Singapore’s Singtel Says Personal Information Of 1,29,000 Users Stolen In Data Breach

Personal information of about 1,29,000 customers of Singapore's leading telecom company Singtel has been stolen after a recent data breach of a third-party file-sharing system, the company said.

Singtel, an associate of Bharti Airtel, has completed initial investigations into the breach and established which files on the Accellion file transfer appliance (FTA) were accessed illegally, reported Channel News Asia on Wednesday, citing the company's news release.

Singtel's Group CEO Yuen Kuan Moon has apologised to customers for the data breach and assured that data privacy is paramount and support in mitigating the potential risks.

The stolen personal information includes the customers' National Registration Identity Card numbers and a combination of names, dates of birth, mobile numbers and addresses, the group said.

In addition, bank account details of 28 former Singtel employees and credit card details of 45 staff members of a corporate customer with Singtel mobile lines were taken.

"Some information from 23 enterprises, including suppliers, partners and corporate customers, was also stolen. The company has started notifying all affected individuals and enterprises to help them and their staff manage the possible risks involved and take appropriate follow-up action,” Singtel said.

Apologising to the customers over the incident, Yuen said, "While this data theft was committed by unknown parties, I am very sorry this has happened to our customers and apologise unreservedly to everyone impacted.

"Data privacy is paramount, we have disappointed our stakeholders and not met the standards we have set for ourselves.

"Given the complexity and sensitivity of our investigations, we are being as transparent as possible and providing information that is accurate to the best of our knowledge. We are doing our level best to keep our customers supported in mitigating the potential risks,” the CEO said.

Singtel said a "large part" of the leaked data includes its "internal information that is non-sensitive such as data logs, test data, reports and emails”.

Accellion FTA, which Singtel used as a third-party file-sharing system, was the target of a sophisticated cyberattack, exploiting a "previously unknown vulnerability", said the telecom.

When it was first alerted to exploits against the system in December last year, Singtel "promptly applied" a series of patches provided by Accellion to "plug the vulnerability", it said.

On January 23, Accellion advised that a new vulnerability had emerged that rendered the earlier patches applied in December ineffective.

Singtel immediately took the system offline, and the FTA system has been kept offline since January 23, said the company.

"On January 30, Singtel's attempt to patch the new vulnerability in the FTA system triggered an anomaly alert. Accellion informed thereafter that the system could have been breached," it said.

The telecom’s investigations later confirmed the breach and identified January 20 as the date it had occurred.

"On February 9, Singtel established that files were taken as a result of the breach and informed the public two days later on February 11," said the company.

On Wednesday, Singtel said it was appointing a global data and information service provider to provide identity monitoring services at no cost to affected customers to help them "manage potential risks".

This service monitors public websites and "non-public places" on the Internet, and notifies users of any unusual activity related to their personal information.

Singtel's core operations and functions remain "unaffected and sound" as the incident involves a standalone system provided by a third-party vendor, Yuen assured.

"Information security remains our highest priority and you have my commitment that we are conducting a thorough review of our systems and processes to strengthen them," he added.