DiMuto Pte Ltd

Background DiMuto Pte Ltd (the “ Organisation ”) notified the Personal Data Protection Commission (the “ Commission ”) on 7 October 2024 of a personal data breach where a threat actor (“ TA ”) had gained unauthorized access to its system resulting in data exfiltration (the “ Incident ”). Investigations revealed that that the TA had infiltrated the Organisation’s cloud-based platform website and system by exploiting a compromised administrator account. This allowed the TA to view internal documents and personal data associated with user accounts. The TA exfiltrated some of the Organisation’s files containing personal data of 516 employees, business partners, representatives and corporate customers. The types of personal data affected included the name, telephone number, work email addresses, as well as a single passport number, photograph and date of birth. Upon discovery of the Incident, the Organisation took prompt remedial actions including, but not limited to, eliminating all single-factor authentication options, implementing encryption for the masking of personal identifiable information, enforcing password changes and enabling email-based two factor authentication (“ 2FA ”) for all internal user accounts. Voluntary Undertaking Having considered the circumstances of the case, the Commission accepted a voluntary undertaking (the “ Undertaking ”) from the Organisation to improve its compliance with the Personal Data Protection Act 2012 (the “ PDPA ”). The Undertaking was executed on 26 December 2024. As part of the Undertaking, the Organisation will be implementing the following: (a) Implement mandatory single sign-on and enable 2FA across all internal accounts; (b) Train employees to reinforce security protocols within the organisation; (c) Engage vendors for penetration testing and endpoint protection; (d) Migrate server and services to cloud and enforcement of MF