Orchid Hotel Pte Ltd

Background Orchid Hotel Pte Ltd (the “ Organisation ”) notified the Personal Data Protection Commission (the “ Commission ”) on 13 March 2024 of a ransomware attack on its servers (the “ Incident ”). The personal data, which included the name, NRIC, date of birth, email address, and telephone number, scanned copy of passport and credit card information (last 4 digits) of 680,000 individuals was encrypted Investigations revealed that the threat actor (“ TA ”) gained access through the Remote Desktop Protocol and successfully compromised the local and domain administrator accounts. At the time of the Incident, sensitive data, i.e. NRIC, passport and credit card information, was encrypted at rest. The Organisation’s firewall logs did not detect any abnormalities, anomalous outbound traffic or evidence to suggest that data had been exfiltrated. Upon discovering the Incident, the Organisation took prompt remedial actions. This included engaging a third-party vendor to conduct comprehensive security assessment and data handling practices and also implementing stronger password standards and multi-factor authentication (“ MFA ”) for all accounts. Voluntary Undertaking Having considered the circumstances of the case, the Commission accepted a voluntary undertaking (the “ Undertaking ”) from the Organisation to improve its compliance with the Personal Data Protection Act 2012 (the “ PDPA ”). The Undertaking was executed on 21 August 2024. As part of the Undertaking, the Organisation will be implementing the following: (a) Change all IP addresses and passwords for affected servers; (b) Perform a full reformat and rebuild of impacted systems to ensure a clean and secure environment. All network assets would be assessed, and all remote access credentials changed. A VAPT is scheduled; (c) Conduct another round of anti-virus scans across all servers and endpoints to identify and re