MISC Group Pte Ltd

MISC Group Incorporated in 1968, MISC Group is a world leading provider of international energy-related maritime solutions and services.29,841 files , 28.4 GBComplete command workstations: Master, Chief Officer and Bridge user folders - 16,918 files / 15.5 GB, including PST mail archives;Crew personal data (PDPA breach): IMO FAL Form 5 crew lists for ~30 seafarers with passport numbers (Malaysia/Philippines/Indonesia/India), Seafarer Employment Agreements with DOB, home addresses and salaries, a full scan of the 4th Officer's PRC passport;Every ship's password: ECDIS, CCTV, AIS, fire & gas alarm panels, door access codes, the Ship Security Plan (ISPS) password, NS5/Dualog mail accounts, domain admin credentials, OCIMF/SIRE web account;Internal investigations: complaint against the Chief Engineer (on-board assault/harassment, 25.08.2026), FR-HR25 investigative report;Incidents: vessel listing during (de-)ballasting - twice, one incident not reported to the flag state; a series of near-misses (VDR sensor failure, radar misuse during collision avoidance);Compliance gap: ~20 internal ISM non-conformities (rusted cargo pipelines, HV gloves expired since 2021) vs 'clean' statutory ABS audits of 17.10.2025; Japan PSC deficiency (Himeji, 09.12.2025) + Statements of Fact from 4 officers;Drydock & charter documentation: repair specs (SQLite MSL), ExxonMobil/APLNG delivery & redelivery certificates, CTMS custody-transfer data, full e-docs and ship plans More

Background On 23 May 2024, the Personal Data Protection Commission (the “ Commission ”) reached out to MISC Group Pte Ltd (the “ Organisation ”) after receiving information that a database containing personal data of individuals associated with the Organisation, were made available for sale on the dark web (the “Incident” ). The database was associated with the Organisation’s online ordering website and investigations found that the API URL to the website that was hosted on a cloud server in the Amazon Web Services (“ AWS ”) console had been publicly accessible. It was believed that the database in the server was likely exfiltrated by the threat actor(s) by exploiting the API URL. As a result of the Incident, the personal data of approximately 97,659 individuals, including their names, contact number, address, email address, transaction information such as choice of payment method and amount purchased were exposed on the dark web. The Organisation was found to be lacklustre in its cybersecurity and data protection practices as it had not developed or implemented data protection policies and procedures to comply with the Personal Data Protection Act 2012 (the “ PDPA ”). In addition, the AWS cloud server was not regularly scanned for vulnerabilities. Remedial Actions After the incident, the Organisation implemented the following: (a) Enabled a secret key on the API URL to prevent public access; and (b) Reviewed the restrictions on other server access keys. Voluntary Undertaking Having considered the circumstances of the case and the lack of knowledge by the Organisation in cybersecurity and data protection practices, the Commission accepted a voluntary undertaking (the “ Undertaking ”), which was executed on 6 September 2024, from the Organisation to engage an external service provider to improve its cybersecurity set-up and its data protection practices and policies. A