Singapore's SPH Media hit by cyberattacks; about 9% of customer database exposed, AI suspected

Singapore media group SPH Media said on Tuesday (10 November) that it was hit by a series of cyberattacks between 4 and 8 November affecting five of its internal systems, which it believes were a concerted effort by the same threat actor. About nine per cent of its customer database was affected.

Mostly email addresses exposed; no payment or password data

The exposed information was predominantly email addresses, along with some names, mailing addresses and phone numbers. Some employee email addresses were also compromised, but no corporate customers' information was affected. SPH Media said no payment card details, financial or banking information, passwords or customer account access were compromised, and its news websites and subscription services were unaffected.

Suspected AI-enabled attacks; regulators notified and police report filed

Based on preliminary investigations, SPH Media suspects the intrusions could have been AI-enabled, though this has not been confirmed. The company said the breaches arose from a combination of software vulnerabilities and system configuration issues. It has hired external cybersecurity experts to investigate, reported the incidents to Singapore's Personal Data Protection Commission, the Cyber Security Agency and the Infocomm Media Development Authority, and filed a police report. Affected individuals have been notified and warned to watch out for phishing attempts.

Sources: SPH Media media statement, 10 November 2026; The Straits Times, 10 November 2026.