PDPC Publishes Four Undertakings on Ransomware and Unauthorized Access
Summary
Singapore's Personal Data Protection Commission (PDPC) has published four undertakings from organizations that experienced ransomware attacks and unauthorized access. These undertakings detail remediation measures to strengthen cybersecurity defenses and data protection practices.
What changed
The Personal Data Protection Commission (PDPC) has published four new undertakings from organizations that suffered data breaches due to ransomware attacks and unauthorized access, often caused by exploiting legitimate credentials. Common contributing factors identified include weak access controls, outdated firewalls, and default account usage. These incidents highlight significant gaps in the organizations' cybersecurity defenses and business operation disruptions.
Under these binding undertakings, the affected organizations are committed to implementing comprehensive remediation measures. These include enforcing multi-factor authentication, conducting regular vulnerability assessments and penetration testing, hardening server configurations, segmenting networks, and enhancing staff training on cybersecurity awareness. The PDPC accepted these undertakings after evaluating the nature of the data affected, the incident circumstances, and the organizations' plans to meet their obligations under the Personal Data Protection Act (PDPA).
What to do next
- Review incident response and cybersecurity measures for ransomware and unauthorized access vulnerabilities.
- Implement multi-factor authentication for all systems and administrative accounts.
- Conduct regular vulnerability assessments and penetration testing.
Source document (simplified)
This week, the Commission has published four Undertakings.
The incidents involved a mix of ransomware attacks and unauthorised access by exploiting legitimate login credentials, which disrupted business operations and exposed gaps in the organisations' cybersecurity defences. Common contributing factors included weak access controls, use of outdated firewall, software, and default accounts.
To address these issues and strengthen data protection practices, the organisations will be implementing a range of remediation measures, including:
- Enforcing multi-factor authentication across systems and administrative accounts
- Performing regular vulnerability assessments and penetration testing
- Hardening server configurations and segmenting network access
- Training staff on cybersecurity and data protection awareness
- Obtaining relevant data protection and cybersecurity certifications The PDPC has accepted these Undertakings after considering the types of personal data affected, the circumstances surrounding each incident, and the organisations' readiness to implement their remediation plans to meet their obligations under the PDPA.
Access the Undertakings here.
Related changes
Source
Classification
Who this affects
Taxonomy
Browse Categories
Get Data Protection alerts
Weekly digest. AI-summarized, no noise.
Free. Unsubscribe anytime.
Get alerts for this source
We'll email you when PDPC Announcements (Singapore) publishes new changes.