Real Incident

A software migration and a 665,495-patron data breach

In 2023 – Marina Bay Sands (MBS) suffered a data breach involving approximately 665,495 patrons. A security-policy configuration was omitted during a major software migration and remained undetected for six months. PDPC found weaknesses in the company’s change management and security verification processes and imposed a S$315,000 penalty. Source: 2023; The Straits Times

Business Pain

Guest data exposure, PDPA penalties and lost trust

In hospitality and retail, guest data is everywhere: bookings, memberships, promotions and payments. When it leaks, the fallout is wide:

• LARGE SCALE CUSTOMER DATA EXPOSURE. Names and contact details of 665,495 patrons were exposed and offered for sale.

• REGULATORY PENALTY. PDPC imposed S$315,000, and financial penalties under the PDPA can reach up to 10% of annual Singapore turnover or S$1 million, whichever is higher.incident.

• PHISHING AND IDENTITY THEFT RISKS FOR GUEST. PDPC warned that leaked details can be used in phishing scams and identity theft.

• SILENT EXPOSURE. The gap stayed open for roughly six months before it was found.

• BRAND AND GUEST TRUST. Guests share data on the assumption that you’ll protect it.

What your company should do

Ransomware Protection checklist

• CONDUCT CYBERSECURITY RISK ASSESSMENTS BEFORE SYSTEM MIGRATIONS. Identify security vulnerabilities and data protection risks before implementing major system changes.

• ESTABLISH FORMAL IT CHANGE MANAGEMENT PROCEDURES. Document, approve and monitor changes to critical systems to prevent security gaps.

• IMPLEMENT INDEPENDENT SECURITY REVIEWS AND VERIFICATION. Introduce second-level checks to ensure critical security configurations are properly implemented.

• STRENGTHEN ACCESS CONTROL AND INFORMATION SECURITY POLICIES. Apply appropriate user permissions, security policies and access restrictions before systems go live.

• PERFORM SECURITY TESTING AND SYSTEM VALIDATION AFTER MIGRATION. Verify data protection, application security and API configurations to identify potential vulnerabilities..

• IMPLEMENT CONTINUOUS SECURITY MONITORING. Regularly monitor critical systems, detect configuration weaknesses and address cybersecurity threats promptly.

How TreeLabs Consulting helps

Cybersecurity Risk Assessment, Patch and Vulnerability Management and ISO 27001

TreeLabs Consulting helps you build the safeguards that catch problems like this before guests are affected:

• CYBERSECURITY RISK ASSESSMENT. A risk assessment in Singapore that reviews your systems, data flows and upcoming changes for security gaps.
• GAP ASSESSMENT. Check change management, access control and configuration review against ISO 27001.
• ISMS DEVELOPMENT & DOCUMENTATION. Develop an information security management system with documented policies and procedures covering change management, security reviews and system migration processes.
• ISO 27001 CYBERSECURITY AWARENESS TRAINING. ISO 27001 training in Singapore for project, IT and operations teams, so everyone understands their responsibilities.
• INFORMATION SECURITY AUDIT. Internal audit and ISO 27001 audit readiness in Singapore, with independent checks on critical configurations and controls.
• ISO 27001 CERTIFICATION SUPPORT. Guidance through the ISO 27001 certification audit in Singapore.
• ISO 27001 CONNECTION. Risk assessment, change management, access control, security procedures and continual improvement directly address the security weaknesses highlighted in this case.