email address, date of birth, country of residence, membership ID number and transactional information of up to the last five purchase transactions. Facts of the Case The setup of the Affected Website included the affected GitHub repository, used by A&C to contain the source code for developing the Affected Website, and the Hubspot Middleware application previously serviced by another vendor, Onyx Island Pte Ltd (“ Onyx ”). The Hubspot Middleware application was set up by Onyx to transfer a customer’s data from the Affected Website to the Hubspot CRM software-as-a-service (“ SaaS ”) platform and also to delete the customer’s data from the Affected Website after the transfer was complete. A&C and Onyx were previously engaged by the Organ