# data[].attributes.body
K Box Data Breach in 2014 lack effort to protect clients information
https://mustsharenews.com/data-breaches-singapore/

# data[].attributes.body
Sonia, Alison, Isty

# data[].attributes.attachment_link.readable_text
Australia's privacy watchdog has taken aim at a growing number of organisations that it says take too long to assess data breaches or that downplay the significance in customer notifications.

The Office of the Australian Information Commissioner (OAIC) issued multiple warnings in its latest report [ pdf] on notifiable data breaches (NDB).

While acknowledging the complexity of some breaches, the OAIC said it was "increasingly ... seeing instances of organisations taking much longer than 30 days to complete their assessments, with further significant delays before they notify affected individuals."

"Additional time taken to assess a breach must be reasonable and justified in the circumstances, with notification to individuals to occur as soon as practicable," the OAIC said.

"Unnecessarily delayed notifications undermine the NDB scheme by denying affected individuals the ability to take timely steps to protect themselves from harm."

The OAIC report revealed that three percent of the 539 data breaches reported between July and December last year - equivalent to 16 in real terms - took more than a year to be identified.

It wasn't just slow responses that irked the OAIC - it was also the way some breaches were ultimately disclosed.

"There were multiple instances where entities' notifications to individuals were deficient," the office said.

"In these instances, the OAIC required that the notifications be revised and reissued."

In some cases, breached organisations "provided individuals affected by a data breach with relatively generic advice that their 'personal details' may have been exposed", without listing the types.

"In other instances, notifying entities did not provide affected individuals with sufficient information regarding the data breach to understand the risk arising from it," the OAIC said.

"For example, an entity notified the OAIC of a data breach caused by social engineering where a staff member of the entity was deceived by a malicious actor into disclosing personal information about other individuals.

"However, the entity only advised individuals affected by the data breach that it involved a disclosure of their personal information to an 'unintended recipient'.

"In response to the OAIC's inquiries, the entity acknowledged that it had incorrectly paraphrased the description of the eligible data breach and reissued the notification to clarify that it involved a malicious actor.

"Examples such as these may not only fall short of reporting obligations but also adversely affect an individual's ability to make an informed decision about how to best mitigate harm."

# data[].attributes.attachment_link.title
OAIC finds 'multiple' Australian companies downplaying data breaches

# data[].attributes.attachment_link.description
Australia's privacy watchdog has taken aim at a growing number of organisations that it says take too long to assess data breaches or that downplay the significance in customer notifications. The Office of the Australian Information Commissioner (OAIC) issued multiple warnings in its latest report [ pdf] on notifiable data breaches (NDB).

# data[].attributes.headline
Some Examples of how Data can be breached

# data[].attributes.subject
Some Examples of how Data can be breached

# data[].attributes.body
Link on how data can be breached

# data[].attributes.attachment_link.provider_name
Must Share News - Independent News For Singaporeans

# data[].attributes.attachment_link.title
Home - Must Share News - Independent News For Singaporeans

# data[].attributes.body
ShopBack, Razer, Grab have faced Data Breaches

# data[].attributes.body
10.  MOH, MOE account sold on the dark web in 2019

# data[].attributes.attachment_link.provider_name
Must Share News - Independent News For Singaporeans

# data[].attributes.attachment_link.readable_text
Data Breaches Have Been On The Rise In Singapore

Singapore was ranked the safest country in the world based on a report by the World Justice Project in 2018. However, it seems that data breaches are threatening our online safety.

In 2019 alone, there were 3 major data leaks that affected millions of Singaporeans. Over the years, there have been other high profile cases that you may have forgotten.

We revisit a few breaches that threatened Singapore since the 'internet age'.

1. Y2K bug in 1999

The Y2K bug, also known as the Millennium Bug, messed with the formatting and storage of calendar data right before the year 2000.

The bug affected Singaporeans at every level.

To our average Singaporeans, it may have been slightly troublesome. For example, the bug caused computerised taxi meters to stop working in Singapore.

Tech stock companies were dealt a more severe blow. Many saw their stocks nosediving and could do nothing about it. The rapid fall in stocks also forced certain banks to sell off business assets.

2. Anonymous attacks in 2013

The Anonymous case was one of the most iconic in Singapore's history. The hackers donned the infamous Guy Fawkes mask whenever they appeared on screen to speak.

Anonymous is a decentralised hacktivist group that focuses on correcting injustices.

2 hackers, who declared themselves part of Anonymous, declared war on Singapore due to a new law on web censorship.

The group attacked PAP's webpage, leaking government employees' personal information.

3. SingPass leaks in 2014

1,500 SingPass accounts were hacked into a few months after the Anonymous attacks.

The situation began when SingPass was informed of false password resets. People received letters informing them that they had reset their password when they did not do so.

At the time, 1560 SingPass accounts were potentially accessed.

Even after the breach, SingPass accounts were used for crimes such as fake work pass applications.

