Five systems at SPH Media were hit by a series of cyberattacks, resulting in data leaks affecting about 9% of database records. The leaked data consisted mainly of subscribers’ email addresses, but also included some names, postal addresses and telephone numbers. No payment card, banking or other financial information was leaked.
Preliminary investigations indicate that the attacks are believed to have been carried out by the same hacker or hacking group, with the help of artificial intelligence (AI).
SPH Media, which publishes newspapers in all four official languages, including Lianhe Zaobao (《联合早报》) and The Straits Times (《海峡时报》), said in a statement on Tuesday (10 November) that the first cyberattack was detected on 4 November and the most recent on 8 November.
The five affected systems fall into two groups, one of which stored some personal data. The leaked data consisted mainly of subscribers’ email addresses, but also included some employees’ and corporate customers’ email addresses. Only a small number of customers’ names, postal addresses and telephone numbers were leaked. The other group of systems was also accessed without authorisation but did not store personal data.
An SPH Media spokesperson stressed that no payment card, banking or other financial information was leaked, and that customer accounts remained secure. Its news websites and subscription services were unaffected and continued to operate as usual.
Upon discovering the incidents, the company immediately took steps to secure the affected systems and engaged external cybersecurity experts to help investigate and contain the breaches. It has reported the incidents to the Personal Data Protection Commission, Cyber Security Agency of Singapore and Infocomm Media Development Authority, and filed a police report.
SPH Media has also informed everyone affected and advised them to be wary of unsolicited emails, text messages and telephone calls, particularly those requesting personal information, passwords or payments. It also warned them against clicking on suspicious links or attachments.
The spokesperson stressed that the company takes the security and confidentiality of customer data very seriously and continues to work closely with the relevant authorities and external experts to protect it.
Questions and answers about the cyberattacks:
Q: Who was behind the cyberattacks?
A: Based on the attack patterns, investigators have reasonable grounds to believe that all the incidents were the work of the same hacker or hacking group, possibly aided by AI. The company is still investigating the hacker’s identity and location and cannot confirm whether the attacks are linked to recent large-scale cyberattacks in Japan, South Korea and elsewhere.
Q: Was the data breach caused by a cyberattack on an external vendor?
A: These were direct cyberattacks on SPH Media’s systems, stemming from software flaws and system configuration issues. They were not caused by phishing, employees mistakenly clicking on malicious links or third-party vendors. The affected systems are managed by SPH Media itself.
Q: What measures has SPH Media taken in response?
A: After discovering the first cyberattack, the company immediately took steps to secure the affected systems, patch software vulnerabilities and update system configurations. It also engaged external digital forensics experts to assist. SPH Media has engaged a leading digital forensics firm to verify the integrity of its network and conduct forensic analysis. The company has also notified the Personal Data Protection Commission, Cyber Security Agency of Singapore and Infocomm Media Development Authority, and filed a police report.
Q: How is the company preventing further AI-aided cyberattacks?
A: Besides fixing software flaws and tightening system configurations, SPH Media has taken steps to strengthen its defences. AI-aided cyber threats are becoming more common. The company has enhanced its cybersecurity measures to better detect such attacks, identify vulnerabilities earlier and remediate them swiftly.
