Internal IT systems at financial services website MoneySmart have been breached by an unauthorised third party, with some Singapore and Hong Kong users’ personal data copied.
MoneySmart founder and chief executive Vinod Nair said in a LinkedIn post on Tuesday (3 November) that the platform discovered the unauthorised third-party intrusion on 29 October. The affected systems store personal data provided by customers when comparing and applying for financial products on the platform.
He said the platform took immediate action after discovering the incident to cut off unauthorised access and strengthen system security. It also engaged independent cybersecurity and digital forensics experts to investigate further.
In a statement issued the same day, the platform said it had confirmed that some Singapore and Hong Kong users’ personal data, including names, email addresses and mobile phone numbers, had been copied.
Nair wrote, “I am deeply sorry that this happened. We are responsible for protecting your information and resolving this is our highest priority.”
Nair stressed that MoneySmart continued to operate as usual, adding that “we are committed to supporting our customers”.
MoneySmart also said it had notified the relevant regulatory authorities, including the Personal Data Protection Commission and the Monetary Authority of Singapore. It has also strengthened access controls and monitoring across its systems and set up a dedicated team to assist affected users.
It remains unclear how many users have been affected. MoneySmart has also not disclosed how the unauthorised party gained access to its systems.
In response to questions from Lianhe Zaobao, including how many users the platform currently has and how many were affected by the incident, the platform declined to comment, saying only that the investigation was ongoing.
The platform also listed some types of data that may have been affected, including information submitted by users to claim rewards, their MoneySmart profiles and details of travel insurance purchased through the platform.
The platform urged users to remain vigilant and take necessary precautionary measures. These include regularly checking bank card statements and immediately reporting any unauthorised transactions to their banks; treating requests to verify personal data with caution; remaining alert to calls, emails and text messages from unknown sources; and never disclosing passwords, one-time passwords (OTPs) or verification codes to others.
Founded in 2009, MoneySmart provides financial services including financial product comparisons and applications, as well as insurance advice. According to its official website, the platform currently works with more than 70 banks, insurers and other financial institutions, including DBS, HSBC and Standard Chartered.
The platform has processed more than 1.58 million transactions since its founding. The company’s revenue grew 26% year on year last year.