190,000 Personal Data Breach Leads to Fine for IT Vendor

IT vendor Ezynetic was fined $17,500 for failing to protect its clients’ data. Ezynetic had failed to put in place reasonable security arrangements to protect the personal data in its possession or under its control, resulting in more than 190,000 individuals’ personal data being stolen and put for sale on the Dark Web.

At the time of the breach, Ezynetic was operating an IT system linked to the Moneylenders Credit Bureau platform operated by Credit Bureau Singapore. The breach was uncovered on June 24, 2024, when a threat actor exploited a vulnerable web service application to gain access and control of Ezynetic’s system administrator account.

The stolen data included personal information such as name, address, e-mail address, telephone number, NRIC number, date of birth, and financial information available in the MLCB credit reports of 190,589 individuals. Ezynetic failed to disable or adequately secure the system administrator account, making it susceptible to attacks.

Following the incident, Ezynetic rebuilt its network, migrated to a cloud environment, and implemented enhanced security measures. The Personal Data Protection Commission (PDPC) found Ezynetic in breach of the Personal Data Protection Act (PDPA) for failing to protect personal data and not conducting periodic security reviews.

Ezynetic was directed to obtain Cyber Security Agency of Singapore’s Cyber Trustmark Certification for its new IT network and pay the fine within 30 days. The firm must also report to the commission after obtaining the certification.

According to the source: The Straits Times.