Meisei International Pte Ltd

Background On 8 September 2025, Meisei International Private Limited (the “ Organisation ”) notified the Personal Data Protection Commission (the “ Commission ”) of a personal data breach involving a ransomware incident which affected multiple systems including its legacy Human Resource Management System (HRMS) server (the “ Incident ”). The Organisation established that the threat actor (“ TA ”) likely gained initial access to its network using credentials from a compromised Virtual Private Network (VPN) account. Exploiting other system vulnerabilities, the TA encrypted the Organisation’s files on its HRMS server containing the personal data of 1,278 individuals who were the Organisation’s current (207 individuals) and former employees (1,071 individuals). The types of personal data affected included a combination of names, copies of identification documents, dates of birth, marital status, mobile numbers, telephone numbers, email addresses, residential addresses, employment records and financial information comprising bank account numbers and salary records. Upon discovery of the Incident, the Organisation took prompt remedial actions including isolating, reformatting and disconnecting the legacy HRMS server, and strengthening endpoint protection and monitoring across active servers and workstations. The Organisation also notified the affected individuals. The Incident had likely occurred as the Organisation had inadequate security measures prior to the Incident including a weak password policy, absence of network segmentation which allowed the TA to move laterally across the Organisation’s system, absence of security measures for the decommissioned legacy server and no implementation of multi -factor authentication (“MFA”) for VPN accounts . Voluntary Undertaking Having considered the circumstances of the case, the Commission accepted a voluntary undertaking (the “