MyRepublic data breach may affect over 79,000 customers

The personal data of nearly 79,400 mobile subscribers of MyRepublic was potentially accessed by hackers, the mobile operator and Internet service provider said yesterday.

This is the latest in a string of cyber attacks in recent months.

The details stolen were identity verification documents related to customer applications for mobile services.

MyRepublic said that hackers may have accessed data, including scanned copies of both sides of NRICs belonging to Singaporeans and permanent residents, and other personal data of employment and dependant's pass holders.

Foreigners who are MyRepublic subscribers may also be affected - the hackers could have taken documents such as scanned copies of utility bills that confirm their residential addresses.

Customers who ported an existing mobile service had their names and mobile numbers accessed, said the Internet service provider.

But it said there is currently no indication that other personal data, such as account or payment information, was affected.

MyRepublic's systems were not compromised and there was no operational impact on its services, the company said.

As scans of identity documents and mobile numbers might have been stolen, customers could be hit by more mobile spam messages or phishing attempts in the coming weeks, said Dr Stas Protassov, technology president of cyber-security firm Acronis.

Cybercrooks could also try to hijack their identities. "I would expect some impersonation attacks and identity thefts that could lead to a victim's account for services being taken over," he said, adding that some crooks might create new accounts in the victim's name to conduct fraudulent activities.

On Aug 29, MyRepublic discovered the unauthorised data access on a third-party data storage platform with the personal data of mobile customers.

Access to the data storage facility has since been secured. Its cyber-incident response team has also been activated to work closely with MyRepublic's internal information technology and network teams.

MyRepublic has notified the Infocomm Media Development Authority and the Personal Data Protection Commission of the issue.

The commission said it is aware of the incident and has contacted MyRepublic for more information.

Apologising for the incident, MyRepublic chief executive Malcolm Rodrigues said the company is "reviewing all our systems and processes, both internal and external, to ensure an incident like this does not occur again".

While there is no evidence that any personal data has been misused for now, MyRepublic said it will offer affected customers a complimentary credit monitoring service via Credit Bureau Singapore. The bureau will monitor customers' credit reports and alert them of any suspicious activity.

The maximum fine for a data breach is $1 million now. But firms can soon be fined more - up to 10 per cent of their annual turnover in Singapore, or $1 million, whichever is higher. The higher fine is slated to take effect at least 12 months from Feb 1 this year.

The latest attack comes after other mobile operators here were affected by data breaches.

Last month, StarHub said that the identity card numbers, mobile numbers and e-mail addresses of nearly 57,200 customers had been leaked online.

In February, Singtel revealed that the personal data of 129,000 customers was extracted by hackers during a breach of Accellion's file-sharing service, which is used by the telco.

At least three ransomware attacks were also reported last month.