Singapore's MoneySmart confirms customer data copied in breach affecting Singapore and Hong Kong users

Financial comparison platform MoneySmart has confirmed that an unauthorised third party accessed its internal IT systems and copied personal data belonging to some customers in Singapore and Hong Kong. The company discovered the intrusion on October 29, cut off the access and secured its systems, then emailed affected customers on November 2-3 and disclosed the incident publicly on November 3. Chief executive Vinod Nair has apologised to affected customers and said services continue to operate normally.

What may have been exposed

What was copied varies by customer, depending on how they used the platform. From customer emails reviewed by CNA, names and email addresses are confirmed; The Straits Times reports a wider set, including dates of birth, nationalities, identification numbers, mobile numbers, mailing addresses, income ranges, financial products held, and vehicle and car insurance details. Customers who submitted reward claims may also have had shipping addresses and application or policy reference numbers copied. MoneySmart has not disclosed how many customers were affected, how the intruder got in, or when the access began.

Regulators notified, investigation under way

MoneySmart says it has notified Singapore's Personal Data Protection Commission (PDPC) and the Monetary Authority of Singapore, as well as Hong Kong's Office of the Privacy Commissioner for Personal Data and the Insurance Authority, and has engaged independent cybersecurity and digital forensics experts. The PDPC has confirmed to CNA that it is investigating; no final regulatory findings have been announced. The company has set up a dedicated support team for affected customers, reachable at [email protected].