Widex Singapore Pte Ltd

Background Widex Singapore Pte. Ltd. (' WSPL ') (the “ Organisation ”) notified the Personal Data Protection Commission (the ' Commission ') on 15 July 2024 of a ransomware attack that affected their archived data stored on Active Hearing Pty Ltd's (' AHPL ') server in Australia (the ' Incident '). WSPL and AHPL are sister companies under WS Audiology and AHPL operates WS Audiology’s Australian retail arm and provides retail systems to other WS Audiology businesses, including WSPL. Investigations revealed that the threat actor (' TA ') targeted AHPL's server in Australia (' Affected Server '). The Affected Server's infrastructure was wholly owned, controlled and managed by AHPL, with WSPL being only a client user who entered their customers' personal data directly into the Affected Server for business operations in accordance with the applicable internal Group policies. Accordingly, there was no transfer of personal data from Singapore to Australia. AHPL was also not a data intermediary of WSPL as AHPL did not access, edit and amend WSPL’s personal data in the Affected Server. The TA exfiltrated personal data of 10,281 WSPL customers. The types of personal data affected included a combination of customer names, contact numbers, emails, addresses, dates of birth, health card numbers (which may include NRIC numbers), and brief notes on hearing loss conditions. The brief notes did not contain detailed medical assessments or diagnoses. Upon discovery of the Incident, AHPL took immediate remedial actions including controlling internet access to approved websites only, hardening the internet firewall, increasing security of all servers, implementing password resets with enhanced complexity requirements and Two-Factor authentication, resetting Wi-Fi access credentials, and reinforcing cybersecurity guidelines with its staff. Voluntary Undertaking Having considered the circum