27:I[35618,["/_next/static/chunks/0~kq_fcbb~0yz.js","/_next/static/chunks/08yvrn8o4u_2w.js","/_next/static/chunks/0_qr0a30p2r_0.js","/_next/static/chunks/0ybgfm2q~g8d3.js","/_next/static/chunks/0.933bw7~tln7.js","/_next/static/chunks/14gq.5yvzptgk.js","/_next/static/chunks/0p3obcb6~vnya.js","/_next/static/chunks/0nawjgi9~47r2.js"],"default"] 21:["$","div",null,{"className":"page-banner__category","children":[["$","div",null,{"className":"page-banner__illustration","children":["$","img",null,{"src":"/assets/5b626164-8019-4615-b710-58c6c35a0973.webp","alt":"","loading":"lazy","width":500,"height":300}]}],["$","span",null,{"children":"Announcements"}]]}] 22:["$","h1",null,{"children":"New Undertaking on 21 May 2025"}] 23:["$","span",null,{"className":"page-banner__date","children":["Published on ","21 May 2025"]}] 24:["$","div",null,{"className":"page-share","children":[["$","span",null,{"children":"Share:"}],["$","ul",null,{"children":[["$","li","facebook",{"children":["$","a",null,{"className":"st-custom-button","title":"Share to facebook","aria-label":"Share to facebook","data-network":"facebook","role":"button","children":[["$","span",null,{"className":"sr-only","children":"facebook"}],["$","span",null,{"className":"icon-facebook"}]]}]}],["$","li","linkedin",{"children":["$","a",null,{"className":"st-custom-button","title":"Share to linkedin","aria-label":"Share to linkedin","data-network":"linkedin","role":"button","children":[["$","span",null,{"className":"sr-only","children":"linkedin"}],["$","span",null,{"className":"icon-linkedin"}]]}]}],["$","li","whatsapp",{"children":["$","a",null,{"className":"st-custom-button","title":"Share to whatsapp","aria-label":"Share to whatsapp","data-network":"whatsapp","role":"button","children":[["$","span",null,{"className":"sr-only","children":"whatsapp"}],["$","span",null,{"className":"icon-whatsapp"}]]}]}]]}]]}] 28:T4a9,

This month, the Commission has issued one Undertaking.

The undertaking this month reveals a breach stemming from a ransomware attack, where a threat actor gained unauthorised access to the organisation’s system via a sister company’s server in Australia, resulting in the exfiltration of personal data belonging to 10,281 customers.

In response, the affected organisation is to implement remediation plan to rectify the immediate breach and address any systemic shortcomings to ensure compliance with the PDPA on a continual basis, such as:

Reviewing overseas data hosting and associated risks
Implement enhanced security measures including encryption and access controls across systems
Scheduling regular security audits in line with ISO 27001 standards
Providing employee training on data protection and cybersecurity

The PDPC has accepted the undertaking having considered the number of affected individuals, the types of personal data involved and the impact of the Incident.

Access the Undertaking here.