4. K Box Data Breach in 2014

More than 300,000 K Box members had their mobile numbers, ID card numbers, and addresses leaked in Oct 2014.

This incident was due to Singapore raising her causeway toll rate which enraged hackers, "The Knowns".

They threatened to leak more information from other companies if their conditions were not met. Fortunately, they never followed up on their threats.

The leak was attributed to their lacklustre effort to protect clients information.

5. WannaCry Ransomware 2017

WannaCry ransomware encrypts files in your computer preventing you from accessing it. Attackers would only decrypt the files if you paid them a sum in Bitcoin.

Fortunately, the ransomware did not hit Singapore as badly as others. Only 500 IP addressed were affected by this.

The software had was stopped from spreading as a 'kill switch' was found ending the saga.

6. MINDEF got hacked in 2017

MINDEF was hacked by an unknown group of people in 2017.

Fortunately, the hackers only got away with the personal data of 850 NSmen as MINDEF keeps its information on a seperate server.

Based on MINDEF's statements, the attack was pre-meditated and could even have been sponsored by other states that were trying to steal classified information.

7. SingHealth got hacked in 2018

Singapore's worst cyber attack so far happened in 2018. 1.5 million SingHealth patients had their personal particulars stolen.

But what shook Singapore the most was that the attacks were directed at our Prime Minister Mr Lee Hsien Loong himself.

8. HIV data leak in 2019

The 'hottest' data breach of 2019 was probably the pair that were involved in HIV leak.

Mr Farrera-Brochez, Mr Ler Teck Siang's lover, was charged with fraud and drug-related offences in 2016. He was deported back to America in 2018 after he completed his jail term.

His name resurfaced again in 2019 as he was suspected to have leaked the personal information of over 14,200 HIV-positive individuals.

9. Blood-donors personal information exposed in 2019

Over 800,000 blood donors had their information leaked online due to a loophole in the system.

A cybersecurity expert was the first to spot the system fault. Thanks to his report, HSA disabled the database and the police were informed.

10. MOH, MOE accounts sold on the dark web in 2019

A Russia cyber-security group found details like usernames and passwords of accounts related to MOH, MOE, Singapore Police and NUS and payment care details on the dark web.

Based on a spokesman of A Smart Nation and Digital Government Group, the main reason for these leaks are the misuse of government email addresses.

Government email addresses were being used for personal purposes like sign-ups for events and marketing promotions.

Singapore prioritising cybersecurity

Singapore's track record doesn't seem to be great considering that there were other small-scale cases not on this list.

However, when we look at the bigger picture, the government is doing a lot to improve cybersecurity.

During the Trump-Kim Summit, there were 40,000 attacks on Singapore. None managed to succeed due to measures put in place by the Cyber Security Agency of Singapore.

Do you think more can be done to fend off nefarious cyberattacks? Let us know in the comments below.
Featured image from Google Maps and Google Maps.

Choi can be bought over with the right types of food. So feed him. Please.

# data[].attributes.attachment_link.title
10 Major Data Breaches In Singapore That Explain Why We Must Prioritise Cybersecurity

# data[].attributes.attachment_link.description
Singapore was ranked the safest country in the world based on a report by the World Justice Project in 2018. However, it seems that data breaches are threatening our online safety. In 2019 alone, there were 3 major data leaks that affected millions of Singaporeans.

# data[].attributes.body
1. Phishing
- Receiving a link disguised as a reputable brand eg. NTUC Voucher.
- When victim clicks, data is breached when personal is entered.

2. Human error
- Sent unauthorized information to the wrong client. Intentionally.

# data[].attributes.body
Examples of a breach might include:

* loss or theft of hard copy notes, USB drives, computers or mobile devices

* an unauthorised person gaining access to your laptop, email account or computer network

* sending an email with personal data to the wrong person

* a bulk email using 'to' or 'cc', but where 'bcc' (blind carbon-copy) should have been used

* a disgruntled employee copying a list of contacts for their personal use

* a break-in at the office where personnel files are kept in unlocked storage

Some of these incidents may happen through human error and honest mistakes. They could also occur through carelessness and a lack of procedure or guidance. It is therefore crucial that your organisation has a suitable data protection policy in place, and that all of your staff, including any volunteers, are aware of their responsibilities.

Even when a crime has been committed against you it is your responsibility to follow the necessary procedures, as the breach involves personal data under your control.

All staff must know how to recognise a breach and that they have a duty to make the organisation aware. Let them know that they should report a suspected breach to an identified member of staff (possibly a Data Protection Officer) who handles the rest of the procedure.

Often, this might be difficult for a member of staff to admit if they feel that they're at fault. It would be much worse if a breach is not reported for fear of sanction. It's important that you foster a culture of openness in your organisation to help meet your responsibility under the law.

Where a breach occurs, the organisation should first establish:

* the facts of what happened

* what personal data was involved

* the number of people likely to be affected

* the likelihood and severity of impact on the people affected