No clear link between recent data breaches; incidents appear to be result of 'opportunistic attacks': PDPC

SINGAPORE: Recent data breaches involving several organisations appear to have been the result of opportunistic attacks, with no clear connection between them, the Personal Data Protection Commission (PDPC) said on Friday (Nov 13).

Preliminary indications were that the “significant data breaches” reported in the past week resulted from opportunistic attacks exploiting common vulnerabilities in IT systems, the commission said.

It added that there was no clear connection between incidents, and some were related to global data breaches.

On Friday, the Cyber Security Agency of Singapore (CSA) also said that the recent cyber incidents did not appear to be part of coordinated campaigns targeting Singapore.

Instead, they reflected "a broader global trend of opportunistic attacks".

In recent weeks, cyberattacks have hit multiple organisations in the healthcare sector, including Minmed, Doctor Anywhere, Fullerton Health and the Agency for Integrated Care.

Data breaches have also been reported by M1, Singapore Airlines and SPH Media, involving the exposure or potential exposure of personal information.

Connected systems support business efficiency and innovation, but their interconnectedness also carries risks, PDPC said.

These include third-party supply chain risks and the exploitation of application programming interfaces (APIs).

“When threat actors find a vulnerability at any part of these connected systems, they find it easier to move laterally through the different systems,” PDPC said.

“They may also find it easier to gain remote access to the systems, as well as impact other third parties in the organisation’s supply chain.”