Financial services firm MoneySmart hit by IT security breach, some customers' data copied

SINGAPORE: Financial services company MoneySmart said on Tuesday (Nov 3) that personal data of some of its customers was copied by an "unauthorised third party" in a data security incident.

It said that it discovered on Oct 29 that the third party had accessed some of its internal IT systems, and its investigation confirmed that some of its customers in Singapore and Hong Kong were affected.

The company stopped the unauthorised access and took steps to secure its systems soon after the discovery, said chief executive officer Vinod Nair in a note on the company's website.

MoneySmart also reported the incident to the relevant authorities and engaged independent cybersecurity and forensics experts to investigate further, he added.

"I am deeply sorry to everyone affected. Customers trust us with information about their financial lives, and we take that responsibility very seriously," he said.

MoneySmart is reaching out directly to affected customers to explain what data was compromised and the steps they can take to protect themselves, he added.

"MoneySmart continues to operate as normal, and we are committed to supporting our customers ... We are reviewing everything that led to this incident and making the changes needed to prevent it from happening again."

In emails sent to customers seen by CNA, MoneySmart said the compromised internal IT systems hold personal data, such as names and email addresses, that customers share with the company when they compare or apply for financial products.

The company added that those who have submitted reward claims may also have had their shipping address and the application or policy reference number for the claimed product copied by the third party.

It recommended customers to take precautionary steps, including checking their card statements and reporting any transaction they do not recognise to their bank promptly.

They should also be wary of delivery or reward messages that ask them to confirm their details or pay a fee, and be alert to unexpected calls, emails and messages.

The company said that it has informed the relevant regulators, including the Personal Data Protection Commission (PDPC).

CNA reached out to MoneySmart for more information, including the number of customers affected. In response, the company forwarded the same statement that it had posted on its website, which does not answer the questions CNA submitted.