Shiseido Group

Background S hiseido Asia Pacific Pte Ltd (“ SAPAC ”), Shiseido Singapore Co. (Pte) Limited (“ SS ”) and Shiseido Travel Retail Asia Pacific Pte. Ltd (“ TRA ”), collectively, the “Shiseido Group” (the “ Organisation ”) notified the Personal Data Protection Commission (the “ Commission ”) on 14 August 2023 of a personal data breach involving a ransomware attack by the Lockbit 3.0 ransomware group that had encrypted their production servers and deleted the data stored on its backup server (the “ Incident ”). Investigations revealed that a threat actor (“ TA ”) had likely gained access to the Organisation’s system using a local administrator account which was used to conduct lateral movements within the system. The first successful entry to the Organisation’s network originated from a ‘test’ account (it was not known why, when or by whom it was created) following a coordinated password-spray attack. The TA encrypted the Organisation’s files containing the personal data of 2,351 individuals who were the Organisation’s current employees, beauty consultants/promoters and contractors. The types of personal data affected included the name, email address, contact number, passport information, date of birth, bank account information and salary information. Upon discovery of the Incident, the Organisation took prompt remedial actions including isolating the encrypted production server from its global IT network, disabling VPN access so as to secure its IT network and systems and resetting the privileged accounts and passwords. The PDPC notes that there was no evidence of exfiltration of personal data. Voluntary Undertaking Having considered the circumstances of the case, the Commission accepted a voluntary undertaking (the “ Undertaking ”) from the Organisation to improve its compliance with the Personal Data Protection Act 2012 (the “ PDPA ”). The Undertaking was executed on 28