St Francis Methodist School (International) Ltd

Background St Francis Methodist School (International) Ltd (the “ Organisation ”), is an international school in Singapore. On 23 December 2024, the Organisation notified the Personal Data Protection Commission (the “ Commission ”) of a personal data breach involving a ransomware attack that had impacted two of its servers (the “Incident”). T he Organisation established that the threat actor (“ TA ”) had gained access to its system on 18 December 2024 through a Server Message Block brute force attack, successfully compromising the main network administrator account and another user account. The TA encrypted files on one of the Organisation’s servers and deleted data belonging to its past job applicants only with no student data affected. The Incident affected approximately 761 job applicants’ personal data including a combination of name, mobile number, email address, educational and work history, residential addresses, NRIC numbers (7 applicants), and bank account numbers (46 applicants). There was no evidence of data exfiltration. Remedial Actions Upon discovery of the Incident, the Organisation took prompt remedial actions including isolating affected servers, disabling network sharing folders and decommissioning old servers with outdated Operating System and manually updating the cybersecurity software for current servers. The ransomware attack had likely occurred as the Organisation had inadequate security measures, including but not limited to the use of an End-of-Life Windows Server 2012 system without extended security updates, lack of multi-factor authentication for Active Directory accounts and the absence of account lockout policy after failed login attempts. Voluntary Undertaking Having considered the circumstances of the case, the Commission accepted a voluntary undertaking (the “ Undertaking ”) from the Organisation to improve its compliance with the Per