D’League Pte Ltd and subsidiaries

Background D’League Pte. Ltd. (the “ Organisation ”) notified the Personal Data Protection Commission (the “ Commission ”) on 8 August 2025 of a personal data breach involving its systems (the “ Incident ”). The Organisation established that on or about 15 July 2025, a threat actor (“ TA ”) had accessed its systems and exfiltrated its data, before encrypting its systems. These systems contained personal data of the Organisation and its subsidiaries, namely Richard Mille Asia Pte. Ltd, Henry Jacques Asia Pte. Ltd, The Value of Time (Asia) Pte. Ltd, Surrender Pte. Ltd. 1 , Three Pleasures Pte. Ltd, Inca Holdings Pte. Ltd, Le Mondo Ryori Pte. Ltd and Shinsetsu Pte. Ltd (collectively, the “ Subsidiaries ”). The Organisation determined that the TA had likely obtained access to its systems through credentials associated with a compromised, dormant Virtual Private Network (“ VPN ”) account used by, or belonging to, a staff member or representative of the Organisation’s external IT consultant. The Incident affected the personal data of 17,626 individuals, comprising employees, former employees, non-employees and customers of the Organisation and its Subsidiaries. The types of personal data affected included a combination of names, NRIC numbers, passport copies, nationalities, dates of birth, addresses, emails, contact numbers, genders, transaction history, financial information ( including names, bank account numbers, and names of bank), employees’ hospitalisation documents and medical certificates. Upon discovery of the Incident, the Organisation took prompt remedial actions including removing all VPN user accounts, creating only essential VPN accounts, enforcing multi-factor authentication (“ MFA ”) for all VPN users and restricting VPN connections. The Organisation also notified the affected individuals. The Incident had likely occurred as the Organisation had inadequate s