Courts fined $178,000 for massive data leak affecting close to 1 million customers, employees

SINGAPORE – Electronics and furniture retailer Courts has been fined $178,000 over a ransomware attack that compromised the personal data of nearly one million people, marking its third breach of data protection obligations since January 2019.

The Sept 2022 attack affected 946,972 people, comprising 941,513 customers and 5,459 current, former and prospective employees, according to a Personal Data Protection Commission (PDPC) decision dated Aug 11 and published on its website on Oct 26.

Among the most sensitive information affected were employees’ bank account details and information about their creditworthiness. Customer data included names, identification numbers, addresses, phone numbers and, for some, the last four digits of credit card numbers.

The attacker was said to have broken into Courts’ network around Sept 21, 2022, through servers intended to keep its business running if its main systems failed.

Two of these disaster recovery servers were accessible over the internet. Investigations indicated that the attacker scanned for vulnerable network entry points and repeatedly attempted to gain access, before obtaining a system administrator’s login credentials through unknown means.

Connections between the disaster recovery servers and the rest of Courts’ network then allowed the attacker to reach other systems.

Ransomware was installed on 26 servers, fully or partially encrypting data on 20 servers. Courts detected malware around Sept 26.

On Oct 1, a customer service employee received a ransom demand seeking an unspecified payment for a password to recover the encrypted files. Courts did not respond, and no further contact from the attacker was reported.

To contain the incident, remedial measures included isolating affected servers, restoring systems from clean backups, installing security updates and tightening access controls were taken.

There was no evidence that the affected data had been taken out of Courts’ systems. Monitoring of the dark web and internet for 12 months also found no signs of public disclosure.

The PDPC found that Courts had failed to conduct security checks that could that could have uncovered and addressed the weaknesses exploited in the attack.

The retailer had excluded its recovery servers from regular vulnerability scans because it did not consider them critical, as they were not routinely used for business operations.

The commission rejected this reasoning, noting that the servers provided access to other systems holding large volumes of personal data.

Courts also failed to ensure timely security updates. The two internet-facing recovery servers had not received the latest patches since July 6, 2022, while multiple other servers ran outdated operating systems such as Windows Server 2008, which Microsoft had stopped supporting in January 2020.

In determining the fine, the PDPC considered the scale of the incident, the sensitivity of employees’ financial information and Courts’ repeated failures despite two earlier penalties.

In a statement, Courts accepted the decision and apologised to affected customers and staff. It said it had strengthened its security measures, engaged cybersecurity specialists to investigate the incident and appointed an external vendor to review the affected data.

It also set up a support channel at corpcomms@courts.com.sg.

Courts notified affected employees because their financial information had been accessed without authorisation by the hackers. It did not notify customers, assessing that their affected information was unlikely to cause significant harm.

This is not Courts’ first data protection breach.

In 2020, Courts was fined $9,000 after a faulty link in a membership email sent to 76,844 customers allowed users to access another member’s account without authentication.

In January 2019, it was fined $15,000 over a website flaw that exposed customers’ phone numbers and residential addresses to anyone entering a matching email address on its guest checkout page.

The PDPC said: “The Organisation’s systemic failings to implement basic cybersecurity policies and practices such as security reviews and patch management despite the previous financial penalties, warrant a higher financial penalty for more effective deterrence.”