MoneySmart data breach hits S’pore, HK users; IC numbers, financial info potentially exposed

SINGAPORE – The personal data of some MoneySmart customers in Singapore and Hong Kong has been compromised after hackers breached the personal finance portal’s internal IT systems in October.

In an e-mail sent to affected users on Nov 2 and 3 and seen by The Straits Times, the platform said an unauthorised third party gained access to some of its internal information technology systems on Oct 29.

“These systems hold personal data that customers share with us when they compare or apply for financial products through MoneySmart,” it said.

MoneySmart’s online platform allow consumers to evaluate, compare and apply for financial products, including credit cards, personal loans and travel insurance.

In response to queries from The Straits Times on Nov 3, the company confirmed that personal data belonging to some customers in Singapore and Hong Kong was copied.

Customer details that were potentially accessed include:

• Personal particulars: Names, dates of birth, nationality and personal identification numbers

• Contact information: E-mail addresses, mobile numbers and shipping addresses

• Financial profiles: Income ranges, life stages, and financial products currently owned

• Vehicle and insurance details: Vehicle information, car insurance enquiries or policies

The company is contacting customers impacted by the breach directly to explain what data was involved and recommend steps they can take to protect themselves.

“As soon as we discovered the incident, we stopped the unauthorised access and took steps to secure our systems,” MoneySmart chief executive officer Vinod Nair said.

Regulators in both markets have been alerted, including the Personal Data Protection Commission (PDPC) and the Monetary Authority of Singapore (MAS), alongside the Office of the Privacy Commissioner for Personal Data and the Insurance Authority in Hong Kong.

Independent cybersecurity and digital forensics experts have been hired to investigate the breach, the company added.

Meanwhile, MoneySmart emphasised that its operations continue as normal.

“MoneySmart continues to operate as normal, and we are committed to supporting our customers,” said MoneySmart CEO Nair.

“We are reviewing everything that led to this incident and making the changes needed to prevent it from happening again,” he added.

“I am deeply sorry to everyone affected,” said Nair. “Customers trust us with information about their financial lives, and we take that responsibility very seriously.”

ST has contacted MoneySmart, PDPC, MAS, the Cyber Security Agency of Singapore and the police for more information.