20:["$","div",null,{"className":"page-banner__category","children":[["$","div",null,{"className":"page-banner__illustration","children":["$","img",null,{"src":"/assets/5b626164-8019-4615-b710-58c6c35a0973.webp","alt":"","loading":"lazy","width":500,"height":300}]}],["$","span",null,{"children":"Announcements"}]]}] 21:["$","h1",null,{"children":"New Undertakings on 23 January 2025"}] 22:["$","span",null,{"className":"page-banner__date","children":["Published on ","23 Jan 2025"]}] 23:["$","div",null,{"className":"page-share","children":[["$","span",null,{"children":"Share:"}],["$","ul",null,{"children":[["$","li","facebook",{"children":["$","a",null,{"className":"st-custom-button","title":"Share to facebook","aria-label":"Share to facebook","data-network":"facebook","role":"button","children":[["$","span",null,{"className":"sr-only","children":"facebook"}],["$","span",null,{"className":"icon-facebook"}]]}]}],["$","li","linkedin",{"children":["$","a",null,{"className":"st-custom-button","title":"Share to linkedin","aria-label":"Share to linkedin","data-network":"linkedin","role":"button","children":[["$","span",null,{"className":"sr-only","children":"linkedin"}],["$","span",null,{"className":"icon-linkedin"}]]}]}],["$","li","whatsapp",{"children":["$","a",null,{"className":"st-custom-button","title":"Share to whatsapp","aria-label":"Share to whatsapp","data-network":"whatsapp","role":"button","children":[["$","span",null,{"className":"sr-only","children":"whatsapp"}],["$","span",null,{"className":"icon-whatsapp"}]]}]}]]}]]}] 27:T499,

This month, the Commission has issued three Undertakings.

The new Undertakings reveals breaches stemming from various ransomware attacks due to exploitation of administrative accounts, inadequate access controls implemented and weak password security, affecting the personal data of over 14,477 individuals.

In response, the affected organisations are to implement remediation plans to rectify the immediate breach and address any systemic shortcomings to ensure compliance with the PDPA on a continual basis, such as:

Implement mandatory single sign-on and enable two-factor authentication for selected accounts
Implementing encryption to mask personal data
Implement security solutions to improve threat detection and response
Conduct training for employees on the organisation's security protocols

The PDPC has accepted these undertakings having considered the number of affected individuals, the types of personal data involved and the impact of the Incident.

Access the Undertakings here.