DLI Asia Pacific Pte Ltd

Background The Personal Data Protection Commission (the “Commission”) received a data breach notification on 18 June 2020 from DLI Asia Pacific Pte Ltd (“DLIAP”), informing that a ransomware attack had infected one of its file servers (“the File Server”), affecting the personal data of approximately 848 individuals. The affected datasets comprised the affected individuals’ names, addresses, contact numbers, dates of birth, marital status, insurance policy details, insurance premiums, passport copies, education background, employment details and/or salary information. It was established that DLIAP had not implemented adequate security measures to protect the personal data in the File Server at the time of the incident. In particular, there were insufficient controls to regulate access to the File Server via a virtual private network (“VPN”). The server hosting the VPN had not been patched, and the same credentials were used to access both the File Server and the VPN . Remedial Actions After the incident, as part of a remediation plan, DLIAP : (a) Implemented multi-factor authentication to strengthen VPN login; (b) Implemented different user accounts for VPN and File Server access; (c) Implemented a virtual desktop for its IT vendor with activity monitoring; (d) Engaged a security consultant to review its current IT infrastructure and propose enhancements; (e) Implemented additional security monitoring by a different IT vendor; (f) Improved patch update & management processes; (g) Established thorough file management rules for cloud storage of data; (h) Implemented email rules including password rules for attachments; and (i) Implemented compliance training for DLIAP’s employees; Undertaking The Commission recognises that DLIAP has made efforts to address the concerns raised in this case and to improve its personal data protection practices. Having considered the circum