SPH Media hit by data breach affecting 9% of its database

[SINGAPORE] SPH Media said on Tuesday (Nov 10) that it has been hit by a data breach affecting about 9 per cent of its database, with cyberattacks identified on five of its systems.

No payment card details, financial, banking information or customer account access were affected. Impacted parties have been informed and advised on precautions to take.

SPH Media declined to give specifics on the number of individuals affected.

The cyberattacks were first discovered on Nov 4, with unauthorised access detected on two portals used by staff and vendors supporting subscriber orders. Subsequent attacks were detected on following days, with the latest being on Nov 8.

Based on preliminary investigations, the attacks are suspected to have been artificial intelligence-enabled and carried out by the same threat actor. The incident was a direct cyberattack on SPH Media, and not through phishing attempts, users clicking on links or through a third-party system.

A combination of factors such as software bugs and system configuration resulted in the breach. Bug fixes and system configuration have been updated since.

THE BUSINESS TIMES INSIGHTS

Powering Asean's Future 2026

Find out how enterprises are navigating power constraints and sustainability targets

ACCESS THE INSIGHTS

“We are continuing to keep a close watch on our systems, as cybersecurity attacks can happen anytime and at any frequency,” said an SPH Media spokesperson.

The company took steps to secure affected systems after discovering the incidents. It has also engaged a cybersecurity firm, which specialises in digital forensics and incident response, to investigate and contain the breaches.

“We concurrently reported the incident to the Personal Data Protection Commission, Cyber Security Agency of Singapore, Infocomm Media Development Authority and filed a police report,” the spokesperson added.

SEE ALSO

Doctor Anywhere hit by data breach due to ‘malicious cyber incident’ involving unknown third party

M1 hit by data breach

MoneySmart hit by data breach; Singapore, Hong Kong customers affected

This breach comes in the wake of a number of data breaches at companies such as Singapore Airlines, M1, Doctor Anywhere and MoneySmart.

“We advise customers to remain vigilant and exercise caution for suspicious and unsolicited emails, messages and calls, particularly those requesting personal information, passwords or payments, and to avoid clicking on suspicious links or attachments,” the spokesperson said.