SIMBA said a data breach discovered on 24 September affected 23,549 people registered for its services. The exposed information included identity and contact details, but the company said credit-card and bank-account information was not at risk.
21
7
What information was exposed?
The data involved included customers’ names, identity-card numbers, dates of birth, mobile-phone numbers and email addresses.
21
26
SIMBA said investigations had found no indication, at that point, that the information had been maliciously misused. That is a status update from the company’s investigation, not confirmation that misuse could not occur later.
1
4
What did SIMBA say it was doing?
SIMBA said it had swiftly resolved the incident and taken immediate steps to review existing security measures intended to protect its core infrastructure and systems. Its notice did not detail the technical cause of the breach or the specific measures used to resolve it.
21
The company also said it was cooperating with relevant authorities. Singapore’s Personal Data Protection Commission was reported to be investigating the breach.
11
2
SIMBA planned to contact affected customers by email, with notifications expected to be completed the following week.
11
Why reports refer to different dates
The incident was discovered on 24 September. SIMBA’s own notice is dated 25 September, while several news reports about the disclosure appeared on 28 September. These dates refer to the discovery, the company’s notice and subsequent reporting, respectively.
21
7
9