Rotary Engineering Pte Ltd

Background Rotary Engineering Pte. Ltd. (the “Organisation”) notified the Personal Data Protection Commission (the “Commission”) on 3 June 2025 of a ransomware attack on its corporate systems (the “Incident”). Investigations revealed that the threat actor had gained unauthorised access to the Organisation’s corporate systems which resulted in ransomware deployment and exfiltration of personal data affecting 2,209 individuals (current and ex-employees of the Organisation). The types of personal data affected included a combination of names, addresses, dates of births, signatures, image copies of passports, NRICs and birth certificates, resumes, pay slips and IR8A. Upon discovery of the Incident, the Organisation took prompt remedial actions including disabling legacy authentication, implementing multi-factor authentication (“MFA”) across network and VPN, applying conditional access controls and token revocations, disabling remote management for all devices, deploying a new “Green” environment that consists of a new network, rebuilt servers and rebuilt endpoint with no overlap with the original, compromised environment . The Organisation also notified the affected individuals. The Incident had likely occurred as there were authentication and access control failures which included the absence of MFA on VPN and critical accounts. There were also weaknesses in the Organisation’s network and infrastructure such as flat network architecture without segmentation. In addition, the Organisation’s backups and recovery were not sufficiently robust and resilient. Voluntary Undertaking Having considered the circumstances of the case, the Commission accepted a voluntary undertaking (the “Undertaking”) from the Organisation to improve its compliance with the Personal Data Protection Act 2012 (the “PDPA”). The Undertaking was executed on 18 March 2026. As part of the Undertaking, the