Prosegur Singapore Pte Ltd

Background Prosegur Singapore Pte. Ltd. (the “Organisation”) informed the Personal Data Protection Commission (the “Commission”) on 27 August 2025 of a personal data breach involving its file servers (the “Incident”). The Organisation established that the threat actor (“TA”) had gained initial unauthorised access to the Organisation’s file servers on 23 June 2025, using compromised login credentials of a service account via Virtual Private Network, which subsequently resulted in the exfiltration of a subset of the affected personal data of the Organisation’s employees, former employees and contractors. The personal data of 21,421 individuals were affected, with a smaller number exfiltrated. The types of personal data affected included a combination of names, addresses, telephone/mobile numbers, NRIC/FIN/passport numbers, countries of origin, photographs, dates of birth, salary histories and a smaller subset of health – mainly vaccination information, belonging to approximately 2,514 individuals. Upon discovery of the Incident, the Organisation took prompt remedial actions including isolating the compromised server, restricting access rights to databases to reduce exposure and renewing all Active Directory user credentials to strengthen identity control and access management. The Organisation also notified the affected individuals. The data breach had likely occurred as the Organisation did not implement multi factor authentication (“MFA”) for remote access to the compromised service account and did not fully apply network segmentation to protect personal data in its possession. The Organisation had other protective measures in place including network security with two pairs of firewall, patch management and endpoint solutions. Voluntary Undertaking Having considered the circumstances of the case, the Commission accepted a voluntary undertaking (the “Undertaking”) from