Five SPH Media systems were hit by a series of cyberattacks, exposing about 9% of database records. The leaked data consisted mainly of subscribers’ email addresses, but also included some names, postal addresses and telephone numbers.
Preliminary investigations indicate that the attacks are believed to have been carried out by the same hacker or hacking group, possibly with the help of artificial intelligence (AI).
SPH Media, which publishes newspapers in all four official languages, including Lianhe Zaobao (《联合早报》) and The Straits Times (《海峡时报》), said in a statement on Tuesday (10 November) that the first cyberattack was detected on 4 November and the most recent on 8 November.
The affected systems fall into two groups. One stored some personal data, with the exposed records accounting for about 9% of the database. These consisted mainly of email addresses, but also included some names, postal addresses and telephone numbers. The other group of systems was also accessed without authorisation but did not store personal data.
The leaked data included some employees’ email addresses, but no corporate customers’ data was affected.
SPH Media stressed that no payment card, banking or other financial information was leaked, and that customer accounts remained secure. Its news websites and subscription services were unaffected and continued to operate as usual.
Upon discovering the cyberattacks, the company immediately took steps to secure the affected systems and engaged external cybersecurity experts to help investigate and prevent further intrusions.
The company has also notified the Personal Data Protection Commission, the Cyber Security Agency of Singapore and the Infocomm Media Development Authority, and lodged a police report.
SPH Media said it had notified everyone affected and urged them to be wary of unsolicited emails, text messages and telephone calls, particularly those requesting personal information, passwords or payments. It also warned them against clicking on suspicious links or attachments.
The company stressed that it takes the security and confidentiality of customer data very seriously and continues to work closely with the relevant authorities and external experts to protect the information entrusted to it.
