Beef up cyberdefences now, CSA urges all organisations as reported incidents triple

SINGAPORE – All organisations in Singapore, regardless of size or sector, should take steps now to strengthen their cyberdefences amid a recent tripling in reported cyberincidents here, said the Cyber Security Agency of Singapore (CSA) on Nov 13.

The advisory comes after a string of cyberincidents across various sectors in the past weeks, affecting Singapore organisations or their service providers, and a rise in significant data breaches reported to the Personal Data Protection Commission (PDPC) over the past week involving well-known organisations.

CSA advised organisations to take action as cyberthreat actors are increasingly exploiting exposed vulnerabilities and poorly secured systems, with AI allowing hackers to speed up attacks.

The agency said that since September, the average monthly number of reported cyberincidents has been three times the average for the January to August period.

“These incidents do not appear to be part of coordinated campaigns targeting Singapore but reflect a broader global trend of opportunistic attacks,” CSA said in a statement. “Some incidents have also involved compromised third-party suppliers, underscoring the importance of managing supply-chain risks.”

In a separate Nov 13 statement, PDPC said that the data breaches it observed arose from attacks exploiting a range of common vulnerabilities in information technology systems. Similarly, there was no clear connection between the incidents, with some related to global data breaches.

PDPC commissioner Denise Wong said that organisations should give the recent increase in reported data breaches “urgent attention to avoid becoming victims”.

CSA chief executive Gwenda Fong said that for business leaders, even those that do not have dedicated IT or security teams, “cybersecurity should be on your agenda”.

CSA noted that hackers are actively scanning the internet for vulnerable systems, and organisations can become victims even if they are not specifically targeted.

“The growing use of artificial intelligence by threat actors could further accelerate the discovery and exploitation of vulnerabilities, reducing the time organisations have to secure their systems,” it said.

CSA urged organisations to prioritise the following when taking immediate steps to protect themselves:

“Organisations should also ensure that their business continuity plans are ready to be activated in the event of a cyberincident,” added the agency.

At least 12 cyberincidents involving Singapore organisations or their service providers were reported between Oct 24 and Nov 13. Most involved confirmed or possible exposure of personal data, ranging from names and contact details to identity card numbers and travel itineraries.

Six of the 12 incidents involved healthcare and community care organisations.

The Ministry of Health said on Nov 12 that the six healthcare-related incidents had caused no disruption to patient care. It was unaware of any unauthorised access to patient health records and was following up with the organisations involved.

It also asked public healthcare institutions and health technology agency Synapxe to step up monitoring of cyberthreats, and urged private providers to strengthen their safeguards.

The first incident was reported on Oct 24, when healthcare services provider Alliance Medinet said the personal data of about 110,000 members had been compromised. Insurers like HSBC Life, Income Insurance and Singlife, which are customers of Alliance Medinet, were among those affected.

On Nov 3, personal finance portal MoneySmart said an unauthorised party had copied personal data belonging to some customers in Singapore and Hong Kong. The information potentially exposed included identity card numbers and financial details.

That same day, Singapore Airlines said data from about 46,000 booking records had been accessed in a breach at its booking technology provider Amadeus. The data included names, booking references and travel itineraries. Travel document details may also have been accessed for about 620 records.

On Nov 6, telco M1 said a breach had compromised customer data including names, identity card numbers, dates of birth and home addresses. On the same day,Telemedicine provider Doctor Anywhere separately reported that users’ personal data had been leaked. Clinical records were unaffected.

Four days later, SPH Media said cyberattacks had affected 9% of its database, exposing some customers’ personal data. The company said payment card details and financial information were unaffected.

Also on Nov 10, SATS said a breach of its Tappee meal-ordering app had compromised student data at four schools, including names, concession card numbers and financial assistance status. A small number of records contained information such as students’ weight and allergies.

Three incidents involving healthcare and community services were reported on Nov 11.

A breach at Fullerton Health may have exposed migrant workers’ names, foreign identification numbers and mobile numbers. Dementia Singapore said some users of its CARA app may have had their names, contact details and membership IDs exposed. Minmed Group said a cyberattack had affected a system supporting teleconsultations and health screenings. It added that clinical records were unaffected and did not disclose whether other personal data had been exposed.

On Nov 12, the Agency for Integrated Care said the personal data of up to 4,064 employees at public healthcare institutions and community care providers may have been accessed through a system used for advance care planning.

The latest case was reported on Nov 13, when local clothing label Our Second Nature said customer details had been exposed in a breach discovered a week earlier.

CSA said that it has briefed all critical information infrastructure sectors and is working closely with owners of such infrastructure to strengthen their cyberdefences.

To help businesses understand the evolving threats and take preventive measures, the agency has also engaged key trade associations and business chambers.

Organisations who need assistance with shoring up their cyberdefences can tap CSA’s CISO-as-a-Service programme to engage professional consultants to develop tailored cybersecurity plans. Eligible small- and medium-sized enterprises can get up to 70% co-funding for this.

For organisations that have experienced a cyberincident, they can contact the Cyber Incident Helpline on 6890-9555 for help. They can also lodge a report on the Cyber Aid webpage of CSA’s Singapore Cyber Emergency Response Team.

PDPC also reminded organisations to collect only data that is needed and protect against unauthorised data theft by taking prevention measures.

The commission’s Guide To Data Protection Practices For ICT Systems provides a reference for organisations to implement data loss prevention measures. Organisations can also refer to PDPC and CSA’s joint advisory on insecure application programming interfaces to protect against common data protection risks.

Consumers can protect themselves by sharing only data that is necessary. They can use secondary e-mail accounts for accessing non-essential services and be vigilant against phishing scams, especially following a notification by an organisation that their personal data has been affected by a data breach.