Case fined $20,000 for breaches compromising data

The Consumers Association of Singapore (Case) has been fined $20,000 for breaches under the Personal Data Protection Act (PDPA).

- Ian Cheng

In a judgment published on Aug 28, the Personal Data Protection Commission (PDPC) said the consumer watchdog was fined for failing to put in place reasonable security arrangements to protect the personal data in its possession or under its control.

It had also failed to develop and implement policies and practices that are necessary to meet its obligations under the PDPA.

The breaches led to two separate incidents in October 2022 and June 2023 where up to 22,542 e-mail addresses in the first case, and consumer data of 12,218 individuals in the second, that Case had in its possession were possibly compromised.

THE FIRST INCIDENT

Case first notified PDPC of a data breach involving a threat actor accessing its e-mail accounts and sending phishing e-mails on Oct 8 and 9, 2022, from its official email addresses.

On Oct 8, 2022, some of Case's consumers received unsolicited emails from "[e-mail]", an account used to communicate with consumers who lodge complaints on its website.

In the e-mail, consumers were told that their complaints had been escalated to the "collections and compensation department", and that they were eligible for a compensation payout.

They were requested to click on a chat icon to fill in their banking details to complete the payment process.

The next day, similar e-mails sent from "[e-mail]", an account used to communicate with consumers whose complaints were escalated to mediation.

Following this, in January and February 2023, Case received complaints of more such e-mails being sent to its consumers from e-mail addresses that did not originate from its domain.